Filter incoming connections to ports internally

[StockcarsRus]

We recently had a company do internal vulnerability scans on our servers and workstations. Alot of the findings were "Warnings", for example:

"Warning found on port net-bios-ssn (139/tcp)
The domain SID can be obtained remotely. Its values is...

An attacker can use it to obtain a list of the local users of this host.

Solution: filter the ports 137 to 139 and 445

In W2K advanced server, how do I go about filtering ports incoming?

Thanks for any help.

 

[Jpoandl]

These ports 137/139/445 are needed for Windows communication. If you filter these ports, your internal network will no longer work.

The key is to make sure that you protect these ports from the Internet. So make sure that you are not allowing these ports to communicate over your firewall.

Again, internally, these ports are fine. Just make sure that these ports are going over your firewall.

Joseph L. Poandl
MCSE 2003

If your company is in need of experts to examine technical problems/solutions, please contact

http://www.NJCOMPUTERNETWORKS.com

(Sales@njcomputernetworks.com)