Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 2 subscribers
  • Views 1496 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Trouble DNAT'ing MS Terminal Services (port 3389)

Orjan Sandland
Hi, I have a problem allowing access to a terminal server behind the astaro firewall.

I have set up a new service, TCP, source 1024:65535, destination 3389
I have defined the networks that are allowed to access this particular service.
This is the DNAT 

Pre DNAT destination
Network: External   
Service: MS Teminal Services
Post DNAT destination
Netowrk: WWW Server
Service: MS Teminal Services 

external is the network that is outside to the firewall.
WWW Server is a source route to the server that I want to access.

I open the packetfilter-violation-livelog, and I get this entry when trying to access the outside firewall ip with my terminal services client (ip-addresses changed):

23:28:10 198.38.54.22 1408  ->  192.168.1.10 3389 TCP SYN  

I keep wondering what the SYN means?
Either way - I can't connect and would appreciate ANY help to get this working.

Thanks in advance!

Ørjan Sandland


This thread was automatically locked due to age.
Parents
  • 0
    Just wanted to add something. For those I tested with last night, I had a source routed network... ie a single host.
    When I tried to allow access to a network subnet, it worked fine.

    Perhaps source routing doesn't work?
Reply
  • 0
    Just wanted to add something. For those I tested with last night, I had a source routed network... ie a single host.
    When I tried to allow access to a network subnet, it worked fine.

    Perhaps source routing doesn't work?
Children
  • 0 in reply to Orjan Sandland
    Have you anable Terminal Client Port:3389 in -Packet Filter? If you haven't that's why is not working.

    Jarek
  • 0 in reply to Jarek
    Yeah - DNAT occurs before the packet filter. SO the packet gets translated to the TS server and then has to be allowed with a
      
    "from" any "service" RDP "destination" TSServer "action" allow rule within the packet filter.

    Also I have found that after changing this sort of stuff a reboot is sometimes required to sort out the FW as on a number of occaisons I have been tearing my hair out trying to work out why it ain't working when everything looks OK. Everything defined was OK - the FW just needed a reboot to sort itself out.

    Sean
Unfiltered HTML