Remote Desktop and VPN

[Thermochemist]

Need Help Confining Remote Desktops to within a VPN Connection

Setup:
Small business network consisting of a Win 2K3 Server (w/RRAS), several WinXP Pro workstations, Comcast Broadband connection, using a Linksys RVS4000 VPN Router.

(1) A VPN Connection is successfully established by using a Network Connection configured in MS Win XP Pro; by specifying the WAN IP of 173.12.26.1xx

(2) Port Forwarding has been successfully configured in the RVS4000 to allow VPN Connections using PPTP (ports 1723 and 47 for GRE); they go to the RRAS Server on the local LAN static IP of 192.168.2.6.

(3) Once a valid VPN Connection is established (via a shortcut on the desktop for the Network Connection), the Remote Desktop program (native to Win XP Pro) is used to successfully connect to the RRAS Server (at static IP 192.168.2.6) AS expected / desired (see point 2 above).

Remote Desktop Connections work without any problems to/from any desired computer from within the local LAN (at the business locale); so we know RD is configured correctly on the workstations. Workstations have been configured to "listen" for RD requests on different ports; for example, to RD to a workstation with a static IP of 192.168.2.8, the user specifies 192.168.2.8:3391 in the RD session to get the connection.

Note: User home networks have a LAN IP with a different subnet (192.168.1.x); so there are no conflicts there.

The Problem
Besides the Server, we'd like to RD, from Remote locations (user homes) to several workstations which have all been configured with static IPs (192.168.2.x). Currently, the ONLY RD connection that works Remotely, as expected / desired, is the one that goes to the Server at static IP 192.168.2.6; once the VPN Connection is made.

If a Port Forwarding entry is made in the RVS4000 for the additional workstations (example, Port 3391 to get forwarded to 192.168.2.8) the Remote Desktop connection WORKS. Unfortunately, it works when a user (ANY User..!) types in the WAN IP of 173.12.16.1xx PLUS the port 3391.

This is NOT what we want..! RD access to any of the workstations using the local LAN IP in the 192.168.2.x range should ONLY be restricted to be accessible WITHIN a valid VPN Connection.

If a VPN Connection is established and a LAN IP other than 192.168.2.6 is specified in an RD sesion, say 192.168.2.8:3391, then it does NOT work. A generic Remote Desktop Disconnected window appears after a short delay.
A PING can connect to the business Router (192.168.2.1), the Server (.2.6), AND the desired workstation (.2.8). It is unknown why an RD session can NOT be established with any computer other than th Server after a VPN Connection is established..!


I suspect problem resolution would be somewhere on the EDIT IP ACL LIST tab of the RVS4000 (???) I've tried for days trying to configure such, but have had no luck.

I've tried first creating a new Service named RemDTop where I specify the range of RD Ports workstations will use (339x to 339y). Then I use that with a create ALLOW Rule where the Source is LAN (since I don't want WAN access, right?), and the Destination IP is a range for the workstations using those RD Ports (192.168.2.x to 192.168.2.y). When done, it's Enabled.

Here's where I'm stuck..!
Is the ACL List the way to go..?
IF so, what parameters should I be specifying for the Source (LAN, WAN; Any Net, Range..?).

Any point in the right direction would be greatly appreciated..!

Thank you.

 

[uncleronald]

Hi there,

I'm new to this forum, so please exscuse me if I've misinterpreted your post. However, I get the impression that you are overcomplicating matters somewhat.

I have a number of remote users within my organisation and they all connect as follows

1) connect to vpn and get ip (like yours on a different subnet)
2) Connect to windows XP or server using RDP on standard port

In days gone (years to be honest) I used to redirect non standard ports from a firewall to a different desktop machine.

From reading your post though, once a machine is connected you are routing traffic succesfully between the 2 subnets. So when you are connected, why not just specify the LAN ip of the machine you want to access?

Ron

 

[Thermochemist]

From reading your post though, once a machine is connected you are routing traffic succesfully between the 2 subnets. So when you are connected, why not just specify the LAN ip of the machine you want to access?
++++++++++++++++++++++++++++++++++++++++++++

Thanks for the reply uncleronald..!

When the following Port Forwarding Rule is Enabled on the RVS4000 tab...

Application External Port Internal Port Protocol IP Address Enabled
RD_002 3391 3391 TCP 192.168.2.8 Checked

...the Win XP Pro workstation [at 192.168.2.8] IS accessible from the LAN -or- the WAN by specifying 173.12.26.1xx:3391 in the Remote Desktop session. Unfortunately, this is NOT what we want.

The RD session should ONLY be established when the VPN Connection is first established AND ONLY when the workstation's Local static LAN IP (and port) is specified; 192.168.2.8:3391.

If the Port Forwarding Rule is Disabled, the Win XP Pro workstation is NOT accessible from the LAN -OR- the WAN (by specifying 173.12.26.1xx:3391 or 192.168.2.8:3391)...!

As mentioned, the RD works fine from/to any desired computer within the LAN (so it's not an RD config issue). An RD connection to the Server, with LAN IP of 192.168.2.x, works without any problems. It is unknown why no other computer, besides the Server, is accessible using RD [?].

I figured, AS you mentioned, once one computer was able to be accessed on the office's LAN subnet (192.168.2.x), that any/all desired computers would be accessible on the office's LAN subnet from the Remote locale.

Once a VPN connection IS established, I try specifying the Local LAN static IPs of the workstations I want to connect to in the RD session (plus the port). ALL RD attempts to the Win XP Pro workstations fail. Connections to the Server are no problem; yet they ALL have LAN static IPs on the same subnet of 192.168.2.x. [I'm flustered..!]

 

[JustAGuy51]

Once a VPN connection IS established, I try specifying the Local LAN static IPs of the workstations I want to connect to in the RD session (plus the port). ALL RD attempts to the Win XP Pro workstations fail. Connections to the Server are no problem; yet they ALL have LAN static IPs on the same subnet of 192.168.2.x. [I'm flustered..!]

I think the problem lies in your workstations not knowing how to respond to remotely connected nodes (via RD). So they send the reply packets to the router, RVS4000.

To confirm, have tcpdump listening on your workstations on (incoming) port 3391 (supposed to be 3389?). If tcpdump see the packets, then my thinking is correct. Solution is to have those workstations send the reply packets to your Win 2K3 Server (w/RRAS). Currently they are sending reply packets to the router; they will be rejected eventually. Remember that reply packets need to be encrypted to be accepted by your home nodes and your 2k3 server is the one doing encryption, not the router. Put some static routes into those workstations' routing tables.

Let me know!