TCP/IP Mask issue

[ManxAnts]

Hi

We are a small operation running with Windows 2003 R2 Server (SP2) with 10
PC's (running XPP SP2) - we update automatically each tuesday morning through
the server to the PC's. We have a very restricted environment only running MS
Office, Adobe Acrobat, and iSeries Access. Two PC's are connected (through
separate IP) to the Web. All other PC's are on a separate IP range, and the
masks are set to ensure that only the specific IP Range is available. They
all use the same switch. A VPN connects to a separate site with CISCO
Firewalls in place, with single authorised route. The iSeries is on the same
internal range, with no external routes.

When there is a need to connect to the www for the internal PC's additional
IP address is specificed for the pc to allow connection through the
appropriate gateway. It us rarely used, and has only been used on 2 pc's. In
each case when the work (authentication, or product update) is complete the
additional IP address and Gateway are removed from the Network connection and
verified that connection to the www is not possible.

Yesterday we found that the PC's on the internal IP Range could access the
www, even though no gateway or additional IP address was specified on the PC.
The settings were checked, and it appears that for the PC's in question no
changes have been made by the users, only auto updates on Tuesday of this
week. Initially this was found through MS Word tips and checking further it
appears to be available through IE6 - which is only used to access a Network
Scanner on the local network.

The firewalls have been checked, along with the VPN's and NATS seems to be
functioning as specified. The system is protected with Sophos AntiVirus Suite
on Server and All PC's - it is reporting that updates are current (Server
updated 6 hourly, with PC's updated daily).

The internal IP range is 192.168.0.x with the internal WWW range being set
for 100.100.2.n the mask is set for 255.255.255.0 for all machines.

It appears that the mask is being ignored and allowing the internal PC's
access to the www range. We are checking other PCs to try and establish
whether this is only occuring with PC's where additional IP address has been
used in the past or whether it is all PC's on the network. We don't want to
broadcast the problem internally as we have always limited people's access to
the www.

Is this something which is known? is there a work around ? what has changed
to provide this new feature ?

 

[Anteaus]

Chances are the problem is being caused by router discovery, a function of
UPnP. You need to stop the UPnP client service on the computers and any UPnP
host service on the router. (the latter being more important as it also has
other security implications, like the ability to open unauthorised inbound
ports)

In any event I would advise you to check and see if your router has a
configurable firewall which will let you set rules such as "DENY ALL outbound
packets WHERE the source IP is x.x.x.x" - this is a simpler and more secure
way to bar outside conections from a computer, and doesn't need a dual IP
range.