RDP Issues
-
try tracing from one end to the other and vice versa. do both directions take the same route?
-
They are going through the same networks, the addresses vary slightly, but i think that is normal.
-
I have been able to spend a little more time troubleshooting and have found that when going –---> pfsense -----> pix that my pix reports an mss exceeded error. Apparently this is caused because the Maximum Segment Size is changing or not matching what it is supposed to be, so the pix drops the packets. I am still leaning towards this being an issue with pfsense since I can get to this sever when bypassing pfsense. I appreciate the help hoba and sullrich :)
-
What's the exact log message you're seeing from the PIX?
I've never had this issue with a number of PIX's, but I also don't need MSS clamping since my WAN is 1500 MTU.
-
Yeah sure, no prob. Here it is.
Dropping TCP packet from outside:xx.xx.xx.xx/3389 to inside:xx.xx.xx.xx/60983, reason: MSS exceeded, MSS 1260, data 1460
MTU on every interface on the pix is also set to 1500
-
You can solve your problem by issuing the commands listed in this link:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804c8b9f.shtml
However, the above link is not a true fix. Can you give a better diagram or description of how you have your network configured? Also perhaps a 'sh run', minus sensitive stuff, from your pix and a list of nat's and firewall rules from pfsense as well.
-
I actually tried that cisco workaround already and it didn't help at all. :(
My network looks like this
Private LAN (10.x.x.x) –----> PFSENSE (2x Intel PRO 1000) ------> "DMZ" (172.x.x.x) ---------> PIX --------> Internet
I am doing Dual NATing. Ex: Internet TCP 21 ------> PIX forwards to -------> PFSENSE forwards to ------> Internal FTP Server
NATing 21, 25, 80, 143, 443, 1723, GRE
I have various VIPs as well, so that hosts in the DMZ can send traffic to a host that no longer sits in the dmz, so pfsense forwards to the new 10.x.x.x address. I have not configured carp yet as I still have some issues I want to iron out. If you need any more info, let me know. I appreciate your help a ton though. Thanks. :)
Show run from my pix would be a very large pain, as it is about 12mb of text and would take ages to filter out sensitive info, but if it is absolutely needed, I can do it. So essentially, when I am in the DMZ and try to RDP, vpn or anything else so some host, I can get to the host as expected, but when i put myself behind pfsense is when it starts to cause problems. Again this is only an issue with a handful of sites, but anytime VPN is used, all kinds of weird things happen, like cant copy files over vpn, cant rdp over vpn, and sometimes it works fine. I am baffled.
-
So you are having issues connecting from your LAN segment to hosts on your DMZ segment when going through the pfSense?
-
LAN to Internet hosts, sorry if my explanation was kinda hard to understand.
-
K, are you able to connect to Host on the DMZ segment from your LAN Segment?
-
yes
-
Well, I'm not positive what is going on, but I know the MSS feature in PIX's is new to the 7.0 version.
pfSense, as of right now, does not do any MSS filtering like the pix. The MSS values should remain unchanged as they pass through the pfSense. Negotiation of the MSS value should also work properly through the pfSense.
I have to say that, since you are able to connect to the DMZ segment from the LAN segment, the pfSense is working as it should.
That MSS fix should work. If you are running 7.2, and you've tried it the previous fix, try using the ADSM to look for the checkbox about the MSS default deny. I can't remember where it was under the ADSM, but there is a checkbox that says something like 'allow MSS exceeded values.'
The only thing that I can surmise is that maybe a router might be throwing off the MSS.
-
Maybe this thread isn't active any more. But I could report that I have the same problem.
RDP Client -(PPTP)-> fpSense 1.2 -(PPTP)-> Corp. Firewall –> Terminal Services / Remote Admin
I also just get a black screen connecting to machines on the other side. But, If start one more RDP-Client and try to connect to the same host, at the same time the first started show a black screen, I can connect. Strange, but it works.
Haven't sniffed any traffice on this one. But may the above info can help out resolve this problem.
-
Maybe this thread isn't active any more. But I could report that I have the same problem.
RDP Client -(PPTP)-> fpSense 1.2 -(PPTP)-> Corp. Firewall –> Terminal Services / Remote Admin
I also just get a black screen connecting to machines on the other side. But, If start one more RDP-Client and try to connect to the same host, at the same time the first started show a black screen, I can connect. Strange, but it works.
Haven't sniffed any traffice on this one. But may the above info can help out resolve this problem.
i have the same issue like you discribed. I think its because of my VMWARE Setu, i have installed pfSense inside a VM and this coused the problem. But if you have a real machine for pfsense, i think its an pfsense fault.
is there anything to get a fix? Does someone know where or what rdp get blcked?!
i'll try to help as much as i can - someone hast to say me what i can do :)
thx,
sash
sash(at)gmx.it
-
I had this problem before. It was caused by the MTU on one end being to big to "fit" at the other end
Network looks like this
Pfsense(ethernet - mtu 1500) -> internet -> (ADSL mtu - 1462)PfsenseWhat I had to do was reduce the mtu on the ethernet side ie
Pfsense(ethernet - mtu 1412) -> internet -> (ADSL mtu - 1462)PfsenseMy problem was exaggerated by running the rdp through an IPSEC tunnel that adds extra overheads so you may not need to reduce your mtu so far
-
If you are on Vista (machine initiating the connection), then this is a terminal client issue, there's a regfix for this (turn off or disable TCP auto tuning). Connecting to XP, Vista, or Windows 2003 exhibits this problem…
-
i have a win2003 TS behind a pfsense Box. The connection comes from the internet from another winxp client which can't connect to my 2003 server.
-
i'm having still that problem that i can't connect via rdp to may 2003 Server. Are there any news or suggestions what i can do? I want to fix that problem. with m0n0 i don't have the prob.
-
I had no idea how to fix it but googling tcp auto scaling windows 2003 came up with:
http://thesystemadministrator.com/The_System_Administrator/Tips_&Tricks/Disable_TCP_Auto-Tuning_to_Solve_Slow_Network(Vista)/
-
I had no idea how to fix it but googling tcp auto scaling windows 2003 came up with:
http://thesystemadministrator.com/The_System_Administrator/Tips_&Tricks/Disable_TCP_Auto-Tuning_to_Solve_Slow_Network(Vista)/
thanks for your reply, but i don't think that this is the issue. It doesn'tmatter which OS the Client has. It can be an Win2003 Server, an XP Machine oder a Vista Box. Everywhere its the same Problem. I can receive some secondes every package from my Server - an then no –> the Server doenst response. if i took my m0n0 back, with the same conf --> everything work fine.
Firewall lets every package pass - nat is configured well. what can i do to help you ?
greets,
sash
sashxp@gmail.com
