DHCP blocked by Windows Firewall ?!?!

[Chris Bedford]

Hello Gurus

This started one Monday morning 3 or 4 weeks ago. The site is small (about a dozen PCs, one thin client, 3 printers, one server). Suddenly no-one was getting IPs from the server any more. Customer tried fixing it himself, spent days, eventually allocated fixed IPs, but not ideal as clients weren't always able to use the Web (I discovered today this is because DNS requests were only intermittently successful).

Eventually I was called in and after about 4 hours of re-applying service packs, installing new updates, removing & reinstalling DHCP - all the usual time-wasters - pinned it down to the Firewall on the server.

No events appear in the system event log, and when I switched on logging in DNS all requests appeared to be answered, but PCs were not receiving the answers, while the server itself was. When I turned off firewall, everything worked properly.

I then managed successfully to open ports (TCP 53 & UDP 53) for DNS but couldn't make the same trick work for DHCP (TCP 546 [client] and TCP 547 [server]).

So my questions:-

1. Since DHCP requests are made before the client has an address, are they considered TCP/IP frames...? Would you expect opening ports on the firewall to work?

2. More importantly, why did it start blocking? Under the "advanced" config of the Firewall, there is a place to specify some of the services you want to allow on the server, but neither DHCP nor DNS appear there. I did try inserting them as new services but it made no difference that I could see.

[Oh... just did a bit more research on well-known port nos and it looks like in addition to the two TCP ports, I should have opened UDP 546 & 547 as well... does that answer my Q.1? Is the DHCP implementation in Windows the same as DHCPv6?]

[Jay Bollyn]

Hi Chris,

I don't have specific answers to your carefully constructed questions, but I can tell you that I have never needed to create an Windows Firewall exception for client access to a DHCP server.

- Jay

[Jay Bollyn]

After further research, it looks like you might need to open ports 67 and 68:

http://www.microsoft.com/technet/itsolutions/network/evaluate/technol/tcpipfund/tcpipfund_ch06.mspx

Opening these ports worked for this guy:

[broken link removed on <4/3/2017> by Mod]

- Jay

[Chris Bedford]

Thanks Jay

Oops I assigned points without testing the suggested remedy :-(

But: wow, that Technet publication you referred to is a great resource. Thanks for that - amazing what info is available out there if you just know where to look for it (and how to filter all the cr@p).

Ok, thanks, will try this and get back to you. Still makes no sense to me that firewall would block services on the same server, this must be "outside the design parameters" also known as an "undocumented feature" or BUG!

Chris

[Jay Bollyn]

Hey Chris,

Glad it worked out. I am a TechNet Plus subscriber, which is $$ yearly. Just search google for Microsoft TechNet Plus (no quotes), and you will get an idea of what it is all about. It is well worth the money (to me).

I have a subscription because I am the main IT guy where I work. I need to have answers quickly, when something breaks. This does not happen daily, but when it does happen, I need to have the answer *quickly*. So TNP is just one of my tools.

I am paid for what I *know*, not for what I do.

I still can't explain why you needed to explicitly open those ports. But hey, I get paid for solutions, not explanations.

- Jay

[Jay Bollyn]

Two other thoughts, while I am in a talkative (i.e. honest) mood (...as I write this, it's Miller Time in Chicago). There are two primary driving forces behind the contributions of most Forum Regulars:

1. We Forum Regulars like to show off our technical wisdom, and;

2. We Regulars are all wrapped up in this Forum Points competition, which obviously is an alpha male thing.

OK, that's all I got.

- Jay

[Chris Bedford]

Hi again Jay

Sorry to take a week to get back to this topic - I'm sure you know how it goes in support!

Bad news is none of the above solutions worked. I still have to have Windoze firewall OFF for DHCP to work. Makes no sense to me, but... like you say, we don't get paid for explanations.

It would be nice to be able to explain, though, wouldn't it, because turning off what is supposed to be an essential safety feature isn't a solution, it's a workaround. "My airbags punch me in the face every time I step on the brakes" "Well switch 'em off then"

[WillNiccolls]

Are you speaking of the Windows XP firewall? Or of a hardware appliance of the sort that do NAT and port forwarding?

DHCP might even be utilizing ports 67 and 68 on some systems

Is the DHCP service running on the clients?

Something may be wrong with DNS? DNS server names are handed out with DHCP leases to clients. If it is misconfigured on the DHCP server it could of course cause problems.

Can you post IPCONFIG /ALL output from the DHCP server if Windows, and from the clients?

This is from MS
http://www.microsoft.com/smallbusiness/support/articles/ref_net_ports_ms_prod.mspx

DHCP Server

Using the Dynamic Host Configuration Protocol (DHCP), the DHCP Server service automatically allocates IP addresses and enables advanced configuration of network settings, such as Domain Name System (DNS) servers and Windows Internet Name Service (WINS) servers to DHCP clients. The network administrator establishes one or more DHCP servers that maintain TCP/IP configuration information and provide it to clients.

System Service Name DHCPServer
Application
Protocol
Port

DHCP Server
UDP
67

MADCAP
UDP
2535

[Chris Bedford]

Hello Will

[WN] Are you speaking of the Windows XP firewall?

No... I didn't explicitly state this is W2K3, but I posted this under "Windows 2003" group thinking everyone would assume that's what I was talking about! A Windows 2003 Server installation.

[WN] DHCP might even be utilizing ports 67 and 68 on some systems

Yes... as Jay mentioned... I opened these ports as well, no help

[WN] Is the DHCP service running on the clients?

Yes, that's where the problem is - clients not getting IPs from the server's DHCP unless I turn off the server's Firewall

[WN] Something may be wrong with DNS? DNS server names are handed out with DHCP leases to clients. If it is misconfigured on the DHCP server it could of course cause problems.

The clients aren't even getting the DHCP lease. As I understand it, clients broadcast for a DHCP server (if they have no address previously assigned). The DHCP server is supposed to respond with a "here I am" type of message; the client then asks for an address and the server allocates a lease, consisting of an IP address together with all other configured parameters like DNS server, default gateway etc.

If a client has previously been allocated an address, it merely asks if it can re-use that address. The server then replies yes or no, as the case may be, but the result is effectively the same. Either way, DNS can't affect the result until after the lease has been handed out?

[WN] Can you post IPCONFIG /ALL output from the DHCP server if Windows, and from the clients?

Sure... :-)

Server:-
----
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator.VARISPEED-SRV1>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : custname-srv1
Primary Dns Suffix . . . . . . . : custname.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : custname.local

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : custname.local
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-0B-CD-E7-C9-FD
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.250
DNS Servers . . . . . . . . . . . : 192.168.1.2
Primary WINS Server . . . . . . . : 192.168.1.2
----

I can't get to a user screen of any of the clients over a weekend, but their config comes up exactly as you'd expect from this DHCP config on the server (when it works!):-
----
[all parameters have a Vendor "Standard" and Class "None"]
Option Name Value
003 Router 192.168.1.250
006 DNS Servers 192.168.1.2
015 DNS Domain Name custname.local
044 WINS/NBNS Servers 192.168.1.2
046 WINS/NBT Node Type 0x8
----

[WN] This is from MS
http://www.microsoft.com/smallbusiness/support/articles/ref_net_ports_ms_prod.mspx

Interesting, thanks - I did see this article but skipped it because it claims to be applicable to SBS, not Windows Server... I keep forgetting MS' article headers aren't "necessarily" accurate :-(

OK I am opening that "MADCAP" port as well as all the others, I'll be able to report back next week!
Thanks for the input.

[The whole point here is why did it work one day and require special firewall configuration the next? Has MS broken the firewall with a recent update? Or did someone mess about with another setting somewhere on the server that I haven't twigged yet...]

Chris

[David Coulby · Accepted solution]

Found this very useful article while trying to troubleshoot an identical problem. While it did not resolve my problem directly, it proved to be the ideal tool for locating the actual issue.

After opening just about every dhcp and related service port, I was still having no luck until....

I had been setting ports 67 and 68 as scope: "My network" changing the scope to "Any computer" resolves the issue.

Basically 0.0.0.0 which is the inbound adress for the dhcp request is quite correctly not on the domain identity, and therefore correctly dropped.

Thanks for the reference points and a link to that very useful dhcp material.

[Chris Bedford]

As I recall David's answer hit the nail on the head. Apologies for taking 18 months to get back to you!!!