Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to block RDP access in 1:1 NAT setup

    Scheduled Pinned Locked Moved NAT
    25 Posts 4 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • HenryH
      Henry @SteveITS
      last edited by

      @teamits Thank you for the update. No I can't restrict it by source IP because of many different customers connect to that. Even if I change the default RDP port, it won't block the connection.

      1 Reply Last reply Reply Quote 0
      • HenryH
        Henry
        last edited by

        @johnpoz Dude I found a way to block the connection to WAN and allow it on Port forwarding.

        "Filter rule association" should set to pass for port forwarding, so all NAT traffic will pass without any rule and WAN is blocked by default.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Why are you doing 1:1 nat if you want to do port forwarding? Just not understanding what your freaking trying to accomplish exactly to be honest. Not understanding the use case at all..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          HenryH 1 Reply Last reply Reply Quote 0
          • HenryH
            Henry @johnpoz
            last edited by

            @johnpoz 1:1 NAT is for my web-server and I needs to access it by RDP, so direct RDP should be blocked and port forwarding allowed

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              Why do you think you need 1:1 nat? Just do the port forwarding for the ports you need.. There is almost zero reason to do 1:1 nat unless your hosting someone else's server on an RFC1918.. 1:1 nat is for when you have so many ports you need to forward that is easier to just do 1:1. Or you have a whole block of public IPs and you want to do a range of 1:1 nat for a range of public to a range of rfc1918.

              If all you want is rdp, then just forward that... How many other ports do you need open on this box that you want to do 1:1?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • HenryH
                Henry
                last edited by

                I thought 1:1 NAT is easier to setup and also I can remember the setup later easily.

                Secondly, outgoing traffic to the Internet originates from the associated external IP, helps for my reporting.

                I only need HTTP & HTTPS on the box.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Well if you only need http and https, just forward those.. If your forward it on a VIP the return traffic will use that VIP to return the traffic.

                  If you want originating traffic from this box to use your vip - just do that with a outbound nat.

                  BTW opening up RDP, even if you change the port is a HORRIBLE idea.. Unless you can lock it to a specific source IP

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    SteveITS Galactic Empire @johnpoz
                    last edited by

                    johnpoz said in How to block RDP access in 1:1 NAT setup:

                    if you only need http and https, just forward those

                    Or at least block all the other ports on the 1:1 NAT, because otherwise you're opening up file sharing, RPC, whatever else is listening on Windows on a LAN. Probably easiest to add a rule to allow HTTP/HTTPS and block the rest.

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote 👍 helpful posts!

                    HenryH 1 Reply Last reply Reply Quote 0
                    • HenryH
                      Henry @SteveITS
                      last edited by

                      @teamits Yes however "1:1 NAT maps all the external ports on that IP to the internal IP but you must still have firewall rules to allow the traffic to reach the local server."

                      https://forum.netgate.com/topic/75917/1-1-nat-vs-port-forwarding-when-to-use-each/3

                      1 Reply Last reply Reply Quote 0
                      • S
                        serbus
                        last edited by

                        Hello!

                        Port 6665 for remote access to your network seems odd, not because IRC is odd, but because that port has been so badly abused.

                        https://www.speedguide.net/port.php?port=6665

                        You might want to pick a "safer" port, unless that is not your intent...

                        John

                        Lex parsimoniae

                        HenryH 1 Reply Last reply Reply Quote 1
                        • HenryH
                          Henry @serbus
                          last edited by

                          @serbus Thank you, very good point!

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            Security though obscurity is not security... Opening up rdp to the public internet no matter what port is a BAD idea!!! If you want to rdp to this box, then vpn in and then do it.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.