Trouble IPSec Packet Filter and Mailserver

[Markus Mühlich]

Hi,

I would like to secure my Win2000 Server (SP4) with IPSec Packet
Filter. Therefore I added following filters:

1. Inbound - all Ports - all Protocolls - deny
2. Inbound - Port 25 - TCP - permit
3. Inbound - Port 53 - UDP - permit
4. Inbound - Port 53 - TCP - permit
5. Inbound - Port 110 - TCP - permit

Until now, I did not set any filter for outgoing traffic.

With the a.m. filters MDaemon (6.8.0) cannot resolve any MX/A record
from the DNS Servers (all answers blocked through IPSec). If I change
filter#3 from Port53 (UDP) to any port, MDaemon gets the resolved DNS
records and everything works fine.

But for security reasons I would like to limit the inbound traffic to
the absolut minimun of Ports. What UDP port for inbound traffic (DNS
resolution) I have to use?



Thanks in advance
Markus

 

[Steven L Umbach]

Create an entry in the permit rule filter to allow traffic to your dns
servers. Traffic for dns name resolution normally uses port 53 udp
[sometimes 53 tcp depending on packet size] "to" the dns server. --- Steve