discoveranother Posted March 15, 2020 Posted March 15, 2020 (edited) Hello all, Have a virtual machine (Windows 2012 VM) on a Windows 2012 hyperv host. Have VPN software installed on Windows 10 and shows a connection. The remote VM has RDP enabled and the firewall equipment allows for port 3389. However, even though the VPN software shows connected to the remote site, when I then try to RDP to the server from outside the premises, it just doesn't connect. I can RDP from within the premises, but not outside. It only occurs on servers with a hyperv host. Flat physical build servers with no hyperv host work fine. I can't ping the VM when the VPN is connected remotely, but can ping VMs if they are on flat build physical servers. Any thoughts much appreciated Edited March 15, 2020 by discoveranother
markrobertsbarter Posted March 16, 2020 Posted March 16, 2020 You say that the "firewall equipment" allows for port 3389, what about the software firewalls on the VMs. I would start there. 1
markrobertsbarter Posted March 16, 2020 Posted March 16, 2020 Oh, and, going back a step: I assume that you have sorted out the routing of your VPN's IP address to the local LAN? 1
discoveranother Posted March 16, 2020 Author Posted March 16, 2020 (edited) You say that the "firewall equipment" allows for port 3389, what about the software firewalls on the VMs. I would start there. Thank you. Yes the remote windows firewall allows for port 3389. The VPN connects fine to the local lan. Just the RDP and pinging doesn't. So the VPN is actually saying it can connect. Oddly, another thing. if I map a share WITHIN the premises to the local network and then go offsite. I can access the share remotely once the VPN is connected, but still cannot RDP. However, if I try to map the share when I am offsite, with the VPN connected (rather than create the share whilst onsite), the share will not map. It has to be created \ mapped first whilst onsite. Edited March 16, 2020 by discoveranother
discoveranother Posted March 16, 2020 Author Posted March 16, 2020 (edited) All servers at clients are schools and are on a local authority WAN. However, it's not an issue with flat build servers, its just the hyperv ones. The local authority no longer support these. The VPN is allowed through the firewall hardware not the server. Setup the same for all schools. Hence, RDPs to flat builds work, to the hyperv's do not, yet the VPN on the firewall is configured just the same i.e, to allow VPN access. The VPN client software connects it's just the RDP session where the issue occurs. RDP port is allowed on all firewalls. I've just got a hunch its a network issue for some reason. All switches onsite are Netgears with the latest firmware. Edited March 16, 2020 by discoveranother
mavhc Posted March 17, 2020 Posted March 17, 2020 If ping doesn't work then forget RDP, just work on getting ping working. Are you using NAT, Bridge, or Routing for your VPN? What are example IP ranges? A diagram might be useful 1
FishCustard Posted March 17, 2020 Posted March 17, 2020 If ping doesn't work then forget RDP, just work on getting ping working. While remembering that some firewalls drop ICMP packets, and often servers are configured not to respond. No ping != no connectivity necessarily. 1
mavhc Posted March 17, 2020 Posted March 17, 2020 True, but I assume ping is working internally, and the ping is inside the vpn so the firewall won't know about it 1
Davit2005 Posted March 17, 2020 Posted March 17, 2020 Are you trying the server by IP address or server name? When you ping by name is the IP address been resolved the IP address of the VM you are trying to RDP to? 1
discoveranother Posted March 17, 2020 Author Posted March 17, 2020 Thanks for all the replies guys. Oddly got one of these hyperv vpn conenctions working, but not sure how !!! I checked with the firewall company and added in some extra vpn configurations inbound and outbound, and it worked. But on another server it hasn't, so my thinking is its not that. However, I noticed in the firewall settings of the server that now works as per screenshot, there is an app allowed for hyperv, however, this is not an app its a folder. This wasn't showing yesterday but today it is. To be honest, i'm not even sure how I got that in there as when you browse to the app through the firewall, it browses to a hyperv folder not a hyperv app, so it's not like I can select an app called hyperv, but I think this is helping the connection. On the server where it now doesn't RDP in via VPN, this hyperv app or should I say folder isn't showing.
mavhc Posted March 17, 2020 Posted March 17, 2020 Have you rebooted the server? Look in the Firewall Advanced view, inbound rules, anything in a HyperV group there? I have 7 items, and you can click Properties to see what they actually are. 1
discoveranother Posted March 17, 2020 Author Posted March 17, 2020 Have you rebooted the server? Look in the Firewall Advanced view, inbound rules, anything in a HyperV group there? I have 7 items, and you can click Properties to see what they actually are. Thanks for everyones replies so far. Thanks ill check on the servers where it isnt working the firewall. Take back earlier what I said about the one I got working. Its intermittent. Basically when I do a tracert it picks up a 192.168.0.1 address first off, other times intermittently, it connects and picks up the correct 10.110.x.x address and works. I have a funny feeling the ISP router at some of these premises maybe left on DHCP. An ISP guy replaced the router a while back at this particular premises. Won't know for definite until I am onsite. But the tracert shouldn't be picking up a 192.168.0.1 address to start with as the remote network is on 10.110.x.x
discoveranother Posted March 17, 2020 Author Posted March 17, 2020 (edited) Are you trying the server by IP address or server name? When you ping by name is the IP address been resolved the IP address of the VM you are trying to RDP to? Very good point. It pings to the VM by ip address but not the name. I believe there are extra configurations to do in order to connect by name, such as editing the LMhosts file on the client. Edited March 17, 2020 by discoveranother
Davit2005 Posted March 18, 2020 Posted March 18, 2020 (edited) Very good point. It pings to the VM by ip address but not the name. I believe there are extra configurations to do in order to connect by name, such as editing the LMhosts file on the client. You should not need to do that, an entry on the DNS servers for the A record and make sure the VPN clients when they connect get the correct DNS servers set and the search domain is correct. That could be why the mapped drives are not working unless being connected on site first. Edited March 18, 2020 by Davit2005
discoveranother Posted March 18, 2020 Author Posted March 18, 2020 You should not need to do that, an entry on the DNS servers for the A record and make sure the VPN clients when they connect get the correct DNS servers set and the search domain is correct. That could be why the mapped drives are not working unless being connected on site first. Thank you. The A records already exist. If I tracert to the server with the VPN on, it picks up the correct server and FQDN.
discoveranother Posted March 22, 2020 Author Posted March 22, 2020 Have you rebooted the server? Look in the Firewall Advanced view, inbound rules, anything in a HyperV group there? I have 7 items, and you can click Properties to see what they actually are. Thanks for this. I noticed that on this particular server there are only 3 rules, whereas on a working one there are 7 items as you also say above. I can't see how to add extra rules to a group called Hyperv. I can't even see where the rules are setup on either server. I assume they are done via Group Policy but can't even find them and have looked and looked through the various group policy settings.
mavhc Posted March 23, 2020 Posted March 23, 2020 In general those things are added when you install the role I think
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now