Firewall & Hackers - help please!!

[Heather]

I have 2 W2k servers one of them running exchange. We use
webmail, but that is pretty much the extent of our need to
get on the servers from outside the office. No VPN, no
FTP, etc. Well - I just enabled audits on success &
failure of logons & it appears I've got people trying to
hack into the system. What ports on my hardware firewall
do I need to block or what ports do I need to enable in
order to stop this.

Oh - I also have an inhouse Mac that uses the SMB port to
connect to e-mail.

Thanks!!
Heather

 

[Lanwench [MVP - Exchange]]

Immediately block ALL inbound ports except what you need:

You need 25 for mail (use port forwarding where needed to get your mail to
your Exchange server's private IP), 80 for OWA (or, even more ideally, 443
for SSL - I would force this), 110 if you have external POP users.