Changing outbound RDP port

[Steve21]

Morning All,

 

Bit of a weird question, but is there a way to change (or at least fix) the outbound ports for RDP?

 

Got a problem with a lil project I'm working on that as only 3389 is open via the firewall (in and out) when RDP tries to connect it's using a random port (seems to be 38*** range) for the outbound but 3389 on the way in so gets blocked. And this port seems to change everytime, we've had 38790 39497 etc etc

 

(We can't use the exe name is it's on an external firewall for this project)

 

Thanks,

Steve

[mjs_mjs]

yeah i think you can do it in the REG

 

HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Control, Terminal Server, WinStations, RDP-Tcp

[Steve21]

Sadfully that's the listening port e.g. 3389, not what the server connects back to the client on

 

Steve

[mjs_mjs]

I can't say i've encountered this problem before - I usually open 3389 and 3390 up for RDP and it just works (on the gateway/WAN firewall).

[Steve21]

I can't say i've encountered this problem before - I usually open 3389 and 3390 up for RDP and it just works (on the gateway/WAN firewall).

 

Most firewalls don't have the ports blocked on the way out though. Only when coming in, so that's why 3389 etc is opened normally.

 

svchost.exe	1160	TCP	tester-win7.mshome.net	[b]ms-wbt-server[/b]	its-001	[b]39497[/b]	ESTABLISHED	71,081	6,845,262	430	173,234	1,514	1,424	2	16		

 

3389 (MS-WBT-SERVER) is the incoming connection it's listening on.

But the connection back to the pc is 39497 in that example.

 

It's a pain

 

Steve

[Guest obsidianpillar]

We've got it setup on our RDS server to change the port to 3390. We deployed it via a Registry GPO and linked it to the OU with the server in. We then created a firewall policy at the root of the domain to allow the port as by default Windows Firewall was blocking it. We have two remote desktop servers. 2008 R2 for our CCTV stuff and 2012 R2 for all user remote access and this has worked fine with us before? (Using 3389 and 3390). I have tried to replicate the issue and can see that it is indeed using a different port number. I ran netstat as an RDP session was in progress and got the following.

 

TCP 10.0.0.31:65380 DC-01:ms-wbt-server ESTABLISHED

 

I'll do some research and see what I get.

 

Best,

Tom.

[Steve21]

Aye Tom, it listens on 3389/3390 etc still as changeable by the regkey, but the out-going is the problem (Windows Firewall allows all outbound connections by default).

 

Will be interesting to see if anyone has a way or finds one haha

 

Thanks,

Steve

[twin--turbo]

It's highly unusual to do src-port matching on firewalls as in general these days it does not matter.

 

Service source ports are generally random, the dst-port is what matters. Firewalls do stateful connection tracking so that any established connection allows related traffic.

 

TT

[Jamo]

Yeah agreed, its a feature of tcp that the source port will be picked from a pool of available ports. You dont normally do source port rules for tcp, whats the reasoning behind wanting to do that?

[Steve21]

The only access to said machines should be RDP, apart from that we want them isolated from the outside (no internet etc), but as its not using anything like Windows firewalls on client can't block the access apart from ports etc

 

The idea being block all but 3389 traffic which obviously hit this issue as its not using that outbound

 

Steve

[twin--turbo]

sorry, lost me. please explain what you want to block/allow and from/to

 

I have 14 firewalls and the only one we do src-port matching on is for "WMI" as MS are utter planks.

 

TT

[Jamo]

So you want these stations to only be able to RDP?

 

then in the FW just allow the dest port 3389 to your destinations and let the default deny all tule clobber all other traffic.

 

If they shouldnt talk to eachother then use te windows firewall,block ping etc

[Steve21]

RDP in, RDP out, nothing else Is the short version. No ping, no interwebs, no FTP, no..... etc

 

The 3389 destination on way in works fine Jamo, but they shouldn't be able to communicate outwards which they can be default (and can't use windows firewall to stop them, needs to be server/firewall side)

 

Steve

[twin--turbo]

So on the firewall, you allow 3389 from your network to anywhere. then block everything else. Totally normal, you should never have a firewall to the internet that allows unrestricted access from clients.

 

rule1

Src = IP subnet of network

dest = any IP

Service = 3389

action = allow

 

rule 2

src = IP Subnet of network

Dest = Any IP

service = all

action deny.

[Steve21]

So on the firewall, you allow 3389 from your network to anywhere. then block everything else. Totally normal, you should never have a firewall to the internet that allows unrestricted access from clients.

 

rule1

Src = IP subnet of network

dest = any IP

Service = 3389

action = allow

 

rule 2

src = IP Subnet of network

Dest = Any IP

service = all

action deny.

 

Then it blocks RDP on the way out as it can't connect to "insert random 38xyz" port :s Unless I'm missing something obvious. As soon as you stop the traffic going out it cuts the connection during my tests.

 

Steve

[twin--turbo]

having said that,

 

I would never allow RDP traffic in or out over an untrusted network.

[twin--turbo]

Where do the clients get DNS?

 

TT

[Steve21]

Where do the clients get DNS?

 

TT

 

In this instance off the NAT on the firewall, as it's an isolated network so no servers on it. All that seems to work fine though until I block the port that it's using to connect out on.

 

As an example if I block 3389 outwards it does nothing, if I block the port it's currently using e.g. 39695 it'll disconnect and after a few retries reconnect on another port eg. 38888 and as that's a random port RDP seems to connect through it's bit of a faff :s

 

Steve

[twin--turbo]

You need to forget about the random port, it's the source port and you should avoid source port blocking.

 

Try the destination server by IP rather than hostname with the rule in. If it works then DNS is being blocked so try adding a rule for Dest Port 53 Allowed.

 

TT

[Steve21]

You need to forget about the random port, it's the source port and you should avoid source port blocking.

 

Try the destination server by IP rather than hostname with the rule in. If it works then DNS is being blocked so try adding a rule for Dest Port 53 Allowed.

 

TT

 

Not sure if we're talking different ends here, but the only issue is the ports from inside going outwards. As that's the machines that are needing to be blocked.

 

The machines inside the firewall can't have any external access, the RDP connecting in part is working fine. It's once the external connection is made the machine within the firewall is trying to connect back on a port it shouldn't be allowed on and thus getting blocked. (e.g. any but 3389)

 

Else the internal machines could access websites/ping etc (from inside -> outwards) which is the issues if that makes any more sense?

 

Thanks,

Steve

[twin--turbo]

Ok what your describing is quite normal.

 

You initiate a connection to a port, the service responds on any port. In the olden days this really was a big problem.

 

Modern ( like 15++++ years firewalls ) have statefull inspection. So if you make a connection to a service on 3389 the responding traffic is allowed through whatever the port it comes from.

 

You need to look at the firewall for options to enable stateful inspection.

 

TT

[Jamo]

Just want to add here TCP is a connection oriented protocol, so there is only one connection made, from a random high numbered port (the source port) to a single listening port (the dest port), the dest port does not connect back as it can already talk via the existing connection stream, all transmissions are then dealt with by this connection. There is only one rule required which is basically to allow 3389 from the restricted network into the main network, no other rule is required for RDP.

 

The other services, such as DNS, NTP, AD integration, if required will also each need their own rules, so UDP and TCP port 53 for example for DNS. (With UDP you may have to open both ways depending on the firewall as its not connection based)

 

What type of firewall is this?