Remote Desktop Gateway 2019 WON'T work with Sophos UTM WAF

I have had the same problem trying to setup the WAF to publish Remote Desktop Gateway for server2019 and the issue, in the end, was two tick boxes in the site Path Routing

Now everything is working :) 

This is after spending 6 hours on the phone to Sophos level 1 & 2 and not getting anywhere and still waiting on a call from level 3

Hi Jack,

I Tried ticking them both but no luck :(

Do you mind if you share your firewall profile & exception list you are using?

I tried several combinations but can't get one right.

These are all the settings we have which work with our 2019 setup 

Firmware on our UTM is 9.605-1

Static URL Hardening

/rpc/*
/rpcWithCert/*
/rpc/rpcproxy.dll?localhost:3388
/rpc/rpcproxy.dll
/remoteDesktopGateway/*
/KdcProxy/*
/rpc/rpcproxy.dll?localhost:3389

Skip Filter Rules

960032
960035
960911
981172

/rpc/*
/rpcWithCert/*
/RDWeb/*
/RDweb/*
/rdweb/*
/KdcProxy/*
/KdcProxy
/remoteDesktopGateway/*
/remoteDesktopGateway
/remoteDesktopGateway/

Hope this helps you get it resolved

These are all the settings we have which work with our 2019 setup 

Firmware on our UTM is 9.605-1

Static URL Hardening

/rpc/*
/rpcWithCert/*
/rpc/rpcproxy.dll?localhost:3388
/rpc/rpcproxy.dll
/remoteDesktopGateway/*
/KdcProxy/*
/rpc/rpcproxy.dll?localhost:3389

Skip Filter Rules

960032
960035
960911
981172

/rpc/*
/rpcWithCert/*
/RDWeb/*
/RDweb/*
/rdweb/*
/KdcProxy/*
/KdcProxy
/remoteDesktopGateway/*
/remoteDesktopGateway
/remoteDesktopGateway/

Hope this helps you get it resolved

AWESOME!!

I got my gateway working! Thanks mate...

The portal comes up however breaks when I log in. Do you use RemoteApps?

Also why are you using https & redirect? If I'm using IIS redirect I don't need Sophos redirect correct? 

I'm trying to figure out how I can just type in my portal URL and it redirects to the full RDWeb URL. This is how I have it working with DNAT.

Don't worry about the RemoteApp portal. I guess my problem is I'm using Duo MFA which changes the URL after authenticating. I'll try to work it out.

Do you have RDG working on IOS or Andriod? Mine doesn't seem to work.

FYI, 

I got my mac to work and still working on getting my Andriod working with gateway.

I found out that as soon I added those three:

/remoteDesktopGateway
/remoteDesktopGateway/
/RemoteDesktopGateway/*

To the firewall profile and firewall exception everything started to work for me. All those other things you have enabled I found them not needed for me. Gateway works whether they are enabled or not.

If anyone can help me with the Andriod issue that would be great. This is what I see in the logs:

2019:11:02-00:32:32 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="13" user="-" host="49.196.9.220" method="RPC_OUT_DATA" statuscode="401" reason="-" extra="-" exceptions="-" time="254830" url="/rpc/rpcproxy.dll" server="GATEWAY.MYDOMAIN.com" port="443" query="?localhost:3388" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIIvYPlsAAN4A84UAAAAK"
2019:11:02-00:32:32 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="13" user="-" host="49.196.9.220" method="RPC_IN_DATA" statuscode="401" reason="-" extra="-" exceptions="-" time="255404" url="/rpc/rpcproxy.dll" server="GATEWAY.MYDOMAIN.com" port="443" query="?localhost:3388" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIIvYPlsAAN4A84YAAAAI"
2019:11:02-00:32:32 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="13" user="-" host="49.196.9.220" method="RPC_IN_DATA" statuscode="401" reason="-" extra="-" exceptions="-" time="219445" url="/rpc/rpcproxy.dll" server="GATEWAY.MYDOMAIN.com" port="443" query="?localhost:3388" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIIvYPlsAAN4A84gAAAAI"
2019:11:02-00:32:32 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="13" user="-" host="49.196.9.220" method="RPC_OUT_DATA" statuscode="401" reason="-" extra="-" exceptions="-" time="228215" url="/rpc/rpcproxy.dll" server="GATEWAY.MYDOMAIN.com" port="443" query="?localhost:3388" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIIvYPlsAAN4A84cAAAAK"
2019:11:02-00:32:33 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="155" user="-" host="49.196.9.220" method="RPC_OUT_DATA" statuscode="302" reason="-" extra="-" exceptions="-" time="223668" url="/rpc/rpcproxy.dll" server="GATEWAY.MYDOMAIN.com" port="443" query="?localhost:3388" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIIvYPlsAAN4A84oAAAAK"
2019:11:02-00:32:33 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="155" user="-" host="49.196.9.220" method="RPC_IN_DATA" statuscode="302" reason="-" extra="-" exceptions="-" time="231956" url="/rpc/rpcproxy.dll" server="GATEWAY.MYDOMAIN.com" port="443" query="?localhost:3388" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIIvYPlsAAN4A84kAAAAI"
2019:11:02-00:32:33 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="1293" user="-" host="49.196.9.220" method="RPC_IN_DATA" statuscode="401" reason="-" extra="-" exceptions="-" time="253576" url="/RDWeb" server="GATEWAY.MYDOMAIN.com" port="443" query="" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIYvYPlsAAN4A84sAAAAL"
2019:11:02-00:32:33 sukafun-utm httpd: id="0299" srcip="49.196.9.220" localip="139.xxx.62.91" size="1293" user="-" host="49.196.9.220" method="RPC_OUT_DATA" statuscode="401" reason="-" extra="-" exceptions="-" time="252065" url="/RDWeb" server="GATEWAY.MYDOMAIN.com" port="443" query="" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="XbxeIYvYPlsAAN4A84wAAAAO"

If anyone still reading...still can't get my Andriod RDP working using Remote Desktop Manager app.

Consider your threat profile.   

• The most important requirement is to ensure that only the right people are getting in.   This means that 2-factor authentication is critical.   Adding in country blocking or some other form of IP filtering would be an extra measure of protection.
     
• If the wrong people can log in, the consequences of what they do from the desktop session are much more worrisome than what they might try to push through the http-rdp protocol combination.
  
  
• Even if an authorized person decides to attack your environment, he is going to do it from the RDP session.
  
  
• So the final risk is malware on the remote device that somehow attacks after the authorized user gets his session established.  If such malware is present, what are the chances that your proposed WAF configuration will detect it?   Seems pretty low to me.   I think it requires a nation-state level of sophistication, and if you are up against that type of attack, UTM content filtering is probably not the solution.

Assuming that you have 2-factor authentication in place, I predict that you could run this WAF in monitor mode forever, and you will only see false positives in the logs.

Hi Douglas,

Thanks a lot for the golden tips.

I totally agree with you that WAF won't give you 100% protection against malware coming from users' computers. At my work environment I'm using Citrix NetScaler to publish RDS farm which is used by thousands of users and we know that our biggest threat is infected computers that get connected to our RDS. 

Of course there are some security measurements that can be followed to minimize the threat just as disabling remote computer devices redirection, keeping servers up to date, installing smart antivirus on all servers, etc.

In my situation I have Home Sophos and my home RDS so my best is to use 2FA and apply country filtering as you mentioned. I've been using DNAT and I don't like but it was easier than Sophos WAF which I always wanted to configure for my RDS and I'm almost have it configured just trying to get my Andriod RDP working. It's very strange to me how Sophos doesn't have a solution for RDG 2012 and beyond! This's the main reason I've been lacking configuring WAF.

Cheers
Mo

Hello!

Could you Confirm, that you can Connect with the Windows 10 mstsc Application?

I'm not able to get this Method working.

When i add the following url Hardening entries:

/remoteDesktopGateway
/remoteDesktopGateway/
/RemoteDesktopGateway/*

The ios App starts working. All otherc Settings are like posted here.

But when the ios App works, the Windows Application is not able to connect anymore. When i remove the three entries, it seems like the Windows App does a fallback and works, but no ios.

Here are the Logs from a Connect from a Windows PC with the three Lines for ios Enabled:

Hi Andreas,

I had the same issue I think and ended up putting the firewall profile on monitor mode which isn't good anyway but I gave up trying to get my IOS working. Everything was working except IOS with these URLs: 

/remoteDesktopGateway
/remoteDesktopGateway/
/RemoteDesktopGateway/*

I tried your soloution, but it doesn't work. When /remoteDesktopGateway is accessible, i can't connect with Windows.

Now i have 2 WAF Profiles with different subdomains - one for ios (with the three exceptions available) and one without them.

The first is useable with IOS, the Second with Windows.

Can you use both Methods with one Profile? If yes, could you give me more Information about your Config?

Does anyone know, if the MacOS Client works the same way as the Windows Client or the IOS Client?

Do you have these entries in skip filter rules:

Also how about