Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 16453 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Defaut RDP 3389 Blocked on VPN

Goon
Good Day All 

We have a ASG220 with Firmware version:  8.301, since version V.8.103 we have had an issue were we cant connect to all out Windows servers using RDP via VPN(SSL/PPTP/IPsec etc). 

At the time we upgraded the firmware and experienced the issue I did not have enough time to troubleshoot and came with the quick fix of using a different port for RDP connections, of course this required changing our RDP/Terminal servers default listening port on the registry. So basically by using the diff port 4777 instead of 3389 my RDP connections work, the only thing I could think of is a firewall rule blocking 3389 however:
I have tried removing all the firewall rules and still not going thru;
I have checked the live firewall live log and I dont see any block/drop activity;

On the Internal LAN RDP works with defaults(3389) well and I checked our servers firewall its completely off. Is the a way for me to check were the packets are being dropped/blocked, at this point I think the fault is with Astaro because using the custom port 4777 RDP works. 

Thanks for any assistance


This thread was automatically locked due to age.
  • 0
    Hi, and welcome to the User BB.

    Whenever something unexplainable starts happening, it always pays to check the Intrusion Prevention log.  My guess is that you need an Exception for Anti-DoS Flooding from the VPN Pools to the Netwrok Group of the devices you want to reach via RDP.

    Was that it?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Thanks for the feedback, I will test later today and post back. I have already added the excpetions under Intrusion Prevention
  • 0 in reply to Goon
    Hi Bob

    I added exceptions earlier as mentioned see ScreenShot122, I connected via SSL VPN and tested RDP however still can't connect. I have also attached a screenshot of the IP live log when I attempt RDP and I could not see anything relating to it being blocked etc.

    I also opened our Firewall live log when I attempt RDP however the is nothing also matching RDP, I cant post that log as it seems it would expose some expects of the network.

    I also tried to use Microsoft Network Monitor to trace, but I dont get were the packet is dropped.

    Please note the reason I think its Astaro its because default RDP doesnt work work over VPN Windows/Linux/Ipad devices so I dont think its client side.

    Thanks for any tips you might have
  • 0
    So, it appears that it's not Intrusion Prevention, but it would be interesting to see what's in the IPS and several other logfiles at 8:30AM your time on 6/19 when you did the packet capture: DNS Proxy, Firewall and the VPN you were using.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    You also have the option of shelling into the Astaro (console or SSH) and running TCPDump to see the traffic through the Astaro.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0 in reply to Goon

    I have same issue.. remote device ping destination reply but cant RDP.

    after looking this forum.. I've try to

    add firewall source vpn pool (PPTP) destination target remote segment any port allow
    add exception on Intrusion Prevention like you do..

    and these solve my problem.. now RDP is avaiable even from android device..

    Thanks for the forum

Unfiltered HTML