Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Windows Server 2008 firewall. Inbound connection is blocked as outbound?

$
0
0

I connect using "Computer Management" from computer A to computer B. Both computers are Windows Server 2008 x64 with all current hotfixes. The connection succeedes, and I don't even try to open any of the sub-snapins.

But computer A (the connection source) logs the following event in its System Log:

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          9/13/2008 8:59:58 PM
Event ID:      10006
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <Computer A name's here>
Description:
DCOM got error "2147944122" from the computer <Computer B FQDN's here> when attempting to activate the server:
{03837521-098B-11D8-9414-505054503030}


And computer B (the connection destination) logs the following two events (three times each) in its Security Log:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          9/13/2008 9:00:11 PM
Event ID:      5152
Task Category: Filtering Platform Packet Drop
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      <Computer B name here>
Description:
The Windows Filtering Platform blocked a packet.

Application Information:
 Process ID:  568
 Application Name: \device\harddiskvolume1\windows\system32\services.exe

Network Information:
 Direction:  Inbound
 Source Address:  <Computer B IP's here>
 Source Port:  57144
 Destination Address: <Computer A IP's here>
 Destination Port:  63485
 Protocol:  6

Filter Information:
 Filter Run-Time ID: 0
 Layer Name:  Receive/Accept
 Layer Run-Time ID: 44

and

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          9/13/2008 9:00:11 PM
Event ID:      5157
Task Category: Filtering Platform Connection
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      <Computer B name here>
Description:
The Windows Filtering Platform has blocked a connection.

Application Information:
 Process ID:  568
 Application Name: \device\harddiskvolume1\windows\system32\services.exe

Network Information:
 Direction:  Inbound
 Source Address:  <Computer B IP's here>
 Source Port:  57144
 Destination Address: <Computer A IP's here>
 Destination Port:  63485
 Protocol:  6

Filter Information:
 Filter Run-Time ID: 0
 Layer Name:  Receive/Accept
 Layer Run-Time ID: 44

Well, I already know that events 5152 and 5157 are nearly the same, so we need to look only into one of them in each case. But what's next?

It seems to me that the firewall here treats the initial connection and a responce as two different connection. So it allows the initial connection (from A to B) because I have some rules in place that are supposed to allow remote management. But then it blocks the responce (from B to A). In this case, looking into separate connection from B to A, I guess, it should treat it as outbound and not filter at all. But it still calls it "Inbound" for some reason, apply some firewall rules and blocks it.

Are my assumptions wrong? What are the explanation for this behaviour? How do I prevent the packets from being blocked?


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>