how to open ports

[Perry Diels]

Hello,

I have a problem between W2K3 routing and remote access and IIS. At least I
think the problem relies between both applications; before posting on this
group I posted on the IIS group, and the information I collected there + my
own assumption make me think so. Here's the scenario:

- I got IIS up and running with FTP services enabled, everyone could connect
to it from the Internet.
- We also needed a VPN server, I installed that and Remote access and
Routing was automatically configured by the W2K3 wizard

The result is that the VPN server works fine, the only problem is that
'some' users cannot longer connect to the FTP server. In fact the ones that
cannot longer make a connection are behind a NAT router themselves. Connect
from the NAT PC itself via the Internet to our FTP works fine, but not from
any PC that sits behind that NAT server. Any idea what could be the reason?

From the information I collected, it looks like I should open more ports on
our W2K3 server in the Routing and Remote Access app.

1) Is this possible?
2) If yes how to do that?

I have been looking around but I could not find the solution, not even in
the help documentation.

FYI our FTP runs on port 1994, I have also tried the default 21 but that did
not help.

Thanks a lot in advance for your time and help.

Regards,
Perry

 

[Dusty Harper {MS}]

This is because filters get applied automatically when you run through the
wizard. This locks down the VPN Server for security reasons. you can
change filters using the Netsh commands or the UI

Netsh Routing IP Show Filters

Effectively the filters that are set up are something like this :

Allow TCP Port 1723 IN ------------

|------Allows incoming PPTP connections
Allow Protocol 47 IN ------------

Allow UDP Port 1701 IN ------------

|------Allows incoming L2TP connections
Allow UDP Port 500 IN ------------

Drop ANY IN ------------ Drops everything that
is not PPTP or L2TP encapsulated

Allow ANY OUT ------------ Allows all packets to
leave the interface

 

[Perry Diels]

Helly Dusty,

Thanks a lot for your answer. However I'm afraid I don't understand it
completely. First I cannot find the "allow" command in the netsh interface
(it does not show it in help either) and secondly if we have an FTP server
setup as I described (at port 1994), what are the ports that need to be
openend in order to resolve our problem?

Thanks again,
Perry