How do you get XP Pro and W2K Pro to talk?

[Ted Byers]

I am crossposting to the networking newsgroups for W2K and XP since this
problem involves networking on both W2K and XP.

In this tiny LAN, there are two machines, one running W2K and XP. They are
connected using a router, which also connects via DSL to the internet, and
this router's DHCP server capability is configured to give the two machines
non-routable IP addresses, as you'd expect. Both machines can connect to
the Internet, and use it, without any problems at all. I can ping the IP of
each from the other. However, in the Network Neighborhood on each, the
other does not appear. Both machines are in the default workgroup called
WORKGROUP. Printer sharing wouod be useful right now, since the one
connected to the W2K machine is presently acting up. However, most
importantly, we need file sharing, but in a way that does not expose our
systems to the Internet.

If part of the problem involves the firewall, turning the firewall off is
NOT an option. I ran into a problem configuring MySQL which turned out to
be caused by the firewall, and the advice universally given was shut down
the firewall. Frankly, this defeats the purpose of having a firewall and
makes systems quite vulnerable. I investigated the settings for the
firewall (Norton's Internet Security suite, in this instance, running on
W2K), and found a way to reconfigure it so that the firewall could stay up
and protect my system while at the same time allow MySQL to work behind the
firewall. If the issue, here, is related to the firewall, tell me how to
reconfigure it so that these two workstations can see each other without
being made vulnerable to hackers attempting to break in from the web.

I have some specific questions and concerns.

1) File and Print sharing is not installed on the W2K machine. If I install
it, can it be restricted to only those non-routable IP addresses issued by
the DHCP server in the router? If so, how? If not, how can I prevent
installing this from making my system vulnerable to the attacks known to
gain access to computers through file and print sharing? (I still have to
check on whether or not this is installed on the XP workstation, but the
rest of the question applies to it too).

2) Netbios is not enabled over TCP/IP on the NIC connected to the router.
If I enable it, can it be restricted to only those non-routable IP addresses
issued by the DHCP server in the router? If so, how? If not, how can I
prevent enabling this from making my system vulnerable to the attacks known
to gain access to computers through Netbios being enabled over TCP/IP? (I
still have to check on whether or not this is enabled on the XP workstation,
but the rest of the question applies to it too).

3) I seem to recall reading something about XP having some firewall
capability being built into it. Is it true that XP has firewall capability?
If so, how should it be configured to facilitate the usual networking needs
on a peer to peer LAN without the machines on the LAN being vulnerable to
attack from the web.

4) As I am doing some web development, I will need IIS and Apache on both
machines (not necessarily active at the same time - but it would be nice if
it is possible) to be visible to the other. I don't know if this will be a
problem or not. But I mention it just in case it has a bearing on how the
two machines and their firewalls are configured.

5) If all goes well, I will be adding a Linux based server, as well as an
OpenBSD gateway (providing an extra layer of firewall protection and
routing, aimed at creating a DMZ and proxy hosting for Apache), and one of
the packages I'd have on that server will need to run scripts and programs
on the Windows clients, so I expect I'd need Samba to be installed
eventually. Therefore, any solution will need to be designed to allow for
this eventuality. It would be good, if at a minimum, someone with
experience with such mixed LANs could comment on how the procedure to make
these machines visible to each other would affect my plans to add a Linux
box and an OpenBSD box to the LAN at some time in the near future.

Cheers,

Ted

 

[Lanwench [MVP - Exchange]]

One quick piece of advice - use a broadband router with a built-in firewall
at the perimeter. They're pretty cheap - you can pick up a NetGear FVS318
for about $120USD, and there are comparable Linksys products....

If you need software firewalls on the workstations in addition to this,
which on your small network I'd find unlikely, don't use ICF - it isn't very
configuable. Re NetBIOS over TCP/IP - yes, you'll need this enabled to
browse.

 

[Ted Byers]

"Lanwench [MVP - Exchange]"

One quick piece of advice - use a broadband router with a built-in firewall
at the perimeter. They're pretty cheap - you can pick up a NetGear FVS318
for about $120USD, and there are comparable Linksys products....

Actually, I am using a Linksys router that has builtin firewall capability.

If you need software firewalls on the workstations in addition to this,
which on your small network I'd find unlikely, don't use ICF - it isn't very
configuable. Re NetBIOS over TCP/IP - yes, you'll need this enabled to
browse.

It is probably a good idea to have software firewalls on the workstations.
I say this because even with the hardware firewall in the router and NIS, I
still got hacked bad enough that my registry was trashed. The damage was
bad enough that I have to reinstall W2K, wiping the boot partitin clean, and
then proceed to reinstall everything else I was using. I don't know how it
was done, though, as I haven't studied how to hack into a system I don't
own. But I do know I suffered the loss of most of a week as a result of
being attacked.

I have done some study of LAN security, enough to be aware of the
possibility of creating a DMZ, but not enough to know how to do it. I was
thinking of doing something like having a small machine running OpenBSD,
into which the DSL model would be plugged. This machine would be configured
to provide proxy web server(using Apache2), DNS, firewall and routing
services, and then have one or more routers, like the one I'm presently
using, to create separate clusters (one for the machines used by my sister
and her kids and the other for me). IIUC, I'd need the DNS on the OpenBSD
box in order for the two clusters to talk to each other, but not create
vulnerabilities.

I don't know what ICF is.

I did find NIS configurable, at least within my needs. For example, when I
learned it was interfering with the operation of MySQL, I was able to enable
a number of things but restrict them to only the range of non-routable IP
addresses that could be assigned by the DHCP server in the router.

I thought I might have to add NetBIOS over TCP/IP, which you have confirmed.
Is there a way to restrict it to only the non-routable IP addresses we use
in this tiny LAN, or are there some settings I can use somewhere to keep the
LAN reasonably hardened against attack? I ask because I vaguely remember
something about NetBIOS (or possibly NetBEUI) creating significant security
vulnerabilities.

Thanks,

Cheers,

Ted