1

I want to do allow 3389 port(RDP) only through VPN connection, not normally. How can I do this?

I have configured VPN server in Mikrotik. I have blocked all traffic except http and https by firewall filter. I allowed 3389 by filter rule and right now other systems(outside of our network) able to do RDP to our intranet systems regardless of VPN. I mean Laptop(client outside of our network) can able to do RDP with/without VPN client. I need client should connect to VPN server of Mikrotik then do RDP to intranet system otherwise disconnect.

How do I block other RDP connection except RDP over VPN?

Right Now:

   --------     pptp tunnel     ------------         ---------- 
  |        |   ============    |            |       |          |
  |laptop  |  --------------   |  Mikrotik  |-------| system A |
  |        |   ============    |            |       |          |
  |        |  --------------   |   router   |-------|          |
   --------                    |            |        ----------
                                ------------


I want :

   --------     pptp tunnel     ------------         ---------- 
  |        |   ============    |            |       |          |
  |laptop  |  --------------   |  Mikrotik  |-------| system A |
  |        |   ============    |            |       |          |
  |        |                   |   router   |       |          |
   --------                    |            |        ----------
                                ------------
Improve this question
1
  • Why are you allowing 3389 by filter rule? If a computer already has a VPN connection to your router it should also have access to internal network and also your port 3389. If you remove the 3389 filter, does it still work via VPN? (Outside computers will not have access anymore)
    – Rik
    Nov 25, 2013 at 18:00

3 Answers 3

Reset to default
1

This is the rule I need to add to allow rdp only over vpn and block all other connection.

add chain=forward action=accept protocol=tcp dst-port 3389 in-interface=VPN comment="Allow RDP via VPN"
Improve this answer
0

Have you tried 

 iptables -A INPUT -p gre --dport 3389  -j ACCEPT
 iptables -A INPUT --dport 3389 -j DROP

in this order? the first ruel should let through GRE-protocol packets, while the second one should block all the other packets.

Improve this answer
1
  • It's impossible to match ports inside gre!
    – Mikhail Moskalev
    May 14, 2014 at 10:57
-1

niren give a right idea. But possible is simpler to match against static WAN interface(s) that against possible dynamic VPN.

add chain=forward action=drop protocol=tcp dst-port 3389 in-interface=WAN comment="Deny RDP via WAN directly"

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .