Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 28 subscribers
  • Views 825 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

external RDP access does not work - XG Firewall bridge mode

Diego Beton

I need to learn how to free external access to RDP. Before placing the Sophos Firewall on the bridge, my Mikrotik was solely responsible for releasing the RDP ports of each server of mine. Now I can't communicate externally with my servers, only locally.

Each server of mine has a fixed iP and a separate RDP port, for example:

Server 01:
ip: 192.168.0.150
RDP port: 3389

Server 02:
ip: 192.168.0.151
RDP port: 3390

and so on....
In my mikrotik there are TCP and UDP rules with the release of the port for the local fixed IP. I also have a DDNS account added to my mikrotik. This allows me to communicate with my servers in 2 ways, through my public IP and through my DDNS, for example:

Server 01:
Public IP (example): 189.38.32.1:3389
or: myddns.net:3389

Server 02:
Public IP (example): 189.38.32.1:3390
or: myddns.net:3390

before adding the Sophos firewall, external access was functional. Now, with the addition of the Sophos firewall, I can't do that anymore.

Grateful for the help and suggestions!



This thread was automatically locked due to age.
  • +1

    Start a TCP Dump on your Webadmin GUI. Maybe you have an issue because of IP Spoof detection. You will see the reason there if the packet is dropped.

  • +1

    Hello Diego,

    Thank you for contacting the Sophos Community!

    As suggested by LHerzog, start by doing a Packet Capture on the WAN interface of your XG, to see if you’re seeing the traffic arriving at the WAN, then if you’re seeing you can do a TCPdump on the Advanced Shell of the XG to see if the XG is forwarding the traffic to your server and hearing back from it.

    In the Advanced Shell you would run

    #tcpdump -eni Port3 host 192.168.0.150 and port 3389

    Also, try posting a screenshot of your DNAT rules showing the Ports used in the Services tab.

    Regards,

  • 0 in reply to emmosophos

    I’ll start testing this evening. Thanks to everyone for the suggestions. However, only for reinforcement, local access (via local ip) is possible. Only external accesses that do not work.

    this way (locally) it works:
    192.168.0.150:3389 or 192.168.0.151:3390 and so on ...

    this way (externally) no longer works:
    when I use my public ip + RDP port or my DDNS + RDP port, example:
    189.38.32.1:3389 or myddns.net:3389

    I will now start a TCP Dump in my GUI and post the result.
    Once again, thank you very much for your help!

  • 0 in reply to Diego Beton

    of course it will, you are inside the your security wall.

    Also he only has two ports.

    Ian