Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    RDP Issues

    Scheduled Pinned Locked Moved NAT
    25 Posts 9 Posters 13.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      yoda715
      last edited by

      You can solve your problem by issuing the commands listed in this link:

      http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804c8b9f.shtml

      However, the above link is not a true fix. Can you give a better diagram or description of how you have your network configured? Also perhaps a 'sh run', minus sensitive stuff, from your pix and a list of nat's and firewall rules from pfsense as well.

      1 Reply Last reply Reply Quote 0
      • D
        DWAyotte
        last edited by

        I actually tried that cisco workaround already and it didn't help at all. :(

        My network looks like this

        Private LAN (10.x.x.x) –----> PFSENSE (2x Intel PRO 1000)  ------> "DMZ" (172.x.x.x) ---------> PIX --------> Internet

        I am doing Dual NATing.  Ex: Internet TCP 21 ------> PIX forwards to -------> PFSENSE forwards to ------> Internal FTP Server

        NATing 21, 25, 80, 143, 443, 1723, GRE

        I have various VIPs as well, so that hosts in the DMZ can send traffic to a host that no longer sits in the dmz, so pfsense forwards to the new 10.x.x.x address.  I have not configured carp yet as I still have some issues I want to iron out.  If you need any more info, let me know.  I appreciate your help a ton though.  Thanks. :)

        Show run from my pix would be a very large pain, as it is about 12mb of text and would take ages to filter out sensitive info, but if it is absolutely needed, I can do it.  So essentially, when I am in the DMZ and try to RDP, vpn or anything else so some host, I can get to the host as expected, but when i put myself behind pfsense is when it starts to cause problems.  Again this is only an issue with a handful of sites, but anytime VPN is used, all kinds of weird things happen, like cant copy files over vpn, cant rdp over vpn, and sometimes it works fine.  I am baffled.

        1 Reply Last reply Reply Quote 0
        • Y
          yoda715
          last edited by

          So you are having issues connecting from your LAN segment to hosts on your DMZ segment when going through the pfSense?

          1 Reply Last reply Reply Quote 0
          • D
            DWAyotte
            last edited by

            LAN to Internet hosts, sorry if my explanation was kinda hard to understand.

            1 Reply Last reply Reply Quote 0
            • Y
              yoda715
              last edited by

              K, are you able to connect to Host on the DMZ segment from your LAN Segment?

              1 Reply Last reply Reply Quote 0
              • D
                DWAyotte
                last edited by

                yes

                1 Reply Last reply Reply Quote 0
                • Y
                  yoda715
                  last edited by

                  Well, I'm not positive what is going on, but I know the MSS feature in PIX's is new to the 7.0 version.

                  pfSense, as of right now, does not do any MSS filtering like the pix. The MSS values should remain unchanged as they pass through the pfSense. Negotiation of the MSS value should also work properly through the pfSense.

                  I have to say that, since you are able to connect to the DMZ segment from the LAN segment, the pfSense is working as it should.

                  That MSS fix should work. If you are running 7.2, and you've tried it the previous fix, try using the ADSM to look for the checkbox about the MSS default deny. I can't remember where it was under the ADSM, but there is a checkbox that says something like 'allow MSS exceeded values.'

                  The only thing that I can surmise is that maybe a router might be throwing off the MSS.

                  1 Reply Last reply Reply Quote 0
                  • iorxI
                    iorx
                    last edited by

                    Maybe this thread isn't active any more. But I could report that I have the same problem.

                    RDP Client -(PPTP)-> fpSense 1.2 -(PPTP)-> Corp. Firewall –> Terminal Services / Remote Admin

                    I also just get a black screen connecting to machines on the other side. But, If start one more RDP-Client and try to connect to the same host, at the same time the first started show a black screen, I can connect. Strange, but it works.

                    Haven't sniffed any traffice on this one. But may the above info can help out resolve this problem.

                    1 Reply Last reply Reply Quote 0
                    • S
                      sash
                      last edited by

                      @iorx:

                      Maybe this thread isn't active any more. But I could report that I have the same problem.

                      RDP Client -(PPTP)-> fpSense 1.2 -(PPTP)-> Corp. Firewall –> Terminal Services / Remote Admin

                      I also just get a black screen connecting to machines on the other side. But, If start one more RDP-Client and try to connect to the same host, at the same time the first started show a black screen, I can connect. Strange, but it works.

                      Haven't sniffed any traffice on this one. But may the above info can help out resolve this problem.

                      i have the same issue like you discribed. I think its because of my VMWARE Setu, i have installed pfSense inside a VM and this coused the problem. But if you have a real machine for pfsense, i think its an pfsense fault.

                      is there anything to get a fix? Does someone know where or what rdp get blcked?!

                      i'll try to help as much as i can - someone hast to say me what i can do :)

                      thx,

                      sash

                      sash(at)gmx.it

                      1 Reply Last reply Reply Quote 0
                      • M
                        morbus
                        last edited by

                        I had this problem before. It was caused by the MTU on one end being to big to "fit" at the other end
                        Network looks like this
                        Pfsense(ethernet - mtu 1500) -> internet -> (ADSL mtu - 1462)Pfsense

                        What I had to do was reduce the mtu on the ethernet side ie
                        Pfsense(ethernet - mtu 1412) -> internet -> (ADSL mtu - 1462)Pfsense

                        My problem was exaggerated by running the rdp through an IPSEC tunnel that adds extra overheads so you may not need to reduce your mtu so far

                        1 Reply Last reply Reply Quote 0
                        • P
                          pinoyboy
                          last edited by

                          If you are on Vista (machine initiating the connection), then this is a terminal client issue, there's a regfix for this (turn off or disable TCP auto tuning).  Connecting to XP, Vista, or Windows 2003 exhibits this problem…

                          1 Reply Last reply Reply Quote 0
                          • S
                            sash
                            last edited by

                            i have a win2003 TS behind a pfsense Box. The connection comes from the internet from another winxp client which can't connect to my 2003 server.

                            1 Reply Last reply Reply Quote 0
                            • S
                              sash
                              last edited by

                              i'm having still that problem that i can't connect via rdp to may 2003 Server. Are there any news or suggestions what i can do? I want to fix that problem. with m0n0 i don't have the prob.

                              1 Reply Last reply Reply Quote 0
                              • S
                                sullrich
                                last edited by

                                I had no idea how to fix it but googling tcp auto scaling windows 2003 came up with:

                                http://thesystemadministrator.com/The_System_Administrator/Tips_&Tricks/Disable_TCP_Auto-Tuning_to_Solve_Slow_Network(Vista)/

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sash
                                  last edited by

                                  @sullrich:

                                  I had no idea how to fix it but googling tcp auto scaling windows 2003 came up with:

                                  http://thesystemadministrator.com/The_System_Administrator/Tips_&Tricks/Disable_TCP_Auto-Tuning_to_Solve_Slow_Network(Vista)/

                                  thanks for your reply, but i don't think that this is the issue. It doesn'tmatter which OS the Client has. It can be an Win2003 Server, an XP Machine oder a Vista Box. Everywhere its the same Problem. I can receive some secondes every package from my Server - an then no –> the Server doenst response. if i took my m0n0 back, with the same conf --> everything work fine.

                                  Firewall lets every package pass - nat is configured well. what can i do to help you ?

                                  greets,

                                  sash
                                  sashxp@gmail.com

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.