Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We just added a new Server 2008 (sp2) Domain Controller in a new Site, our first such config. It's over a VPN gateway WAN (10Mbit). Unfortunately it is displaying a strange network symptom. Connections to the SMB ports (TCP/139 and TCP/445) are being actively refused... if the connection is coming in on pure IPv4. If the incoming connection is coming by way of the 6to4 tunnel those connections establish and work just fine.

It isn't the Firewall, since this behavior can be replicated with the firewall turned off. Also, it's actually issuing RST packets to connection attempts; something that only happens with a Windows Firewall if there is a service behind a port and the service itself denies access. I doubt it's some firewall device on the wire, since the server this one replaced was running Samba and access to it from our main network functioned just fine.

I'm thinking it might have something to do with the Subnet lists in AD Sites & Services, but I'm not sure. We haven't put any IPv6 addresses in there, just v4, and it's the v4 connections that are being denied. Unfortunately, I can't figure this out. We need to be able to talk to this DC from the main campus. Is there some kind of site-based SMB-level filtering going on? I can talk to the DC's on campus just fine, but that's over that v6 tunnel. I don't have access to a regular machine on that remote subnet, which limits my ability to test.

share|improve this question
If the 6to4 works and the pure ipv4 doesn't I'd strongly suspect that there really is something blocking some traffic on your VPN link - is the new DC able to communicate successsfully with the Global Catalog server of IPV4? – Helvick Mar 26 '10 at 22:27
This DC can talk to a GC via IPv4 on the main network (tcp/3268) just fine. At the same time, it can talk regular SMB to a Server 2003 (ipv4 only) machine on the main network. Also, I'm not seeing any replication-failure events on either side (not surprising due to 6to4 working and every DC being Server 2008). – sysadmin1138 Mar 26 '10 at 22:39
up vote 1 down vote accepted

Answering my own question here, but Helvick nailed it. Just had a long talk with our firewall people (they'd been out of the office all day rigging up a new remote site, so I hadn't had a chance to speak with them before now). They rearranged the rules order and that seemed to have picked it up. An old legacy IPv4 BLOCK TCP/139 rule was getting bypassed by the 6to4 gateway, which was why that traffic was getting through.

Looking back on it, the Samba access we had been doing before shouldn't have worked from the main network. I'll have to check what happened.

Anyway, resolved.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.