0

I have a bastion ubuntu server set up to tunnel traffic inside AWS to a Windows server on a private subnet.

The AWS security group allows port 22 traffic, and all outbound traffic. The private Windows server allows RDP traffic from the bastion server.

I set up putty to tunnel RDP traffic from local 3391 to 3389 on the private Windows server. I am able to connect SSH without a problem.

When I open an RDP session to localhost:3391, I get "Remote Desktop can't connect to the remote computer "localhost" for one of these reasons: 1) Your user account is not listed in the RD Gateway's permission list ... etc."

I have tried turning off the windows firewall on my local machine. I have instructed windows to allow remote desktop connections to my local machine. Remote desktop connections from other windows machines on the same network to the private Windows server work without a problem, so it's not an issue with the remote machine accepting connections.

Ideas on what could be causing this?


Editing to provide more details:

Local machine (I want to connect from this server to the destination server in AWS, tunneled through the bastion)

  1. On my private home network.
  2. Windows 10
  3. Windows firewall is off for debugging purposes.
  4. Windows is allowing remote desktop connections.
  5. Windows loopback for 127.0.0.1 is configured in drivers/etc/hosts (as usual)
  6. Putty version 0.67 is running to connect SSH on the bastion server.
  7. Putty is connecting to ubuntu@[Public IP for Ubuntu Server] on port 22
  8. Putty authenticates against ubuntu using key file from AWS
  9. Putty is configured to allow agent forwarding
  10. Putty is configured to tunnel traffic from local 3391 to port 3389 on the destination server using the private IP address that the bastion server would use to connect to it (10.0.2.127)
  11. When I attempt to connect to localhost:3391 from this machine, I get the error mentioned above.

Bastion server:

  1. Ubuntu running on AWS
  2. Has a public IP address
  3. Is on a public subnet, but shares the same VPC as the destination server
  4. AWS security group for this machine allows inbound traffic on 22, and all outbound traffic

Destination server:

  1. Windows 2012 R2 on AWS
  2. On a private subnet on the same VPC as the bastion server
  3. Windows Firewall is off for debugging purposes
  4. AWS security group for this machine allows RDP traffic from the bastion server on 3389.
  5. I can connect remote desktop from a different windows machine in AWS to this machine, so we know that RDC connections are accepted by the destination server.
2
  • This would probably be easier to answer if you can be very specific about the settings involved. (Port forwarding is always tricky to get right, especially when there are multiple hosts involved.) So edit your question to state, very clearly, which software running on which host is configured for which port forwarding exactly, and which host you are running the remote desktop client software on, to where you tell it to connect, where that's supposed to end up and the exact behavior you are seeing. That should allow spotting the problem.
    – user
    May 19, 2016 at 13:32
  • Good point. More details added above. Let me know if there's more info I should provide.
    – awright
    May 19, 2016 at 13:48

0

You must log in to answer this question.

Browse other questions tagged .