IPSec policy

[Joel Gacosta]

Hello All,

I want to implement IPSec policy on my server with 2 ethernet cards(one with
public IP connected to Internet and one connected to private LAN). I want to
filter incoming traffic on public IP to allow only port 80 while allowing
all outbound traffic from my private LAN to pass. How can I accomplished
this using IP Filter List?

thanks in advance!

 

[Steven L Umbach]

Ipsec is a non stateful packet filtering mechanism and you will not really
be able to do what you want if you want to allow all outbound traffic
because you will have to create a mirrored rule to allow traffic back into
any port/protocol which will effectively leave everything open. If you want
to allow only specific outbound traffic you can built a more effective
packet filtering firewall. Ipsec is not meant to be an internet firewall, at
least as the first line of defense. A much better solution would be to get
an inexpensive NAT router/firewall to protect your server. If you still want
to pursue ipsec, see the link below on how to configure a policy with permit
and deny filter actions. If you want a filter to apply to only a particular
network adapter, enter the IP address of that network adapter instead of "
my IP " in the filter source or destination. --- Steve

http://www.securityfocus.com/infocus/1559
http://support.microsoft.com/kb/811832 -- ipsec information on default
exemptions.