RDP on second NIC

riversr54

First of all, I readily admit that Firewall and NAT are not my strong point. With that said…

I have pfSense installed and working great with one exception. It has three NICs, one on the public side (connected to a cable modem) and two others, each connected to separate networks. The internal NIC addresses are: 10.1.0.100 (LANCR109) and 10.2.0.200(LANCR202).

I have created NAT rules to allow external RDP connections on the LANCR202 network and it works great. I have NOT been able to make the same rules work on the LANCR109 side. I copied one of the working rules and modified only the target IP address, but still nothing.

I read somewhere that pfSense has a default or primary network and that I must create rules for any "other" networks, but I'm not sure I understand how or what exactly to do. I noticed that there is a Firewall rule called Anti-Lockout rule that I didn't create, so I'm assuming that maybe that has something to do with my problem.

What do I need to do to allow RDP (or other protocols) traffic on that second network (LANCR109)?

Please let me know if I need to provide additional information.

riversr54

johnpoz

Well you can not forward the same port to 2 different addresses

I assume you only have 1 public IP.

So you could forward say publicIP:3389 to 10.1.0.101:3389

and then
publicIP:3390 to 10.2.0.202:3389

But you you can forward publicIP:3389 to both 10.1 and 10.2 addresses.

riversr54

I'm sorry, I didn't make that clear in my original post.

I have a classroom with 20 computers, each with it's own static IP address. My students need to connect to their assigned system using a provided port number. If my public IP address was 100.100.100.100, the students would create a RDP connection with an address like this:

100.100.100.100:8001 Computer 01
100.100.100.100:8002 Computer 02
etc…

I have created NAT rules for each port number that we use on the LANCR202 network and it works fine. It's my second network that I have a problem with.

Hopefully that makes more sense.

doktornotor

Time to post the screenshots of working and not working configuration.

kejianshi

When you created the pfsense originally, as default it started with a LAN and a set of default allow rules on the LAN subnet. Do you have an equivilant set of allow rules on the second LAN? Also, is this actually RDP or some other RDPish thing?

johnpoz

"I have a classroom with 20 computers"

So is this some internal network, or is that an actual public IP address they connect too from the internet? From say their houses?

Wouldn't it just be easier to have the kids vpn in, and then access the IP of their computer directly via just normal rdp port, etc. That would clearly be a more secure option then opening up rdp to the public internet.

If kids are somewhere else on the network when they need to access - why are you natting?

But to your exact issue, even if seems to be the wrong way to tackle the problem in the first place. As mentioned by kejianshi - what are the lan rules on your other segment? By default when you install pfsense your lan has unfiltered outbound access.. But when you create a secondary segment on say opt1 or opt2, etc. There are no lan rules setup for that interface - so no outbound traffic would be allowed. Which could explain why your port forwards are not working.

doktornotor

@johnpoz:

Wouldn't it just be easier to have the kids vpn in, and then access the IP of their computer directly via just normal rdp port, etc.

Yeah, a whole LOT easier to maintain and use.

kejianshi

Are you suggesting that opening a bunch of WAN ports to forward RDP directly to a bunch of computers is somehow less wise and convenient than using secure VPN on a single port?

johnpoz

Yeah goes against your "I hate simple" mantra but yeah ;)

kejianshi

In this case I'll make an exception… Wonder if he knows how well pfsense does openvpn?

riversr54

Ok…sorry for the delay in getting back...school starting has kept me very busy...

I have considered VPN and even tried to implement it but had zero luck with that. I'm not sure why, it was several weeks ago now. I know that opening multiports for RDP is not the best solution, but it seemed like one that I could make work, at least for now. I would love to get VPN up and going but I'm not sure my Firewall/VPN skills are up to it.

If someone could point me to a beginners guide to VPN, espeically if it was specifically related to setting it up on pfSense, I would really appreciate it. I am under the gun timewise for getting this working...so that students can have remote access.

Regards,

riversr54