Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have this situation:

network mask. 255.255.255.0

  • router/gateway: Ubuntu server (only command line, no gui) with internal lan ip 192.168.0.2 and a dynamic dns on the external ip

  • Windows pc on 192.168.0.1 with RDP (remote desktop connection) enabled on 3389

I want to forward the RDP service on the external address: how can i do that?

What are the iptables rules I need to connect to my Windows pc from the outside world?

share|improve this question
    
Q. What port does Remote Desktop use? Does everything go over port 3389? A. Port 3389 is the only port you need to open. Windows will attempt to stream sound through User Datagram Protocol (UDP) first. If no port is available for UDP, sound will stream through a virtual channel in Remote Desktop Protocol, which uses port 3389. –  brandstaetter Dec 1 '09 at 13:56
    
3389, as i wrote before. Yes, i need only 3389 udp, but i don't know how to "construct" iptables rules for that forwarding.. i need a hint, googled it but i haven't found a clear explanation :( –  apelliciari Dec 1 '09 at 14:28

5 Answers 5

So just giving you this rule probably won't be enough. Here's why: I'm not sure if (a) it'll work right (haven't tested it) and (b) if it does work it'll do more than work - it'll probably forward RDP packets to ANY machines in your network. The dilemma is, how to get the right IP address for the -d nnn.nnn.nnn.nnn/nnn argument. So... buyer beware; if 0/0 works it'll probably work to ALL machines behind your router.

Anyways, here you go:

iptables -A FORWARD -p tcp -s 0/0 -d 0/0 --destination-port 3389 -j ACCEPT

Here's some good reading on iptables: http://oceanpark.com/notes/firewall%5Fexample.html

Regards,
-pbr

share|improve this answer
    
Also you might have to repeat the line with "-p udp" instead of "-p tcp" –  pbr Dec 1 '09 at 21:45

You need to create a destination NAT (DNAT) rule to map the RDP (3389) on your internet connection's IP address to your internal systems IP address. Something like this:

iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3389 -j DNAT --to 192.168.0.1:3389

Replace $EXTIF with your external ethernet adapter (eth0, etc1,...). You can read this for more information (or if I got something wrong in this example, I didn't test it)

share|improve this answer

just port foward 3389 tcp and udp to the computer that has the remote desktop enabled. Then figuar out you external ip by going to a speedtesting website. Once done then all you need to get to your desktop is to type your external or GLOBAL ip address into a remote desktop terminal. user/password. done.

to port foward 3389 you need to enter your router and add that rule. there is no routing table you need to add. just that rule.

share|improve this answer
    
i need that iptable rule! i don't know the right syntax to forward 3389 tcp and udp to that computer from the server –  apelliciari Dec 1 '09 at 16:18
    
using yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html you can go over your basics and start your model for your system. not using a standard router and tring to use a linux server is great but you i need to know your set up before i can give you the syntax but this website should clear up setting your iptables and ipchains for port forwarding –  mike Dec 2 '09 at 8:28

Here is the rule you need:

iptables -t filter -A rdp -p tcp --dport 3389 -m state --state NEW -j ACCEPT -m comment --comment "rdp"

share|improve this answer

I would also suggest using a random port number from the outside... it's security by obscurity, but if you have port 3389 open on the outside of your home router, an attacker will easily see this and try to brute-force their way in to your system.

Any port above 1024 will work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.