RDP does not work over SSL VPN

Question

I read through several similar threads but none seemed to be the same. 
 
 Several of my customers have a UTM and use the VPN, but at one customer RDP doesn't work over VPN. 
 
 In summary: 
 1) RDP on the LAN works 
 2) SMB on the LAN works 
 3) Other services over LAN work (e.g. VoIP) 
 4) SMB on the VPN works 
 5) RDP on the VPN does not work: times out 
 6) Other services over VPN work (e.g. VoIP) 
 
 I can't find anything in the Firewall, Application Control or even IPS log, which is driving me insane - I don't even know where to look anymore now.

sachingurung · Accepted Answer

Hi Janssens, 
 PM me the remote access support code and I will look into the configurations. 
 Thanks

J.Janssens · Answer

I found the problem thanks to Sachin Gurun: it wasn't on the Sophos side - that's why I couldn't find anything in the log files. It was a GPO that only allowed RDP from specific subnets and the SSP VPN Pool subnet was not part of that.

--------------------

J. Janssens

Sophos Certified Architect
Sophos Certified Engineer
Sophos Certified Sales Consultant
Gold Partner

sachingurung · Answer

Hi All, 
 In such events, always look at the tcpdump captures to understand the packet communication between the two endpoints. In this example, the UTM was forwarding the SYN request from the VPN connected client but the Server didn't respond with an ACK packet. 
 11:25:19.168707 In ethertype IPv4 (0x0800), length 68: 10.242.2.3.49868 > 172.29.9.1.3389: Flags , seq 3435107371, win 8192, options [mss 1350,nop,wscale 8,nop,nop,sackOK], length 0 
 11:25:19.168932 Out 00:1a:8c:58:30:d1 ethertype IPv4 (0x0800), length 68: 10.242.2.3.49868 > 172.29.9.1.3389: Flags , seq 3435107371, win 8192, options [mss 1350,nop,wscale 8,nop,nop,sackOK], length 0 
 11:25:22.087104 In ethertype IPv4 (0x0800), length 68: 10.242.2.3.49868 > 172.29.9.1.3389: Flags , seq 3435107371, win 8192, options [mss 1350,nop,wscale 8,nop,nop,sackOK], length 0 
 11:25:22.087215 Out 00:1a:8c:58:30:d1 ethertype IPv4 (0x0800), length 68: 10.242.2.3.49868 > 172.29.9.1.3389: Flags , seq 3435107371, win 8192, options [mss 1350,nop,wscale 8,nop,nop,sackOK], length 0 
 11:25:28.323570 In ethertype IPv4 (0x0800), length 64: 10.242.2.3.49868 > 172.29.9.1.3389: Flags , seq 3435107371, win 8192, options [mss 1350,nop,nop,sackOK], length 0 
 11:25:28.323678 Out 00:1a:8c:58:30:d1 ethertype IPv4 (0x0800), length 64: 10.242.2.3.49868 > 172.29.9.1.3389: Flags , seq 3435107371, win 8192, options [mss 1350,nop,nop,sackOK], length 0 
 Hope that helps someone.

RDP does not work over SSL VPN

Submitted a Tech Support Case lately from the Support Portal?