RDP over HTTP / HTTPS

[GrumbleDook]

Once again I bang my head against a brick wall fro not thinking straight.

 

Scenario: Terminal Services run on Windows Server 2003 R2. IIS installed and Remote Desktop enable.

 

TS configured (of a fashion) and the web front-end happy within school using both the local domain address (foo.school) as well as the FQDN (server.domain.com).

 

The next stage ... external access. We have still not got the certificate stuff sorted right now but I need to show some stuff of and will be doing it over http (please don't shout and scream DPA at me ... I know ... it will be opened for the demo and closed again!).

 

Sort out the external DNS and NAT via the firewall (Firebox X series). I can see server.domain.com fine ... and even get to server.domain.com/tsweb. As soon as I enter the FQDN in the text field and hit enter ... it times out on connection.

 

I know I have missed something ... I have gone over this in my head all weekend. DNS is fine internally and externally ... port forwarding rules for http are fine (as shown by actually getting to the page), but the next bit kills me.

 

Any help appreciated.

[PiqueABoo]

No immediate help , but in a similar scenario I set up an SSL tunnel to a target server with "stunnel" and then ran RDP through that.

 

I didn't realise MS supported this over HTTP. AIUI you get the RDP activex control from a web page, but that control makes a normal RDP connection to the target server port 3389.

 

Is proper RDP over HTTP a new feature for R2? Regardless I'd run up some network monitor (e.g. windump|ethereal) and verify whether the client is trying to contact to the server port 3389.

[GrumbleDook]

Oh dear ... I am truly embarrased on a number of scores now.

 

Firstly, it helps if you remember that you still need to tunnel it through rather than use RDP over the 'Net. That's what I get for skim reading new documentation and presuming that things have improved.

 

Secondly, it helps if you have configured your firewall to have RDP connections pointing at the correct server (I still had the setting from when I had a box sat in the now-defunct DMZ).

 

And then I forget that we still have not allowed the relevant security groups to log in.

 

I need pizza and sleep.

 

Thanks PiqueABoo ... A virtual beer (or bar of chocolate) is on it's way to you.