Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to harden down A Win2k3 server that talks to a branch over an IPsec tunnel based connection. Windows 2k3 firewall doesn't offer control of outbound communications, so I've turned to the IPsec policy. Im testing this with a couple VMs and have the following rules:

  • List item
  • Allow RDP
  • Allow DNS requests
  • Negotiate with remote server (IPSEC connection)
  • Deny all. (this specifies one endpoint as the Win2k3 IP)

RDP still works, DNS requests work. But when I ping the other endpoint it results in:

Negotiating IP Security
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.

Soon as I take off the deny all rule, the tunnel establishes just fine.

I tried creating a permit rule for UDP 500 (ike). But soon as you put 500 in, it says you cannot establish a tunnel based on the ike protocol. So that's out.

I tried creating an additional rule with both endpoint IPs, and to permit the traffic. However this trumps the negotiate security rule, and no tunnel is attempted to be created.

Im pretty well out of ideas.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.