I have added my role to a virtual subnet, and configured network security groups to allow 63389 inbound to 3389 I've tried various permutations 3389 to 3389 But I can never get RDP to work. If I remove the NSG it works ok. I'm basically doing what it says here

Here is what I am currently using for my web_sg subnet

# RDP inbound
Get-AzureNetworkSecurityGroup -Name "web_sg" | Set-AzureNetworkSecurityRule -Name RDP-web_dmz -Type Inbound -Priority 347 -Action Allow -SourceAddressPrefix 'INTERNET'  -SourcePortRange '63389' -DestinationAddressPrefix '' -DestinationPortRange '3389' -Protocol TCP
# SSL Inbound
Get-AzureNetworkSecurityGroup -Name "web_sg" | Set-AzureNetworkSecurityRule -Name SSL-web_dmz -Type Inbound -Priority 348 -Action Allow -SourceAddressPrefix '*'  -SourcePortRange '*' -DestinationAddressPrefix '' -DestinationPortRange '443' -Protocol TCP

I have also tried 3389 -> 3389, and * -> 3389 and have also added these as endpoints in my cloud service. Note that I am enabling remote desktop manually using the azure management website.

Any ideas?

  • It would be useful if you could post the rules/zones/subnets you have created for this purpose. – Noor Khaldi Jun 18 '15 at 7:19
  • Did the extra info help? – Ian1971 Jun 22 '15 at 10:03

If your cloud service is sitting behind an NSG, you may need to create rules that allow traffic on ports 3389 and 20000. Remote Desktop uses port 3389. Cloud Service instances are load balanced, so you can't directly control which instance to connect to. The RemoteForwarder and RemoteAccess agents manage RDP traffic and allow the client to send an RDP cookie and specify an individual instance to connect to. The RemoteForwarder and RemoteAccess agents require that port 20000* be opened, which may be blocked if you have an NSG.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.