OK i'm confused.

I have a 2003 SBS server sitting behind a 3300 with various ports forwarded to it for things like remote access, vpn etc etc. However the security event log on the server is showing thousands of failed login attempts all day every day from addresses that trace back to romania, china and all sorts of other exotic locations. The event log shows them happening on a variety of ports but none of these ports are open.

So if the ports arent open how are these requests even reaching the server? I admit i dont really understand how the firewall works but i would assume that everything would be blocked apart from the ports i specify.

I'm guessing there's something i need to do like, er, configure the firewall? duh... anyone got any advice?