Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to block RDP access in 1:1 NAT setup

    Scheduled Pinned Locked Moved NAT
    25 Posts 4 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      Why are you doing 1:1 nat if you want to do port forwarding? Just not understanding what your freaking trying to accomplish exactly to be honest. Not understanding the use case at all..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      HenryH 1 Reply Last reply Reply Quote 0
      • HenryH
        Henry @johnpoz
        last edited by

        @johnpoz 1:1 NAT is for my web-server and I needs to access it by RDP, so direct RDP should be blocked and port forwarding allowed

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          Why do you think you need 1:1 nat? Just do the port forwarding for the ports you need.. There is almost zero reason to do 1:1 nat unless your hosting someone else's server on an RFC1918.. 1:1 nat is for when you have so many ports you need to forward that is easier to just do 1:1. Or you have a whole block of public IPs and you want to do a range of 1:1 nat for a range of public to a range of rfc1918.

          If all you want is rdp, then just forward that... How many other ports do you need open on this box that you want to do 1:1?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • HenryH
            Henry
            last edited by

            I thought 1:1 NAT is easier to setup and also I can remember the setup later easily.

            Secondly, outgoing traffic to the Internet originates from the associated external IP, helps for my reporting.

            I only need HTTP & HTTPS on the box.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              Well if you only need http and https, just forward those.. If your forward it on a VIP the return traffic will use that VIP to return the traffic.

              If you want originating traffic from this box to use your vip - just do that with a outbound nat.

              BTW opening up RDP, even if you change the port is a HORRIBLE idea.. Unless you can lock it to a specific source IP

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              S 1 Reply Last reply Reply Quote 0
              • S
                SteveITS Galactic Empire @johnpoz
                last edited by

                johnpoz said in How to block RDP access in 1:1 NAT setup:

                if you only need http and https, just forward those

                Or at least block all the other ports on the 1:1 NAT, because otherwise you're opening up file sharing, RPC, whatever else is listening on Windows on a LAN. Probably easiest to add a rule to allow HTTP/HTTPS and block the rest.

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote 👍 helpful posts!

                HenryH 1 Reply Last reply Reply Quote 0
                • HenryH
                  Henry @SteveITS
                  last edited by

                  @teamits Yes however "1:1 NAT maps all the external ports on that IP to the internal IP but you must still have firewall rules to allow the traffic to reach the local server."

                  https://forum.netgate.com/topic/75917/1-1-nat-vs-port-forwarding-when-to-use-each/3

                  1 Reply Last reply Reply Quote 0
                  • S
                    serbus
                    last edited by

                    Hello!

                    Port 6665 for remote access to your network seems odd, not because IRC is odd, but because that port has been so badly abused.

                    https://www.speedguide.net/port.php?port=6665

                    You might want to pick a "safer" port, unless that is not your intent...

                    John

                    Lex parsimoniae

                    HenryH 1 Reply Last reply Reply Quote 1
                    • HenryH
                      Henry @serbus
                      last edited by

                      @serbus Thank you, very good point!

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        Security though obscurity is not security... Opening up rdp to the public internet no matter what port is a BAD idea!!! If you want to rdp to this box, then vpn in and then do it.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.