Windows 2000 TCP/IP Filtering

Hmm. W2k's TCP IP filtering isn't all I thought it was... it only affects inbound traffic. It does not block outbound. It also does not block ICMP. I'm mildly disappointed - mind you, this does provide about the same protection as a NAT.

http://support.microsoft.com/default.aspx?kbid=309798

Some notes on this:

Filtering port rules are set for EACH connection, e.g. if you have a LAN and a dialup modem for internet access, make sure you are setting the rules for the dialup connection (if you are trying to block remote attacks).
For dialup connections, you need to do some registry hacking to manually configure which ports to filter. ARGH. http://groups.google.com/groups?q=enable+tcp/ip+filtering+dialup&hl=en&lr=&ie=UTF-8&oe=utf-8&selm=95hkmq%241p8k%241%40news.beeb.net&rnum=1
DNS seems to work badly with IP filtering, I don't know why, but it did for my config. I needed to allow connections for ALL UDP ports. (DNS responses are often by UDP, but the W2K filtering couldn't recognize the returning packet as being a response to an earlier DNS request (from a TCP port)).
I've leaning towoards IPSec instead (which is NOT necessarily tied to IPSec VPN's). We'll see how easy it is to setup. It doesn't need a reboot to apply settings which is nice.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/network/maintain/security/ipsecld.asp
and:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/standard/ipsec_start_snap-in.asp
and:
http://online.securityfocus.com/infocus/1559
Oh, software firewalls are good too, but if processor time is of the essence... (e.g. you're running W2K on a P150)
This is interesting - a package to configure Window's filtering, using a similar syntax to IP Filter: http://www.hsc.fr/ressources/outils/pktfilter/