blocking ports in NT4

[cookie101]

I'm trying to block specific ports (135, 139, etc) on an NT4 embedded system. Microsoft is not helpful and IPSec isn't installed on the NT4.

Does anyone have any ideas on how to do this?

Thanks!
Garrett Carter
CCNA, A+

 

[oisnds]

These ports are used by MS networking, best to block at the switch or firewall.

 

[Jump1ng]

The best way is to block all ports and only open the ones that are needed.

As oisnds said use a firewall either software or hardware. If you don't have a hardware software there is some quite good free software ones out there.

 

[itsp1965]

If you really want to do this on NT, you can go into the Advanced properties for the IP protocol and under the options tab there is a setting for TCP/IP filtering. From here you can select the ports you want to enable/disable.

 

[cookie101]

All these suggestions are great, but it's not an option. The NT machine is directly connected via dail-up and we don't want to place it behind a firewall. Is there any other way to block ports that are not needed?

Also, we're using ports 1024 through 5000 and don't want to "open" all of these individually.

 

[itsp1965]

Have you thought about installing a host based firewall on the box like ZoneAlarm or BlackIce

 

[rdroske]

This is the second time I've seen it posted that you can do this on the Advanced tab of TCP/IP properties and as far as I know it just ain't true. If it really is someone please let me know.

As far as I know there is no way to do this without an add on like those that have been mentioned.

I don't understand the don't want it behind firewall part though. What difference if the firewall blocks certain ports or you block them some other way?

 

[cookie101]

I agree that putting this behind a firewall is the best solution, but we don't want the cost and since it's embedded, there is no user to say "yes" or "no" to settings, Zone Alarm and BlackICE are not good solutions. My customers don't want to (don't need to) pay for something they don't need. The firewall is extra expense, we're only communicating between us and it on specific ports (1000 - 5000). A firewall is just out of the question.

However, we have seen in the Advanced properties that you can allow specific ports. We've done this, but it only seems to work on the NIC, the MODEM isn't listed on the devices. Seems odd.

Anyway, the best solution is something I can't do. Any suggestions?

 

[Jump1ng]

You only need one firewall since if i understand your setup correctly. Everyone that get out on the net goes through the NT box.?

So all you need is a firewall configured on one machine block all ports then open the ones you need.

If you already using some kind of router it might have built-in firewall.