Re: DI-804

From: Daniel Crichton (danielc@helio.co.uk)
Date: 04/08/02 

From: "Daniel Crichton" <danielc@helio.co.uk>
Date: Mon, 8 Apr 2002 10:08:19 +0100

"Lars Øystein Handegard" <lars.handegard@tiscali.no> wrote in message
news:_0jr8.166$dm4.2902@news2.ulv.nextra.no...
>
> "Daniel Crichton" <danielc@helio.co.uk> wrote in message
> news:Z%hr8.8100$d45.798547@monolith.news.easynet.net...
> > Sending a file via Messenger requires that the ports are open at both
ends
> > of the link - the person you are sending to needs to have the correct
> ports
> > open too. Are they running a firewall? It's the same for the voice
feature
> > too.
>
> Yes i know this. That is why i have tested with people that are connected
> directly to their isp through pppoe in windows (not through
router,firewall
> or gateway)

OK, here's what I was able to dig up.

From
http://www.microsoft.com/WindowsXP/pro/techinfo/deployment/natfw/solutions.a
sp#solutions

"Administrator/User Action Required
To enable voice and video communications with Windows Messenger through a
non-UPnP firewall, configure the firewall to allow incoming traffic on UDP
ports 5004 - 65535.

For other purposes, enable the following ports:

  a.. File Transfer: 6891 (to allow 10 simultaneous file transfers open
ports 6891 through 6900)
  b.. Application and Whiteboard Sharing: 1503
  c.. Remote Assistance: 3389
"

And from
http://help.microsoft.com/en_us/HelpWindow_msg.asp?INI=msgr_xpv46.ini&H_VER=
1.7&Topic=netguideother.htm

"To allow your network users to have a direct connection to instant
messaging services, you will need to:
  a.. Open outgoing TCP connections to Port 1863 on your proxy servers.
  b.. Let your network users know which kind of proxy server your network
uses (HTTP, SOCKS4, or SOCKS5) and provide them with the corresponding
details (server name, port number, and so forth) so they can enter that
information on the Connection tab of the Options dialog box (Tools,
Options).
  c.. Make sure the internal local area network has access to the Domain
Name System (DNS) servers to resolve the names of external hosts such as
messenger.msn.com.

For file transfer

Both incoming and outgoing TCP connections use this range of ports: 6891 to
6900. This allows up to 10 simultaneous file transfers per sender. If you
open only Port 6891, users will be able to do only one file transfer at a
time.

The TCP ports need to be configured so that sockets on a port remain open
for extended periods of time."

Are these the same articles you have already looked at? Looking at it they
both say that you have to open ports 6891-6900 for incoming and outgoing TCP
at both ends, however the second article also says "File transfer may not
work if you are behind a network address translation (NAT) device." so it's
likely that the IP address is passed in the packets and so without a UPnP
NAT device you may not be able to get the file sending to work at all. I've
only ever tried the file sending from behind my PIX firewall with PAT (port
address translation) once before and gave up when I found the above articles
as PAT doesn't allow incoming connections at all due to the way in which the
port translation tables are generated only out outgoing connections.

Dan

Relevant Pages

  • Re: Logging login event
    ... network and the name of the computer. ... take some detective work to see what are established connections that you ... with well known ports after the IP xxx.xxx.xxx.xxx:80 such as ports 53, ... If there's a remote login, I hope it logs the IP address. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Ports scanned despite NAT
    ... >against about a dozen ports from 33367-33432. ... Are those are "new" connections, ... hosts on the ISPs internal network. ... mentions "Internetworking with TCP/IP Principles, Protocols, and ...
    (comp.security.firewalls)
  • Re: Now that Ive got my router configured properly I cant connect!
    ... >> I have an SBS network located here connected to the outside world via ... >> OWA and web based connections all work well from various locations. ... >> connect from their house via VPN or Outlook RPC over HTTP. ... >> the NAPT page to configure some ports in order to get these working, ...
    (microsoft.public.windows.server.sbs)
  • troubles defining firewall policies
    ... restricting high ports. ... I use RH 7.3 and my eth0 interfase is part of the class C network ... use the linux machine as their gateways so all the network traffic is ... Grant incoming connections for every IP of my network ...
    (RedHat)
  • troubles defining firewall policies
    ... restricting high ports. ... I use RH 7.3 and my eth0 interfase is part of the class C network ... use the linux machine as their gateways so all the network traffic is ... Grant incoming connections for every IP of my network ...
    (RedHat)