RD Connection Broker External Access

[Manny-Tech]

I'm having a bit of a weird problem with my connection broker when accessing my session hosts externally.

 

Setup:

 

RD Connection Broker - SRVRDS

RD Session Host - SRVRDS1

RD Session Host - SRVRDS2

 

Farm Name - remote.domain.sch.uk

 

NLB configured for SRVRDS1 + SRVRDS2. NLB cluster name remote.domain.sch.uk

 

DNS internally points to the NLB cluster IP

DNS externally points to the public IP of the NLB cluster

 

Firewall rule configured for public NLB IP to internal NLB IP on 3389

 

Internally everything works brilliantly. Externally it is very sporadic - some users connect, and some don't. If I disabled the Connection Broker service on SRVRDS then there are no problems with connection at all which makes me think the problem lies with the Connection Broker somewhere. I've checked the logs and it appears if a user connects to SRVRDS1 and isn't redirected by the Connection Broker all works swimmingly well. If a user connects to SRVRDS1 and then the Broker redirects them to SRVRDS2 then it just disconnects and says check the server is enabled for remote connection etc..

 

Do I need any further firewall configuration?

Has anyone come across this before?

 

Any help much appreciated.

[kmount]

For external usage I'd recommend using the RD Gateway role (it can sit on your connection broker) so you run this all over 443 instead of opening 3389.

 

That way you'll actually from the external point only ever connect to the gateway directly, the rest is tunnelled for you and handled by the RDCB.

 

Internally you can carry on hitting them however you like because the comms are bouncing around happily internally.

 

Remote Desktop Services (RDS) Architecture Explained - Yung Chou on Hybrid Cloud - Site Home - TechNet Blogs