Can't establish remote desktop connections to offsite servers

[Muppet1902]

Hi

We've just had a new server installed and domain built from scratch.

Since we've had everything up and running again we can't conect to any external (outgoing) remote desktops connections. We keep getting the folowing error:

 

The computer name and domain for the remote computer is correct.

 

We're with exa-networks for firewall and filtering and they're adamant it's not them. All internal remote connections are working well and we can remote in to the site via offsite/mobile internet. We can also make external (outgoing) remote conections using a domain device to and mobile internet.

We've also tried using domain admin account to establish a remote access connection to offisite server with not luck.

Any thoughts on which step in the process we've missed will be greatfully recieved.

Thanks in advance.

Edited November 18, 2021 by Muppet1902

[Michael]

This does come across as firewall related to me. You're VPNing into Site A, but cannot access servers on Site B remotely?

 

I'm presuming also there's a Site to Site VPN in place?

 

If I've understood correctly or not, can you ping anything at all?

[mavhc]

Step 1: ping -t 1.2.3.4 the ip of the server

Step 2: ping -t servername

 

If those fail, tracert

[Muppet1902]

This does come across as firewall related to me. You're VPNing into Site A, but cannot access servers on Site B remotely?

 

I'm presuming also there's a Site to Site VPN in place?

 

If I've understood correctly or not, can you ping anything at all?

 

 

[site 1 (Domain 1)] trying to remote to [site 2 (Domain 2) via RDP/RDS or PSFinancials (which use RDP/RDS)]

 

no VPN in use

 

Can ping the IP of [site 2 (Domain 2)] successfully but can't ping PSFinancials...I don't think they allow it.

Can't ping the name of [site 2 (Domain 2)]

Edited November 18, 2021 by Muppet1902

[Muppet1902]

Step 1: ping -t 1.2.3.4 the ip of the server

Step 2: ping -t servername

 

If those fail, tracert

 

Step 1: Sucess

Step 2: Fail

[Michael]

Usually if there are two domains, you'd need a Forward/Reverse lookup zone or a Stub zone would suffice in DNS.

[Muppet1902]

Usually if there are two domains, you'd need a Forward/Reverse lookup zone or a Stub zone would suffice in DNS.

It looks like we already have forward and reverse zones set up

 

Basically we're trying to establish an RDP connection to any computer/server not conected to the schools network when the device we're using connect is??

Edited November 18, 2021 by Muppet1902

[smarties11]

Step 1: Sucess

Step 2: Fail

 

This indicates to me that DNS isn't set up correctly. Do you have conditional forwarders set up for the remote sites, pointing at their DNS servers?

 

What happens if you ping / RDP using the FQDN i.e. servername.domain.com?

[Michael]

So typically two schools and two domains would/could be linked using a Site to Site VPN, unless it's literally across a playground with an on site fibre link.

 

To RDP offsite into school, usually a VPN is needed, then RDP. RDP-ing over the internet without VPN is how a lot of schools are being targeted, but I'm sure you know this!

[mavhc]

If pinging an ip works but name fails then next set is dns

 

How is your dns setup, what servers is your computer pointing to, how are they setup?

 

use nslookup to debug

 

nslookup servername

 

nslookup servername 1.2.3.4 (ip of non default dns server)

[Muppet1902]

So typically two schools and two domains would/could be linked using a Site to Site VPN, unless it's literally across a playground with an on site fibre link.

 

To RDP offsite into school, usually a VPN is needed, then RDP. RDP-ing over the internet without VPN is how a lot of schools are being targeted, but I'm sure you know this!

 

The issue isn't remoting to another site/school that is test a case/example. The main issuse is that we can't remote onto PSFinancials from the schools network. This is a commonly used piece of 3rd party software which is used by many schools across the country. Unfortunatly I can't contol how they require us to access their web-based provision (basically an RDP connection as far as i'm aware).

 

 

thanks for your thoughts

[mavhc]

Does the remote server have a public dns name? Can you resolve that name to an ip at home but not at work?

[smarties11]

The issue isn't remoting to another site/school that is test a case/example. The main issuse is that we can't remote onto PSFinancials from the schools network. This is a commonly used piece of 3rd party software which is used by many schools across the country. Unfortunatly I can't contol how they require us to access their web-based provision (basically an RDP connection as far as i'm aware).

 

 

thanks for your thoughts

 

Your original post said 'offsite servers' which has made people assume you are part of a multi site setup.

 

It sounds like you just need to add a DNS A record on your on-site DNS server. The 'host' field needs to be the name of the server and the 'IP address' needs to be the IP address you have been given by PSF.

Edited November 19, 2021 by smarties11

[MatthewL]

Port TCP 3389 could well be blocked outgoing, I know we only allow it to certain external IP's not in our network. Try connecting via it's IP first and go from there.

[exa_nicky]

Hi

We've just had a new server installed and domain built from scratch.

Since we've had everything up and running again we can't conect to any external (outgoing) remote desktops connections. We keep getting the folowing error:

[ATTACH=CONFIG]63701[/ATTACH]

 

The computer name and domain for the remote computer is correct.

 

We're with exa-networks for firewall and filtering and they're adamant it's not them. All internal remote connections are working well and we can remote in to the site via offsite/mobile internet. We can also make external (outgoing) remote conections using a domain device to and mobile internet.

We've also tried using domain admin account to establish a remote access connection to offisite server with not luck.

Any thoughts on which step in the process we've missed will be greatfully recieved.

Thanks in advance.

Good Morning Muppet 1902, I am the Relationship Manager at Exa Networks and I have spoken with our Support Team who are happy to talk through your issue and try and get a fix in place for you on 0345 1451234

 

Thanks

Nicky

[bald_pig]

Are you using the RDP file provided by PSFinancials? It's not a direct connection, they use a gateway server.

 

I'd also echo that you don't want to be putting your own RDP servers directly on the internet, and would invest in a VPN or RD Gateway for accessing your remote sites.

[Muppet1902]

Are you using the RDP file provided by PSFinancials? It's not a direct connection, they use a gateway server.

 

I'd also echo that you don't want to be putting your own RDP servers directly on the internet, and would invest in a VPN or RD Gateway for accessing your remote sites.

 

Thanks for your thoughts.

 

We do a VPN across our sites which which we do use through our smoothwall. Although I am curently investigating transitioning to another solution.

As I mentioned I was just trying to illistrate the concept of my understanding surrounding how PSFinancials link worked (possibly didn't explain it well)

 

Yes we're using the PSFinancials provided file and just doubled check that the gateway server information is there.