Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What im trying to do is RDP to a external address while connected through cisco vpn. at the moment i can RDP to internal addresses (192.168.3....) but not external. i was thinking that the firewall might be blocking the RDP port so i added a rule to allow access out on the port 3389 but this didnt resolve the issue.

External computer ----VPN --> 192.168.99.0/24 ---> server ----> RDP external address

so when external useres connect using vpn they get a .99 address from the server.

Thanks Houlahan

share|improve this question
    
What external address are you trying to access - a system out on the internet, or the public address of a device in your network? –  Shane Madden Feb 21 '12 at 16:49
    
A system out on the interent –  Houlahan Feb 21 '12 at 16:57
    
Gotcha - but the connected VPN client can connect to other resources on the internet without issue, right? Can you provide your config, stripping out sensitive details? –  Shane Madden Feb 21 '12 at 16:59
    
They cant access resorses on the internet unless they add in to there lan setting in IE the ip and port number to our webfiltering service but you cant ping any external ip address outside the network i think this is the problem –  Houlahan Feb 21 '12 at 17:07
add comment

2 Answers

You probably want to configure split tunneling on the PIX.

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/basclnt.html

share|improve this answer
add comment

Your question isn't entirely clear - what firewall ?
Is this also a Cisco device ?

If it is, you need to allow access IN to the RDP port, not out.

access-list inside permit tcp 192.168.99.0 255.255.255.0 any eq 3389

This won't work - as I said, you need to provide access INTO a firewall port.

access-list <vpn interface> permit tcp 192.168.99.0 255.255.255.0 any eq 3389

share|improve this answer
    
sorry its a cisco firewall 515E at the top of the config it says PIX Version 6.3. I have the line access-list inside permit tcp 192.168.99.0 255.255.255.0 any eq 3389. inside is vlan 192.168.2.0/24 - 192.168.9.0/24 –  Houlahan Feb 21 '12 at 10:07
    
i implemented this rule and it still wouldent allow me to connect to a RDP outside the network. However i did notice that i was unable to ping any ip address outside the network –  Houlahan Feb 22 '12 at 9:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.