Re: TCP/IP Filtering Question

From: Herb Martin (news_at_LearnQuick.com)
Date: 01/27/05 

Date: Wed, 26 Jan 2005 18:19:23 -0600

"Marcus" <Marcus@discussions.microsoft.com> wrote in message
news:C2BBBD78-683B-4DA0-8599-EE13C5EB20AF@microsoft.com...
> The idea behind what I'm trying to do is to implement the open source SSL
> Explorer on the Windows 2000 Server, which would supply secure
communications
> to workstations with a SSL VPN tunnel. Since the VPN is SSL, it only needs
> access to port 443.

If you are using Win2000+ as your router you might just
(about as) easily just use the actual IPSec facilities.

> By shutting down all TCP/IP ports, except 443, this will
> allow users to have a secure gateway into the other network through the
> Windows server. The main goal is to avoid IPSec. Does anyone have any
other
> ideas? Thanks.

Your GOAL is to avoid the built-in IPSec in favor of
something add-on?

As for using the SSL then we were answering your
question about blocking all other traffic (pairs) using
IPSec FILTERS -- not IPSec itself.

IPSec filters have three behaviors:

    1) BLOCK
    2) PASS
    3) NEGOTIATE (actual IPSec)

This is a much better filtering method than the trivial and
near useless NIC filters.

If you really MUST AVOID IPSec (Filters) then use the
RRAS filters (which are actually even better.) 

-- 
Herb Martin
>
> "Steven L Umbach" wrote:
>
> > For what you are doing you might want to try ipsec filtering policy
using
> > permit and block fitter actions instead on that router computer. If you
do
> > not want the same ipsec policy applied to both adapters, then configure
the
> > actual IP address of the network adapter you want to filter instead of
"my
> > address". Ipsec filtering will not block multicast and broadcast
traffic,
> > kerberos, IKE, or RSVP traffic by default if that is a concern, though a
> > registry mod can change most of that. Ipsec can also manage traffic in
both
> > directions. The link below explains more.  ---- Steve
> >
> > http://www.securityfocus.com/infocus/1559
> >
> > "Marcus" <Marcus@discussions.microsoft.com> wrote in message
> > news:9A90D9A0-EC72-4982-9A75-E1AA60323DDB@microsoft.com...
> > >I have a Windows 2000 Server acting as a router between two different
> > > networks (10.29.x.x and 10.22.x.x). I want to configure network
10.29.x.x
> > > to
> > > be only able to get to the server/router through port 443. I have
tried
> > > enabling TCP/IP filtering on that network's NIC accepting only port
443,
> > > however, all this has done is block the PCs from getting an IP address
> > > from
> > > the DHCP server. Once I give the workstation a static IP in the
10.29.x.x
> > > range all traffic goes right through NIC and ignores the TCP/IP
filters.
> > > Thanks for any help.
> >
> >
> >

Relevant Pages

  • Re: IPSec without encryption between intranet and standalone
    ... Are _all_ of your filters set to either permit or block actions, ... I've also unassinged the IPSec polcy and instantly the 'lag' disappears ... Microsoft MVP (Windows Server: Security) ... security associations (Kerberos and talk of shared key). ...
    (microsoft.public.win2000.security)
  • Corrupt IPSEC service
    ... admin workstation rebooted and since then cannot use IPSEC. ... Generic MM Filters ... These Windows services are started: ... Machine Debug Manager ...
    (microsoft.public.windowsxp.security_admin)
  • RE: Inbound filters not workign
    ... Do you use public IP or private IP between RRAS server and client? ... How do you configure filters in Routing and Remote Access Service? ... Protocol security (IPSec) filtering rules can be used to help protect ... Windows 2000-based, Windows XP-based, and Windows Server 2003-based ...
    (microsoft.public.win2000.ras_routing)
  • Re: Problem with IPSEC
    ... yes ipsec filters are weighted such that a specific rule overrides ... ipsec in XP like you can for Windows 2003 to see events for dropped traffic. ... Ethereal while connecting connect to a website. ... I use IPSEC to control internet access on a domain. ...
    (microsoft.public.windows.server.security)
  • RE: IPsec vs any personal software firewall
    ... This prevents the source port 88 issue. ... It is possible to bypass the filters and contact a service listening on UDP. ... Should you use it if you have a firewall running externally of the machine? ... IPSec filters are not a replacement for a firewall. ...
    (Focus-Microsoft)
Loading