Hi, I have the following architecture in mi organization:
And I wan’t to access to a Remote Desktop in a Windows Server 2K12 R2 SE (is a testing server on a VPN):
The firewall in the Windows Server is deactivated;
The Remote Access in Windows is activated with a specified user for login;
The port is configured in the NAT section of the Mikrotik Firewall like this;
This are the interfaces of the Mikrotik:
I can make a ping from my computer to the Server ;
And in whatsmyip.org I can check that the port 3389 is opened (at least in WAN)
But the problem is that I can’t access the Remote Desktop, it says the following error:
TRANSLATION:
Remote Desktop can’t connect to the remote computer for one of these reasons:
Remote access to the server is not enabled
The remote computer is turned off
The remote computer is not available on the network
Make sure the remote computer is turned on and connected to the network, and that remote access is enabled.
It seems like something is blocking the connection, but the ping is OK and the port is opened so I don’t know if I missing something,
Any help will be really appreciated,
Thanks in advance!
It’s hard to say what your firewall rules are really doing from a screenshot because there is missing information.
Open a terminal window and do:
/ip firewall nat export compact
/ip firewall filter export compact
Post the results here in a code block
(sanitize the public IP addresses in the output if you wish)
But to give some general assistance:
My question would be “how” is it failing - meaning does it instantly fail, as if something is actively refusing the connection, or is it sitting there in limbo and finally timing out?
If the former, then the port is being directed to something that is not listening on 3389
If the latter, then packets are being dropped by a firewall / sent to the wrong destination by routing or NAT rules
As RDP is encrypted by SSL and MS also sets the dont-fragment bit on the traffic, it’s frequently troublesome due to fragmentation.
Your packets are more than likely getting fragmented over the VPN. Will need wireshark or something similar to compare, and you more than likely need some change-mss rules on the firewalls and/or mikrotik.
Make sure that your load balance/share policy routing is not to blame.
I didn’t ask for the mangle rules and routing table earlier, but if your mangle table is like most common load balance configurations, then you have some rules that do connection marking for wan1 and wan2, and then some packet marking rules that operate based on the connection marks.
Make sure that you are marking connection-marks on new connections…
in-interface=wan1 connection-mark=no-mark action=mark-connection new-connection-mark=wan1
in-interface=wan2 connection-mark=no-mark action=mark-connection new-connection-mark=wan2
Obviously the interface names and the connection mark names are going to be specific to your installation, but I think you get the idea.
Another item of note: your firewall is a default-allow firewall, which is pretty insecure. You should at least make the input chain have a default drop rule, and also add some rules to the beginning of the input chain which accept all packets with connection-state=established,related and another rule to accept packets in-interface=LAN
Hi ZeroByte
Could you help me with a similar problem?
I can access from outside to my network perfectly, RDP, cameras, etc etc.
I cant access from within my network to outside, for example, cant RDP to something outside my network
Below are the configs you asked to the creator of the post.
First, it’s usually bad idea to post your problem to existing topic, just because you think it’s similar. It often isn’t and only creates confusion, because it requires others to pay extra attention to what is what. Make your own topic for yourself and 100% focus will be on your problem.
I didn’t study your whole config in detail, but the obvious mistake is rules like this:
You don’t limit destination address, so it takes all - incoming, outgoing, it doesn’t matter. If you can, add dst-address=. If not (because it’s dynamic), use dst-address-type=local.
