I'm looking to harden down A Win2k3 server that talks to a branch over an IPsec tunnel based connection. Windows 2k3 firewall doesn't offer control of outbound communications, so I've turned to the IPsec policy. Im testing this with a couple VMs and have the following rules:
- List item
- Allow RDP
- Allow DNS requests
- Negotiate with remote server (IPSEC connection)
- Deny all. (this specifies one endpoint as the Win2k3 IP)
RDP still works, DNS requests work. But when I ping the other endpoint it results in:
Negotiating IP Security Destination host unreachable. Destination host unreachable. Destination host unreachable.
Soon as I take off the deny all rule, the tunnel establishes just fine.
I tried creating a permit rule for UDP 500 (ike). But soon as you put 500 in, it says you cannot establish a tunnel based on the ike protocol. So that's out.
I tried creating an additional rule with both endpoint IPs, and to permit the traffic. However this trumps the negotiate security rule, and no tunnel is attempted to be created.
Im pretty well out of ideas.