I have a dual homed server that I am using as a gateway from a small local area network to the internet. One NIC card goes to the internal LAN (the intranet) , the other connects to the internet via a DSL connection. The server runs Win2K Server (SP2) , Proxy 2.0 (updated), and Exchange 5.5 (SP4), DNS, AD and IIS . It also is the domain controller for the network (I know --I know. It saves a machine). The machine hosts the DNS servers for several domains that are being hosted. The packet filters are turned on in Proxy, and only a minimal number of ports are open. All the latest MS security patches are on the machine. There are no other domain controllers on the network.
Anyway, what is happening is that I am getting packet rejects from port 137 (the Netbios port) coming from the intranet NIC. A sample of the packet filter log entries are: 6/6/2002, 1:49:00, 192.168.1.10, 211.109.2.104, Udp, 137, 137, -, 0, 209.42.32.73, -, -, 6/6/2002, 1:49:01, 192.168.1.10, 211.109.2.104, Udp, 137, 137, -, 0, 209.42.32.73, -, -, 6/6/2002, 2:11:27, 192.168.1.10, 211.254.60.122, Udp, 137, 137, -, 0, 209.42.32.73, -, -, 6/6/2002, 2:11:28, 192.168.1.10, 211.254.60.122, Udp, 137, 137, -, 0, 209.42.32.73, -, -, 6/6/2002, 2:30:59, 192.168.1.10, 203.240.154.143, Udp, 137, 137, -, 0, 209.42.32.73, -, -, 192.168.1.10 is the IP address of the intranet NIC, and 209.42.32.73 is the IP address of the internet NIC. The address 209.42.32.73 is visible from the internet and is the primary dns server for the domains I am hosting. I believe that these packets are coming out of Exchange 5.5. The TO: address points to Korean spam sites. I get a lot of spam sent to non-existent mailboxes on my domains, and these end up as NDRs, and so I think these packets are the results of this. I would like to stop them from being sent, but don't have a clue as to where to begin. The MS knowledge base isn't any use. Does anyone out there know what is going on, and how to stop it? Or even point me to a place to get started. Other that this, the server runs fine. Thanks in advance Steve Jacobson List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
