Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What im trying to do is RDP to a external address while connected through cisco vpn. at the moment i can RDP to internal addresses (192.168.3....) but not external. i was thinking that the firewall might be blocking the RDP port so i added a rule to allow access out on the port 3389 but this didnt resolve the issue.

External computer ----VPN --> ---> server ----> RDP external address

so when external useres connect using vpn they get a .99 address from the server.

Thanks Houlahan

share|improve this question
What external address are you trying to access - a system out on the internet, or the public address of a device in your network? – Shane Madden Feb 21 '12 at 16:49
A system out on the interent – Houlahan Feb 21 '12 at 16:57
Gotcha - but the connected VPN client can connect to other resources on the internet without issue, right? Can you provide your config, stripping out sensitive details? – Shane Madden Feb 21 '12 at 16:59
They cant access resorses on the internet unless they add in to there lan setting in IE the ip and port number to our webfiltering service but you cant ping any external ip address outside the network i think this is the problem – Houlahan Feb 21 '12 at 17:07

Your question isn't entirely clear - what firewall ?
Is this also a Cisco device ?

If it is, you need to allow access IN to the RDP port, not out.

access-list inside permit tcp any eq 3389

This won't work - as I said, you need to provide access INTO a firewall port.

access-list <vpn interface> permit tcp any eq 3389

share|improve this answer
sorry its a cisco firewall 515E at the top of the config it says PIX Version 6.3. I have the line access-list inside permit tcp any eq 3389. inside is vlan - – Houlahan Feb 21 '12 at 10:07
i implemented this rule and it still wouldent allow me to connect to a RDP outside the network. However i did notice that i was unable to ping any ip address outside the network – Houlahan Feb 22 '12 at 9:44

You probably want to configure split tunneling on the PIX.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.