IPsec, can't browse the net!!!

[Stingreen]

Guys, I'm trying to configure our windows2K servers' IPsec feature. I simply can't get out of the internet. (from the server)
I figured it should be a DNS problem. I was right because nslookup response turns "server timeout" errors.
I can't ping any sites, when I type ping

http://www.yahoo.com

it doesn't even turn an error message it hangs like that.
What should I enable, at least what port to get this thing working.
Port 80 is already permitted, so is 53. But I'm making a mistake somewhere.
Can anybody help ?
Thanks a lot.

 

[CartoonHair]

I wouldn't use windows!!

 

[Stingreen]

OK, tell me then what exact rule would you allow to get out on the internet in LINUX / BSD ?

 

[GiaBetiu]

IPsec in which configuration is used?
Just a secure conenction between two hosts?
A tunnel? L2TP/IPSec? IPSec "tunnel"?

Don't forget that IPSec require some special ports to be open:
- for IKE: protocol UDP port 500
- for AH: protocol id 51
- for ESP: protocol ID50
ALso, I hope thatis not the case, but chec the implications of a NAT. If you have such a service, and your IPSec pacets wil cross it... then there are problems (imagine that IPSec is signing/encoding a packet, that will be later changed by a NAT..) Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[Stingreen]

Hey thanks for the reply, I've already solved the problem.
I should've permit the "UDP" 53rd port as well as TCP one.
That did the trick, and now mail delivery works like a charm..
Thanks again!