We have a system using Windows 7 that connects to a piece of equipment directly using a crossover cable on NIC1 and it connects to the network on NIC2. It seems to communicate with everything it is supposed to just fine with the exception of one thing. The problem is a support program on the computer is supposed to communicate with the company that supports that piece of equipment over the internet. It uses three services:
- An XMPP Service - Netstat shows it connecting
- An RDP Service - Not connecting. I think this is initiated by the support end.
- A Telemetry service - I don't know if this has to be initiated by support.
The support company says they can't see the computer on our end. After a lot of troubleshooting they say, it is our firewall because it isn't allowing ACK packets to come back through. This worked when it was running on Windows XP so, I really don't think that is the issue. I did try this with the Windows firewall disabled with no luck. My understanding with the following output is, ACKs are coming back through. According to our network manager ACKs aren't allowed to come back through. I can't get a packet capture on the other side of the firewall.
I get the following output (sanitized) in wireshark
I am looking for two things:
- Firewalls are a week area for me, can someone explain to me about ACK's not being allow back through and how that works or why that is a security risk if allowed?
- What do you suggest the next step to be?
The support company has the following in their documentation: Equipment requires outbound communication on port 443 TLS. Incoming ports don't need to be opened. IP ACK messages much be allowed back through the firewall. No VPN Required due to TSL over 443.
Addendum: I forgot to mention a couple of things. All of the packets look like they are appropriately ACK'ed in order. I think Wireshark is just calling it SSL traffic because it is using port 443. It looks more like unencrypted jabber (XMPP) traffic, so I am really confused by that. I was going to upload another screen capture of the wireshark output with all three streams in it but I think the frame numbers might confuse things. There are three streams in this capture and they all have the same data in them. There aren't any retransmits. I did a 20 minute capture that has a few in them but that was probably due to bandwidth congestion on our internet connection (time of day thing). I am going to get with the Support Company tomorrow and get them to look at what you all said. I think it will be very useful.