Redrects to internal ip ip based on a domain name
-
Alternatively you can use a VPN to facilitate access to the internal network and not expose RDP to the Internet; the latter will most probably result in countless (hopefully unsuccessful, if your passwords are sufficiently strong) break-in attempts…
-
" RDP is a must and sadly port alteration is not an option for these machines "
Who ever said anything about port alteration on the machines? From the client you state what port you want, clearly that is what marcelloc showed in his example
33891 -> 192.168.1.1:3389
33892 -> 192.168.1.2:3389The machines at .1 and .2 still listen on 3389, the default rdp port. Just the client coming from the public net uses a different port so that pfsense knows what private IP to forward to using the 3389 port.
-
" RDP is a must and sadly port alteration is not an option for these machines "
Who ever said anything about port alteration on the machines? From the client you state what port you want, clearly that is what marcelloc showed in his example
33891 -> 192.168.1.1:3389
33892 -> 192.168.1.2:3389The machines at .1 and .2 still listen on 3389, the default rdp port. Just the client coming from the public net uses a different port so that pfsense knows what private IP to forward to using the 3389 port.
the issue with this is externally this would be the url
1.example.com:33891 instead of 1.example.com
2.example.com:33892 instead of 2.example.comyes internal ports will be default but external it will not be
if you can come up with any way to get the ports to work in a forward in the dns i would love to know but if done as a forward rdp will not work and A records will not allow port limitations
let me explain one of reasons we need it clean is i have several people that will be using these machines who are less then beginners in computers who will need to be able to access there machines externally and due to where they will be accessing from they are not allowed to have any file <including a="" rewritten="" rdp="" file="" with="" the="" port="" info="">and if i have those numbers they will write the info down making the no file rule a joke but one the company will not allow me to get past on external data
while most of my uses post this issue will be for tech reasons where the nat port redirection will work at present i need to come up with something clean that i know they can do no matter what computer they access from which is why VPN and vlc were not a choice as these are not found on most computers by default.
and sorry for being a pain on this i am not trying to but have been given several limiting factors that are making this project a nightmare</including>
-
Sorry what your asking, just doesn't work that way.
Get more than 1 external IP that way you can have your different urls point to different different boxes inside.
But your example is wrong - there would be no reason for it to be
1.example.com:33891
2.example.com:33892it would be
example.com:33891
example.com:33892You are only pointing to one public IP, no reason for different fqdn to point to the same thing.
I don't care if your users are retarded monkeys on crack!! If they can not remember example.com:123 vs example.com:456 then get different monkeys. Or put example.com:123 on a piece of paper.
-
options are:
1. open a https port to windows server
2. use an ssl vpn like adito on an internal server
3. there are html5 vnc & rdc proxies about but they need to go on an internal serverbut pfsense at this time cannot do this apart from squid etc for http/s and nat or vpn to your rdp's or vnc's
-
ok sadly this is what i was expecting and what i told them when i was given this list of instructions on what can and can not be done on this project. at lest now i can send this into them to show the problem currently has no solution.
I thank you all for your time here and will present them with there choices on what they want and see what the company want to do.once again thank you
ps if anyone wants to make a package that will read any incoming Domain regardless of ports <even if="" it="" checks="" the="" url="" via="" another="" port="">i would be interested in beta testing it but i do understand it does NOT exist at this time.</even>
-
" show the problem currently has no solution."
Not actually true - there is a solution, use ports on the end of the url:123 etc.. Or another solution would be to get more public IPs so you could assign different fqdn and therefore different IPs that you need to get to behind your nat router.
Your issue is your trying to use 1 public ip with multiple boxes behind it all listening on the same port.
-
ps if anyone wants to make a package that will read any incoming Domain regardless of ports <even if="" it="" checks="" the="" url="" via="" another="" port="">i would be interested in beta testing it but i do understand it does NOT exist at this time.</even>
This isnt possible for anything besides HTTP because most services (like RDP) will just resolve the name and connect to the IP and forget about the name. HTTP does the same thing but what makes it different is INSIDE the request it sends the FQDN it was trying to connect to in the first place inside the headers. That is how a web server or reverse proxy can figure out what to send to where. In pure RDP, that header with the FQDN in it simply does not exist.
-
slightly off topic (as it's not pfsense) but rather a reverse proxy (like i mentioned above), take a look at guacamole.
it's a clientless html5 vnc & rdp proxy and runs a treat even behind squid.
http://guac-dev.org/ -
Sounds great but really fast look viewed, that there is only linux support, am i wrong?
-
Yeah you have to run it on a linux OS, but what you access with rdp or vnc could be any OS that supports those.. Windows would be RDP. Rut it on a VM if don't have any linux boxes around.
-
there is also thinvnc & thinrdp for windows which are free but an only be used on each client whereas the server (cost) can do the proxy.
-
I have Linux and Windows based machines at home, but i'm somewhat curious how to set this up.
Is it, that all connections to 5900 and 3389-3390 is portforwarded to linux machine and after that quacamole direct's it right point based on domain? -
guac is a proxy (much like squid)
you simply point your browser at guac and you are confronted with a logon page. depending on how you have configured the mappings, depends on what you are confronted with.
to point your browser at gauc from external, you will need to create a A record or use your public ip and open up either 80 or 443 and point it to the guac server.
alternatively, you can use squid and map to guac.
