RDS 2019, what am I doing wrong!?

[Sheridan]

OK, before I run off into the bushes crying, I can't see for the life of me what is wrong on my very simple, basic RDS test box.

 

Internally - a single RDS server 2019 with the Gateway/Web Access/Licensing role on it, with a fixed IP address and domain wildcard certificates installed on it for all the services

Externally - a public IP dns registered with the server.domain - with that IP being our Smoothwall UTM's public facing IP

Smoothwall - configured to port forward incoming 443 to the internal IP of the RDS server

 

It works fine internally, but externally I can login and see the apps but always see an error 'Your computer can't connect to the remote computer because the Remote Desktop Gateway server is temporarily unavailable. Try reconnecting later or contact your network administrator for assistance. '

 

When I look at the connection from the external client, it shows Remote computer as the internal name of the RDS server, and the Gateway as the external fqdn mapped to our smoothwall's external IP

 

It seems like the Smoothwall is working, in the sense I get the login page and can see the apps, but at that stage it fails?

[kiwi_cam]

It sounds to me like your Gateway isn't working at all. Does it work Internally if the client un-ticks the "bypass RD gateway server for local addresses" option?

 

EDIT - I only raise this because I've spent/wasted too much time troubleshooting a gateway that "works internally" only to realise that it wasn't actually being used internally.

Edited May 15, 2019 by kiwi_cam
Clarification

[MS2011]

OK, before I run off into the bushes crying, I can't see for the life of me what is wrong on my very simple, basic RDS test box.

 

Internally - a single RDS server 2019 with the Gateway/Web Access/Licensing role on it, with a fixed IP address and domain wildcard certificates installed on it for all the services

Externally - a public IP dns registered with the server.domain - with that IP being our Smoothwall UTM's public facing IP

Smoothwall - configured to port forward incoming 443 to the internal IP of the RDS server

 

It works fine internally, but externally I can login and see the apps but always see an error 'Your computer can't connect to the remote computer because the Remote Desktop Gateway server is temporarily unavailable. Try reconnecting later or contact your network administrator for assistance. '

 

When I look at the connection from the external client, it shows Remote computer as the internal name of the RDS server, and the Gateway as the external fqdn mapped to our smoothwall's external IP

 

It seems like the Smoothwall is working, in the sense I get the login page and can see the apps, but at that stage it fails?

 

Remote app to work, you need to open port 443 on the server

[MS2011]

Had the same issue here before, off the top of my head the fix was adding users/groups you wish to allow access to local remote access desktop users groups on the RDS server .

[MartinByard]

We had a similar issue on our new 2016 RDS farm (although only intermittently, it didn't effect everyone who tried to use it) and we think we finally managed to track it down to be something to do with the way the server was passing the RDP requests over http. Not sure if this is likely to be similar to what you're experiencing, given you're on 2019 .. but worth a mention.

 

We seem to have fixed it by adding the below reg key to the effected machines (or at least the complaints seem to have stopped coming in).

 

[HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client]
"RDGClientTransport"=dword:00000001

[Sheridan]

It works fine internally and clients don't get the option to bypass the gateway, and externally we get as far as the Apps page. Its now being port forwarded through our old reliable TMG gateway on port 443 only. I've double checked and the whole Domain Users group is a member of the local Remote Desktop User Group on the RDS server.

 

I'll try the reg hack, but it also fails on W7 and Macos so I'm guessing the problem is either the RDS or the routing. However the routing is now very straightforward as the external IP is bound to the TMG, which port forwards all HTTPS on that to the RDS internal IP.

 

Its frustrating as I want to move to this for a year or two instead of keeping our old Citrix system alive.

 

Edit: I notice when I remove the Gateway role and test again, I immediately get a message saying the remote computer could not be found when opening an app, whereas when using the Gateway it takes a few seconds for the original error to appear, suggesting a timeout or routing problem perhaps.

Edited May 15, 2019 by Sheridan

[Sheridan]

Well, even when I removed the Gateway role on the RDS server I get the same error. I'm guessing RDS doesn't work in 2019 as it seems to have been a buggy release since day one.

[k-strider]

in the Gateway manager can you see connections under the monitoring tab.... and i know its possibly a stupid question but under connection Authiraztion policies and Resource Authorization policies you have the users and the servers listed...

[Sheridan]

I don't see any connections in the monitoring tab but I guess that's expected as they only appear when an App is running? And I don't get to that point. I've checked the policies and its the default 'all users, all computers' still, I haven't configured it in any detail yet.

[k-strider]

It sounds to me like your Gateway isn't working at all. Does it work Internally if the client un-ticks the "bypass RD gateway server for local addresses" option?

 

EDIT - I only raise this because I've spent/wasted too much time troubleshooting a gateway that "works internally" only to realise that it wasn't actually being used internally.

Have you tried this?.... put a computer name you can RD into and set the gateway explicitly

 

you should then see a connection under the monitoring...

[Sheridan]

Have you tried this?.... put a computer name you can RD into and set the gateway explicitly [ATTACH=CONFIG]53387[/ATTACH]

 

you should then see a connection under the monitoring...

 

I'm only running RemoteApps so I don't get the RD interface normally. I've tried a manually setup RDP session and I get the same error now as well, and nothing appears in the connection monitoring

 

Having now tested server 2016 RDS and got exactly the same error I'm starting to think it might be an external factor!

Edited May 15, 2019 by Sheridan

[Sheridan]

Bizarrely I now seem to have a working system - all I did in the end was rebuild the 2019 server (even though it was a fresh install!) and install the RDS using the simple method which is exactly what I did the first time, and port forwarded though our TMG it works fine!

 

It does not like reverse proxy on either Smoothwall or TMG though.

[k-strider]

Strange.... i dont like it when things arent logical!

[Sheridan]

Strange.... i dont like it when things arent logical!

Me too! I'd rather have found I was doing something wrong, or had missed a stage out as this doesn't make a lot of sense. Still, server 2019 is based on Windows 10 so anythings possible....