2

I have this situation:

network mask. 255.255.255.0

  • router/gateway: Ubuntu server (only command line, no gui) with internal lan ip 192.168.0.2 and a dynamic dns on the external ip

  • Windows pc on 192.168.0.1 with RDP (remote desktop connection) enabled on 3389

I want to forward the RDP service on the external address: how can i do that?

What are the iptables rules I need to connect to my Windows pc from the outside world?

2
  • Q. What port does Remote Desktop use? Does everything go over port 3389? A. Port 3389 is the only port you need to open. Windows will attempt to stream sound through User Datagram Protocol (UDP) first. If no port is available for UDP, sound will stream through a virtual channel in Remote Desktop Protocol, which uses port 3389. Dec 1, 2009 at 13:56
  • 3389, as i wrote before. Yes, i need only 3389 udp, but i don't know how to "construct" iptables rules for that forwarding.. i need a hint, googled it but i haven't found a clear explanation :( Dec 1, 2009 at 14:28

5 Answers 5

1

So just giving you this rule probably won't be enough. Here's why: I'm not sure if (a) it'll work right (haven't tested it) and (b) if it does work it'll do more than work - it'll probably forward RDP packets to ANY machines in your network. The dilemma is, how to get the right IP address for the -d nnn.nnn.nnn.nnn/nnn argument. So... buyer beware; if 0/0 works it'll probably work to ALL machines behind your router.

Anyways, here you go:

iptables -A FORWARD -p tcp -s 0/0 -d 0/0 --destination-port 3389 -j ACCEPT

Here's some good reading on iptables: http://oceanpark.com/notes/firewall_example.html

Regards,
-pbr

1
  • Also you might have to repeat the line with "-p udp" instead of "-p tcp"
    – pbr
    Dec 1, 2009 at 21:45
1

You need to create a destination NAT (DNAT) rule to map the RDP (3389) on your internet connection's IP address to your internal systems IP address. Something like this:

iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3389 -j DNAT --to 192.168.0.1:3389

Replace $EXTIF with your external ethernet adapter (eth0, etc1,...). You can read this for more information (or if I got something wrong in this example, I didn't test it)

0

just port foward 3389 tcp and udp to the computer that has the remote desktop enabled. Then figuar out you external ip by going to a speedtesting website. Once done then all you need to get to your desktop is to type your external or GLOBAL ip address into a remote desktop terminal. user/password. done.

to port foward 3389 you need to enter your router and add that rule. there is no routing table you need to add. just that rule.

2
  • i need that iptable rule! i don't know the right syntax to forward 3389 tcp and udp to that computer from the server Dec 1, 2009 at 16:18
  • using yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html you can go over your basics and start your model for your system. not using a standard router and tring to use a linux server is great but you i need to know your set up before i can give you the syntax but this website should clear up setting your iptables and ipchains for port forwarding
    – mike
    Dec 2, 2009 at 8:28
0

Here is the rule you need:

iptables -t filter -A rdp -p tcp --dport 3389 -m state --state NEW -j ACCEPT -m comment --comment "rdp"

0

I would also suggest using a random port number from the outside... it's security by obscurity, but if you have port 3389 open on the outside of your home router, an attacker will easily see this and try to brute-force their way in to your system.

Any port above 1024 will work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .