Network Protection: Firewall, NAT, QoS, & IPS Connections to 3389 port

UTM Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 10 replies
Subscribers 7 subscribers
Views 15232 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Connections to 3389 port

DrMeskon over 6 years ago

Hi,

I've configured destination NAT on Sophos UTM9 on public interface IP:3389->Local_ip:3389

In firewall live logging i see entries like this

Occasionally someone is sending SYN request and nothing more (this is what live log shows)

By the way netstat shows TCP Local_ip:3389 xx-xxx-33-158:54592 ESTABLISHED

and after second this ESTABLISHED is gone.

I've tried telnet from outside with one PC and established is long enough, so is this a some kind of scan?

Is this harmfull?

This thread was automatically locked due to age.

Parents

0 apijnappels over 6 years ago

Please do NOT use RDP over a public internet connection. If you need to access it, then use a VPN or look at RDP gateway like told above.

Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jay Jay over 6 years ago in reply to apijnappels

If you absolutely must use port forwarding, at the very least change the default rdp port to something else. Preferably something 5 digits longs.

https://support.microsoft.com/en-us/help/306759/how-to-change-the-listening-port-for-remote-desktop

Are you using a windows pc to connect to the remote desktop? If so, why not use UTM's L2TP/IPSEC vpn server? It's relatively easy to configure both on the UTM and windows. The latter has built in support for this type of vpn so no additional software is needed. I used the certificate encryption option rather than PSK (PreShared Key). PSK is easier yet as you just define a passphrase (lengthy and cryptic) rather than import a certificate. A side benefit is you can have access to other devices on your network directly. Firewall rules will need to be established.

www.sophos.com/.../asg_8_remote_access_via_l2tp_geng.pdf
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Jay Jay over 6 years ago in reply to apijnappels

If you absolutely must use port forwarding, at the very least change the default rdp port to something else. Preferably something 5 digits longs.

https://support.microsoft.com/en-us/help/306759/how-to-change-the-listening-port-for-remote-desktop

Are you using a windows pc to connect to the remote desktop? If so, why not use UTM's L2TP/IPSEC vpn server? It's relatively easy to configure both on the UTM and windows. The latter has built in support for this type of vpn so no additional software is needed. I used the certificate encryption option rather than PSK (PreShared Key). PSK is easier yet as you just define a passphrase (lengthy and cryptic) rather than import a certificate. A side benefit is you can have access to other devices on your network directly. Firewall rules will need to be established.

www.sophos.com/.../asg_8_remote_access_via_l2tp_geng.pdf
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data