Re: redesktop through a firewall

> Marijn Hofstra wrote:
> >> I am attempting the following:
> >>
> >> rdesktop<->smoothwall<->internet<->smoothwall<->XPpro
> >>
> >> I've got port 3389 forwarded on both smoothwall devices to 
> the proper 
> >> internal IP, but when I try:
> >>
> >> rdesktop -u user external_ip_of_firewall
> >>
> >> I get:
> >>
> >> ERROR: connect: Connection timed out
> >>
> >> What am I missing.
> > 
> > I am using smoothwall to allow outside access to our 
> terminal server. I've
> > also used a 2 smoothwall setup, although it doesn't make things any
> > different because you only need to configure one smoothwall 
> (smoothwall does
> > not restrict outbound traffic by default). It has worked 
> fine with rdesktop
> > and mstsc.
> > 
> > On the networking > port forwarding page, you need to 
> specify the following
> > values for a port forwarding rule:
> > Proto    External source IP       Source port   Destination IP
> > Destination port
> > TCP      IP_OF_OTHER_SMOOTHWALL   3389          
> IP_OF_WINXP_PC    3389
> 
> This is exactly what I'm doing.  Must be something else going on here.
> 
> What I don't understand is, I can ssh to a Linux box inside this 
> network, that is through this same smoothwall.  From there, I can run 
> rdesktop to that machine and display it back on my network.  I do 
> understand that all this is happing in the ssh tunnel, but this does 
> tell me that the XP box I'm trying to connect to is accepting 
> connections from rdesktop.
> 
> > Basically, all you need to do is tell the "receiving" 
> smoothwall to forward
> > all incoming traffic on port 3389 to the internal IP of the 
> XP box. Unless
> > you modified the "sending" smoothwall to block outside 
> traffic, this is all
> > you have to do. Perhaps you have used the "DMZ Pinhole" 
> configuration page?
> > This page is not suited for configuring [internet] <--> 
> [local pc] traffic,
> > but rather for [local DMZ pc] <--> [local green zone PC] traffic. 
> 
> I removed the references on the 'sending smoothwall', still no joy. :(

kind of strange... you could try checking the firewall logs on the
smoothwall box (the one with the port forwarding rule) and check for blocked
attempts on port 3389. You could also check the kernel log for occurrences
of the IP that is connecting to the XP box, and if that doesn't fly either,
you can tell the SW to log all activity from a certain ip address  via
networking > ip block.

Perhaps this is a long shot, but is the XP box using the smoothwall as its
gateway? If it is using a different gateway (for example when you have two
connections to the internet for redundancy), it will receive a request via
the smoothwall box and reply through the other internet connection and hit
the firewall there (which expects to hear via the smoothwall box). Even if
this isn't true, you might want to check the logs on both smoothwalls.

As Kevin said, if telnet doesn't work either, it's probably somewhere in the
smoothwall box (check the logs on both servers to figure out which one). You
could also try to ssh to the "receiving" smoothwall box and check if it can
telnet to the XP box itself, that way you can isolate the issue a bit
further.

-Marijn

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV