RDS 2019 through Smoothwall UTM

[Sheridan]

I'm testing a new 2019 server with RDS for Mac and Windows users, it works fine internally but when tested through our 'test' firewall (an old TMG 2010 server) it fails with the error code 0x3000008 which seems to be a generic connection error. I'm about to try and publish the server through our smoothwall UTM instead, has anyone ever tried this, as I would be interested in any pitfalls or problems that they might have had? We have a domain wildcard ssl so we're ready to put a live server out. Edited May 13, 2019 by Sheridan

[foofighterjim]

As far as I can recall you just need to setup a port forward to the RDP server in Smoothwall. Obviously make sure there are no firewall rules blocking the inbound or outbound connection.

[localzuk]

How are you trying to publish this? As raw RDP, or via a RD Web server/Gateway?

[Sheridan]

Its using RD Web Access. I was expecting to use the reverse proxy, probably as I'm used to the TMG method of old. We have the smoothwall public IP as the DNS destination for our rds server so I thought we would reverse proxy the https://server.domain to the internal RDS server ip?

[localzuk]

We use Sophos UTM, and we had issues with reverse proxying to RD Web/Gateways. Ended up just port forwarding to port 443 on the RDSWeb/gateway host instead.

[Sheridan]

I guess that's my plan B - I assume you're directing all inbound traffic on your public IP/443 to your RDS server? We also want to publish another HTTP service this way but it does use a different port to 443

[localzuk]

I guess that's my plan B - I assume you're directing all inbound traffic on your public IP/443 to your RDS server? We also want to publish another HTTP service this way but it does use a different port to 443

Yeah, we have a NAT rule in place pointing all port 443 traffic on one of our public IP addresses to the server internally. We have more than 1 public IP address, so this isn't a problem for us. Our other HTTPS services are behind our Sophos UTM reverse proxy though, as that handles SNI so they all use a single IP.

[Sheridan]

I think the Smoothwall is going to be tricky to get working. I've tried both ways and they fail in different ways

1) Reverse proxy the https://server.domain/rdweb to the internal RDS server ip fails with 'connection refused'

2) Port forward HTTPS on our external IP to the ip of the internal RDS shows connection timeout

 

I'm not sure if its the UTM or my RDS server that's not configured correctly, as the Smoothwall config seems pretty simple.

[localzuk]

Do you have the bindings in IIS on the web server set up correctly? Oh, also, you need more than RDWeb I believe - you also need access to /Rpc and /RpcWithCert (which I believe are part of the gateway side of things). Edited May 13, 2019 by localzuk

[Sheridan]

Bindings on IIS are all IPs on the server, managed to get port forwarding working though! Still can't get reverse proxy to open an app - same 0x3000008 error after the second login appears

[Sheridan]

Hmm, looks like RDS just doesn't work at all from a Mac client. Doesn't matter what I do I get the same error (0x000008 or 0x000016)

 

I can't get the Windows clients to work either. Weirdly it works on a Mac tethered to a phone, but not when at home. The Windows version at home simply continually requests login details even though they're input correctly.

 

I wasn't expecting much from RDS but it looks like I'll be sticking with Citrix on our new build server - it may be expensive but it works across platforms properly!

[Cache]

For your Windows client, have you tried entering it in the format domain\username?

[Sheridan]

For your Windows client, have you tried entering it in the format domain\username?

 

Yes, that just pops up saying the remote desktop server is currently unavailable! I think I'll go back and try server 2016 next

[Sheridan]

I get this error on Windows clients. Seems to be a fairly generic error though. I've only got port forwarding on 443 so I'm wondering if its trying to access on port 3389?