1

I want to do allow 3389 port(RDP) only through VPN connection, not normally. How can I do this?

I have configured VPN server in Mikrotik. I have blocked all traffic except http and https by firewall filter. I allowed 3389 by filter rule and right now other systems(outside of our network) able to do RDP to our intranet systems regardless of VPN. I mean Laptop(client outside of our network) can able to do RDP with/without VPN client. I need client should connect to VPN server of Mikrotik then do RDP to intranet system otherwise disconnect.

How do I block other RDP connection except RDP over VPN?

Right Now:

   --------     pptp tunnel     ------------         ---------- 
  |        |   ============    |            |       |          |
  |laptop  |  --------------   |  Mikrotik  |-------| system A |
  |        |   ============    |            |       |          |
  |        |  --------------   |   router   |-------|          |
   --------                    |            |        ----------
                                ------------


I want :

   --------     pptp tunnel     ------------         ---------- 
  |        |   ============    |            |       |          |
  |laptop  |  --------------   |  Mikrotik  |-------| system A |
  |        |   ============    |            |       |          |
  |        |                   |   router   |       |          |
   --------                    |            |        ----------
                                ------------
  • Why are you allowing 3389 by filter rule? If a computer already has a VPN connection to your router it should also have access to internal network and also your port 3389. If you remove the 3389 filter, does it still work via VPN? (Outside computers will not have access anymore) – Rik Nov 25 '13 at 18:00
1

This is the rule I need to add to allow rdp only over vpn and block all other connection.

add chain=forward action=accept protocol=tcp dst-port 3389 in-interface=VPN comment="Allow RDP via VPN"
0

Have you tried

 iptables -A INPUT -p gre --dport 3389  -j ACCEPT
 iptables -A INPUT --dport 3389 -j DROP

in this order? the first ruel should let through GRE-protocol packets, while the second one should block all the other packets.

  • It's impossible to match ports inside gre! – Mikhail Moskalev May 14 '14 at 10:57
-1

niren give a right idea. But possible is simpler to match against static WAN interface(s) that against possible dynamic VPN.

add chain=forward action=drop protocol=tcp dst-port 3389 in-interface=WAN comment="Deny RDP via WAN directly"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.