Page 1 of 1

RDP Problem behind Mikrotik

Posted: Thu May 04, 2017 1:09 pm
by Marktime87
Hi Guys

I'm running an RB3011 for a client, everything is fine except the one RDP connection they a staff member uses. No other machines are using RDP at the moment.

So the below code is what I have in place for her RDP:
 chain=dstnat action=dst-nat to-addresses=192.168.1.252 to-ports=4001 
      protocol=tcp dst-port=4001 log=no log-prefix=""
I can see packets going through when I try to connect but no success. If I make the same rule but get it to go to 192.168.16.254:3389 (thier server) it works. If I RDP from the server to the client PC, it also works. But if I have the rule setup for her PC on port 4001 it doesn't work. With the rule enabled http://canyouseeme.org/ cannot see port 4001 as open.

The rule is identical in setup to their port 443 rule for the VPN server, which does work and can be seen on http://canyouseeme.org/.

So why the frick isn't it working on the client PC?

Any ideas?

Cheers

MT

Re: RDP Problem behind Mikrotik

Posted: Thu May 04, 2017 2:59 pm
by kamillo
Check this: https://serverfault.com/questions/12005 ... te-desktop
RDP uses port 3389 so I'm not sure why are you using 4001?
Another thing could be firewall blocking traffic

Re: RDP Problem behind Mikrotik

Posted: Thu May 04, 2017 4:20 pm
by p3rad0x
If you want to use 4001 rather to this
 chain=dstnat action=dst-nat to-addresses=192.168.1.252 to-ports=4001 
      protocol=tcp dst-port=3389 log=no log-prefix=""

Re: RDP Problem behind Mikrotik

Posted: Thu May 04, 2017 10:34 pm
by Marktime87
Cheers guys.

Kamillo - I changed the port to 4001 as the server used to be on 3389.

Also I'm connecting via "public ip":4001 so it will try to rdp on that port and not 3389 anyway.

The firewall has the port open, everything was working for years until the RB install.

Sent from my SM-G920F using Tapatalk

Re: RDP Problem behind Mikrotik

Posted: Mon May 08, 2017 10:59 am
by karlisi
Are You using default RDP port 3389 on server 192.168.1.252 when connecting from inside network and want to connect to port 4001 from outside? If so, rule should be
chain=dstnat action=dst-nat to-addresses=192.168.1.252 to-ports=3389 
      protocol=tcp dst-port=4001