Logon to a Windows2000 DC through Firewall

bbb · #1 (**permalink**) 08-01-2002, 06:52 PM

Hi,

anyone knows exactly which Ports are really needed to login a Win2000 DC from a Client or Server in a DMZ through the Firewall onto an internal win2000 Domain Controller?
The target is to let a proxyserver/viruswall located in DMZ(not_ASL)login the internal Domaincontroller so that it can authenticate requests from the clients against the internal domain.
The internal DC is installed in compatible mode not in native mode.

I opened many Ports for that but i am not sure if they are all needed.
(CIFS,nbdgram,135tcp,139_udp,ldap389tcp/udp,kerberos_auth_88,MicrosoftLSA_1026,DNS_udp,pin g for testing)
I havent opened microsoft_ds_445 ... maybe one got some better experience with less ports?????

BBB

fnacer · #2 (**permalink**) 08-04-2002, 08:40 AM

Here's the no-guess approach I use. Disable any rules you may already have to access the Win2k server. Then set up a rule to "Log Drop" all traffic to it. Attempt to access the server. The log will show you what ports you need.

Hope this helps.

Farid

bbb · #3 (**permalink**) 08-04-2002, 12:13 PM

Heh...that would not give me all information i need. Because after connecting the first used Port there will be another approach to other service etc...okay i could test port by port and open em one after another...grmpfl

Biffa · #4 (**permalink**) 08-05-2002, 09:58 AM

Quote:

Originally posted by Bernd Buchenberger:
Heh...that would not give me all information i need. Because after connecting the first used Port there will be another approach to other service etc...okay i could test port by port and open em one after another...grmpfl

<font size="2" face="Verdana, Arial">Try this thread.