CODEWITHSUNDEEP
network-programmingrebootwindows-firewallwindows-2003-webserver
jazzer102
jazzer102

Reputation: 39

IPNAT.SYS running after reboot, stopping connection to server

Came in this morning to find our server had rebooted and websites were down. Server was online and able to connect via Logmein. (Windows server 2003 R2 Standard Edition SP2)

The actual symptom was that the server did not seem to accept any incoming network traffic. eg. websites, FTP, SQL, ping from within the same network (external ping blocked by firewall) browse via network etc all no response.

After investigation we found that IPNAT.sys was running and that the command NET STOP IPNAT resolved the issue and everything came back.

The services are configured as follows: Windows firewall / ICS (NOT running) (Automatic) Routing and Remote access (NOT running) (Disabled)

Security configuration Wizard is not installed under windows components.

When you try to start Windows firewall you get a message saying that it cannot start because IPNAT.sys is already running.

After rebooting the server the same issue comes back and can be resolved as above.

I dont nessecarily want WF / ICS running anyway so could disable this however that fact that this cannot start seems more like a symptom not the cause. (unless it is partially starting and failing during start up but I can see anything in the event logs)

The question is what could be starting IPNAT.sys and can it be disabled.

Any ideas would be appreciated, thanks.

Upvotes: 3

Views: 17821

Answers (3)

cepa
cepa

Reputation: 11

Click My Computer -> Manage -> Services and Applications -> Routing and Remote Access you will find it with a red box next to it, right click and click on DISABLE.

enter image description here

Upvotes: 1

Josh Lucy
Josh Lucy

Reputation: 13

We had a similar issue, and the NET STOP IPNAT worked but after we'd reboot it would happen again. To stop that we ran the following:

sc config ipnat start= disabled

No more IPNAT conflicts.

Upvotes: 1

Lucas
Lucas

Reputation: 1

I had same issue here today for the Windows Server 2003 R2 version. The server ws infected by "Child Pornographic" virus and it locks all data files and deleted originals and somehow disable the firewall as well.

After cleaning all the viruses.. I tried all suggested solutions from other sources such as disabling RRAS service and also changing registry keys but none working.

After all, I found the "Windows Firewall/Internet Conneciton Sharing(ICS)" service working to enabled after I enabled "Windows Management Instrumentation (WMI)" service.

Sorry for my poor grammar, and hope this will eliminate some of you who having the same pain as I am. =)

Upvotes: 0

Related Questions