Thread Info
  • State Suggested Answer
  • +5 person also asked this people also asked this
  • Locked Locked
  • Replies 22 replies
  • Answers 4 answers
  • Subscribers 37 subscribers
  • Views 89052 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Running Remote Desktop Gateway using WAF?

oxident

Hi!

I'm trying to migrate from UTM to XG and I can't get my Remote Desktop Gateway working.

In my network, I've got a Win2012R2 server which hosts the RDG-, Broker- and Webgateway-role.

In order to access it from outside of my private LAN, I've created the following business application rule (basically as I did in UTM):

  • HTTP-Template
  • hosted address: (my WAN port)
  • HTTPS: enabled
  • Redirect HTTP: enabled
  • Listening Port: 443
  • Certificate: (selfsigned using the correct FQDN)
  • Domains: (same as in the certificate)
  • protected server: the private IP of the server in my LAN
  • authentication: none
  • allow from: Any IPv4
  • exceptions: none
  • Application Protection: none (also tried a self made rule containing only "Outlook Web Access")
  • Intrusion Prevention: none
  • Traffic shaping: none
  • disable compression: off
  • rewrite HTML: off
  • pass Host Header: on

Now, if I access the server's Remote Desktop webfeed (https://myserver.mydomain.com/RDWeb/Feed/webfeed.aspx) or it's main URL (/RDWeb), I can access its ressources without problems or certificate warnings. Windows even creates shortcuts for the published RemoteApps.

But whenever I try to actually *use* the gateway (for accessing workstations in my LAN) or one of the RemoteApps, my client tries to connect a couple of seconds without success. It simply says "Cannot connect. Please check your connection".

I'm not yet very familiar with XG's log structure but so far I haven't seen any blocked packets or something similiar. I've even set up a rule that allows the Terminal Server to access the WAN zone without any authentification.

When I'm inside my LAN, everything works perfectly, as well as when using UTM 9.

Is there anything I could try?



This thread was automatically locked due to age.
Parents
  • 0
    Oxident,

    can you apply the Microsoft RDG 2008 as "Application Protection" ?

    You config seems ok.

    Luk
  • 0 in reply to lferrara

    I as well have a 2012 R2 Box behind the WAF.  I have GoDaddy SSL's installed and working on both the XG and the RDS server. 

    RDS - remote.mydomain.com

    WAF - home.mydomain.com

    By adding the following exceptions to the Firewall Business Rule and disabling URL Hardening, I still cannot get clients to connect. 

    /rpc/*,/RpcWithCert/*,/remoteDesktopGateway/*,/*

    The WAF is set to use the CERT from the RDS server, and pass the likewise URL requests.  I'm able to get to the Essentials Web Page and login, but again, I cannot start a RDP session with the RDS Gateway.

    Ive been searching the forums for a couple of weeks now, and cant seem to find any solution to get this working...  any update?

    -J

  • 0 in reply to Joel Hilliard

    Well, that was exactly my setup but it didn't work at all. I ended up in doing a Full-NAT using a different port (44300 in my case). That way, it works more or less...

Reply Children
  • 0 in reply to oxident

    Okay, after digging around a little bit more, I've finally got it working using an this older thread:

    community.sophos.com/.../302538

    In summary:

    - use WAF instead of NAT
    - create a custom protection policy (enable only "Pass Outlook Anywhere" and "Static URL Hardening" -> Entry URLs as written in the above thread)- add exceptions for a few paths (again, read the thread)
    - enable "Pass Host Header"

    That way it even works when using the Windows 10 (Mobile) Remote Desktop app.

    I'm quite sure I've tested this before but maybe I've missed something or Sophos fixed this in the current release ;-)

  • 0 in reply to oxident

    Oxident,

    the thread is really old but it works (I did not try it but I am sure it works). XG uses the same WAF as UTM9.

    I hope that  or  can take a note and make sure that a proper Template for RDG is already integrated inside the next version of XG. I know that we can create custom template, but it would be nice that who uses the built-in template can publish RDG easily without having a look at the community. [;)]

    Thanks

  • 0 in reply to lferrara

    Hi there

    I am also unable to publish Windows Remote Desktop Services.  I have followed the guidance in the documentation and reviewed many of the postings.  I get get RDS working fine, up until I added Static URL Harding, via a Protection Policy and the required exceptions, then it breaks.  The browser reports "Request Blocked", and "no signature found", the logs indicate the same.

    Bearing in mind I am using built in templates, I expected this to work.  Am I missing something?

    I have a single XG Firewall (SFOS 16.01.2).

  • 0 in reply to Sandy Millar

    Hi there

    I have answered my own question. :0(

    I reworked the scenario from the beginning and have it working. It appears that the Protection Policies Entry URL's must match the Exceptions, which is not surprising, however it appears that you need to add ALL the Entry URL's, e.g. /rpc/rpcproxy.dll?localhost:3388, /rpc/*, /RPCWithcert/* and /RDWeb/*, evn though I only wanted Remote Desktop Web Gateway.

    I suspect this is a case of "not seeing the wood for the trees".

    Kind regards

    Sandy