Unable to RDP using pfSence

mameen.lk · Sep 6, 2023, 1:23 PM

Hello All,

I am new to PfSence and have installed PfSence at my home. My setup is as follows.

Dual WAN failover
pfBlockerNG
Snort
Squid Proxy
Squid Guard

I need to remote into a server via RDP at the office, but when I'm going through PfSence, the connection fails, and if I bypass the pfSence it works fine.

I would highly appreciate if someone could help me with this.

Best Regards,

johnpoz · Sep 6, 2023, 1:38 PM

@mameen-lk My first guess would be snort.. Until you have tuned your IPS to your needs/network it should only ever be in monitor only mode.

pfblocker could do it as well, if blocking the IP address your trying to connect too or the fqdn your wanting to access is filtered.

squid could do it too if all you allow is access outbound via squid and no other outbound access is allowed.

bmeeks · Sep 6, 2023, 5:37 PM

@mameen-lk said in Unable to RDP using pfSence:

pfBlockerNG
Snort
Squid Proxy
Squid Guard

You have 4 add-on packages installed that all block stuff in one manner or another. So, the logical first troubleshooting step when something is blocked unexpectedly is to disable all four of those blocking packages, test if RDP works, and then add back the packages one at the time until you find the one that breaks RDP. Then troubleshoot that package.

Not trying to pick on you individually here, but many users it seems install all manner of packages that block stuff, then come asking why pfSense is blocking something .

mameen.lk · Sep 7, 2023, 2:49 PM

@bmeeks Thank you, for the valuable guidance.

I have found out that once I disabled squid proxy I was able to RDP
Is there any option where we could bypass for a specific host or add a rule in squid proxy

Thanks in advance

bmeeks · Sep 7, 2023, 5:17 PM

@mameen-lk said in Unable to RDP using pfSence:

Is there any option where we could bypass for a specific host or add a rule in squid proxy

Sorry, but I've never used the Squid packages on pfSense. However, I would suspect there is a mechanism for implementing a "white list" of trusted IP addresses. Most packages that do some level of blocking provide a means for whitelisting.

You could try posting in the Cache/Proxy sub-forum which covers Squid related questions: https://forum.netgate.com/category/52/cache-proxy. Users there will be familiar with the various Squid packages available on pfSense.