Well that's just fantastic!  Thank you! ... View more

Just some additional information...   For a server that I have a 1:1 NAT for, if I specify port 3389 TCP and UDP but restrict it to a single public IP, I can STILL RDP into that server from other public IPs, not just the one I specified.   If I add a 1:Many rule for a system that already has a 1:1 NAT rule and redirect port 3389 to an obscure port, I can no longer RDP into the server; however, that tells me I'd need to redirect all ports to obscure IPs and ports in order to adequately protect that system and maintain the 1:1 NAT.   It seems so long as a system has a 1:1 NAT rule AT ALL, then all ports are allowed through to that system, regardless of the ports specified.    I hope this is just a misconfiguration or misunderstanding and not a massive security issue. ... View more

Current Firmware Version: MX 15.4 ... View more

I did move two servers that don't require a 1:1 NAT to 1:Many and they appear to actually be secure now from outside, but I can't do that for all the services. My understanding of the statement at the top of the Firewall page "Inbound traffic will be restricted to the services and forwarding rules configured below" is what you said... anything not specifically allowed would be blocked.  It's as if there's some Allow Any-Any rule somewhere in the config but not exposed to the web interface. ... View more

That's the problem.  NONE of the 1:1 NAT entries include port 3389.  In fact, now that I've tested more, I can get to ANY port on the servers from outside, even when they are not in the list of allowed ports.  For example, I have ONLY ports 80, 443 and 25 allowed to my Exchange server.  I can RDP into it.  I have ONLY port 443 allowed to my SharePoint server, and I can get to the central admin site on port 11111 and RDP into it from outside.   ... View more