Firewall – Remote Desktop working in LAN, but not over WAN

desktopfirewallport-forwardingrdpremote

We have a server with Remote Desktop enabled, but we can only access the server from inside the LAN. Port forwarding on port 3389 is set up on the gateway/modem (Comcast SMCD3G) and canyouseeme.org says the port is open, but when I try connect with the WAN ip it says "Remote desktop cannot access the specified computer". The only thing between the server and the Gateway is a Netgear ProSafe GS716T, but I do not see any settings that would interfere with remote desktop, so I am at a loss as to why its not working.

Best Answer

Three common possibilities:

  1. The network port forwarding & firewall rules are incorrect, we would need more details to help.

  2. Firewall Issue on the Server

    Some Windows OS's (SBS 08 R2 at least) by default deny RDP packets from networks other then the LAN. Check the server firewall settings:
    Administrative Tools, Windows Firewall w/ Advanced Settings, Inbound. If it's a problem then and you can't edit the rule or it comes back then it's probably coming from a Group Policy that needs to be changed.

    On a server with Group Policy Management installed, run GP Results Wizard, select the Server computer, Computer Settings only. In the results window, Settings tab, click Show All to see what settings are being applied and what policy they come from. In particular look at policies effecting RDP.
    -Backup the policy
    -Edit the policy.
    -On the server run: "GPUpdate /force"
    -Test RDP remotely

    The setting is under: Computer Configuration > Policies > Administrative Templates > Network/Network Connections/Windows Firewall/Domain Profiles > "Windows Firewall: Allow inbound Remote Desktop exceptions"
    An entry of "" would allow RDP from any remote subnet.

  3. Network Level Authentication requirement on the server is set higher then the RDP client is set to or can use.

    See http://technet.microsoft.com/en-us/library/cc732713.aspx
    Turn NLA off for testing, if it's an issue either leave it disabled or enable/upgrade the clients. Older RDP clients have limited or no NLA capabilities.

    If you reply then please be specific about: Server OS, client OS, RDP version and provide any relevant Event log entries on the Server relating to RDP.

Related Topic