Subject: Accessing NT Domain from Behind Firewall

From: Paul Dunphy <[email-masked]>
Date: Thu, 02 Mar 2000 10:48:29 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I have one Win98 PC behind my firewall which needs access to an NT domain 
that exists outside of the firewall. (The reason it needs access is simply 
so it can map a shared drive from the outside domain.) I have tried opening 
up ports 137 and 138 for UDP, and port 139 for TCP, as per the recent 
Netbios discussions, but still cannot access the shared drive. If I try 
setting up Win98 to log into the NT domain on boot-up, it complains that it 
is not able to find the NT domain server. If I try just mapping a drive, it 
says that it cannot find the computer or drive in question.

Does anyone know what might be causing this, and if there is any way of 
getting around it while still maintaining a reasonable degree of security 
on the firewall?

Thanks,
Paul

---------------------------------------------------------------------
Paul T. Dunphy, P.Eng.
Technical Services Officer/Technology Manager
Office of Research Services
Ryerson Polytechnic University
Toronto, Ontario, CANADA
Phone: (416) 979-5000 ext. 7112
Fax: (416) 979-5336
E-mail: [email-masked]

---

From: "Wilson, Aaron" <[email-masked]>
Date: Thu, 2 Mar 2000 08:51:46 -0800

Paul,

Start at the lower levels first.  You're using a firewall that is directly
connected to both segments, correct?  Just to make sure, check and see if
your internal host (98) has a route out to the NT box and that the NT box
has a route back to the 98 host.  You can use "route print" or "netstat",
then "tracert" in the command prompt.  You might need to temporarily open
ICMP on your f/w to do the trace.

Next, try mapping a drive by using IP addresses instead of names.  You'll
definately need those ports (137,138,139) open.  Next, to use the
convenience of names, look into the meaning of the LMHOSTS file.  The WinNT
resource kit books have a great discussion on this.  There is a LMHOSTS.SAM
file on each of your Win boxes.  This is a sample file that will explain its
uses.  You'll need to create an LMHOST (with no extension) file of your own
for each box containing the proper info.  That info will most likely consist
of:

For the Win98 box - the NetBIOS name and IP of the NT server and the
#DOM:<your domain> directive.  Good idea to include #PRE too.

For the NT box - just the NetBIOS name of the 98 box.  This file is only
necessary if you want to map back out to the 98 box from inside.

This is a simple way to get two Win boxes to see each other by name without
the help of a WINS server.

You asked about security - I wouldn't really condone this procedure but I've
had instances (*ahem* - Exchange servers, etc) where management overruled
security policy in favor of more functionality.  It's a classic argument
that takes place in almost every institution.  But the short of it is, if
your Win98 box is compromised (BackOrifice or whatnot), it will already have
an allowed path into your private network.  

Good Luck!

-Aaron

-----Original Message-----
From: Paul Dunphy
To: [email-masked]
Sent: 03/02/2000 7:48 AM
Subject: Accessing NT Domain from Behind Firewall

[To be removed from this list send the message "unsubscribe fwtk-users"
in the
BODY of a mail message to [email-masked].]

I have one Win98 PC behind my firewall which needs access to an NT
domain 
that exists outside of the firewall. (The reason it needs access is
simply 
so it can map a shared drive from the outside domain.) I have tried
opening 
up ports 137 and 138 for UDP, and port 139 for TCP, as per the recent 
Netbios discussions, but still cannot access the shared drive. If I try 
setting up Win98 to log into the NT domain on boot-up, it complains that
it 
is not able to find the NT domain server. If I try just mapping a drive,
it 
says that it cannot find the computer or drive in question.

Does anyone know what might be causing this, and if there is any way of 
getting around it while still maintaining a reasonable degree of
security 
on the firewall?

Thanks,
Paul