RRAS: dial on demand doesn't hang up (only incoming packages)

Hello,

I have a problem with dial on demand with the routing and remote access
servive (rras) (windows server 2003).
The RRAS is configured for lan routing and NAT. A dial on demand
connection with automatic hang up after one minute is the external
interface to the internet (with activated basic firewall).
Everything works fine except the automatic hang up. The dial on demand
interface doesn't close the connection after the specified time.
I had observed the connections with netmon for a while and there were
only incoming packages.
So I think the dial on demand connection doesn't hang up because of
the incoming packages. But the incoming packages (from different IPs)
doesn't relate to connections which were initiated from a client
inside the LAN.

How can I force the automatic hang up?
Is it possible to (hardening?) modify the firewall for excactly
ignoring incoming packages.

TIA.