RDP Config on Cisco 871 Router, RDP stopped working

[NOLAChris]

Remote desktop has been working fine for a couple months, but about mid january, the router stopped allowing connections. Last known good config below. Anything jump out at anyone?

Building configuration...

Current configuration : 6906 bytes
!
! Last configuration change at 12:36:41 PCTime Thu Sep 18 2008 by ***USERNAME***
! NVRAM config last updated at 12:34:33 PCTime Thu Sep 18 2008 by ***USERNAME***
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200
logging console critical
enable secret 5 $1$CO6Q$va3qh5OPXssNHocruf1Al1
!
no aaa new-model
clock timezone PCTime -6
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-2644455569
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2644455569
revocation-check none
rsakeypair TP-self-signed-2644455569
!
!
crypto pki certificate chain TP-self-signed-2644455569
certificate self-signed 01
3082024F 308201B8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32363434 34353535 3639301E 170D3032 30333031 30303336
30355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 36343434
35353536 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100C1E5 6DCAB152 7F1D453A AE39D599 36D10468 8A9C055D 335FDB92 3FBD3876
FE14E19C 6D64A6CB 2028B956 346E5468 1C555BF1 FC50A94D 3D02A2F1 41EBAFBD
0F82D71E 4AFC14FE 8D689558 24F4C03B 10B7E7F1 D27AA97E 94768BFE F260AC3D
AF509BD1 E30D18F2 A276FC50 529C6AEE 3921E11A DEAA1D45 E177EE99 6A32562F
56450203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603
551D1104 1B301982 17796F75 726E616D 652E796F 7572646F 6D61696E 2E636F6D
301F0603 551D2304 18301680 14F9D0CC 798E4CA4 A3EAEA6D A727002B 67BD084E
15301D06 03551D0E 04160414 F9D0CC79 8E4CA4A3 EAEA6DA7 27002B67 BD084E15
300D0609 2A864886 F70D0101 04050003 8181009D AD4DD41F 0AC67FB6 FF77B822
C80C0941 CDC8750E 7F59A89D 88138B09 BEB4F94D 54C71CFC 3453A2F3 DF863D7F
3DA671C5 6F68352A 9A25CC63 B3DCFB30 828573DA 6BD3FA4A 6A31B50E 4DE6B620
46504D84 E62D027C B944868B 4DFE0089 4C96163B B5A965EA DA6DDD68 355D45DF
039BE1FF 78363057 EBC615C1 93E8CC3C E1A44F
quit
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.2.1 192.168.2.99
!
ip dhcp pool sdm-pool1
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
domain-name eventrental.com
dns-server 205.152.132.23 205.152.37.23
!
!
no ip bootp server
ip domain name yourdomain.com
ip name-server 205.152.132.23
ip name-server 205.152.37.23
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
username ***USERNAME*** privilege 15 secret 5 $1$ulQ0$Daai9lFFL88pmTZu5zRh50
!
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$$ES_WAN$
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.2.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1412
!
interface Dialer0
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1452
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip route-cache flow
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname eventrental@att.net
ppp chap password 7 075A71194F041C091E13
ppp pap sent-username eventrental@att.net password 7 08741C1B0814001B1B0A
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 192.168.2.2 3389 interface FastEthernet4 3389
ip nat inside source static tcp 192.168.2.10 80 interface FastEthernet4 80
ip nat inside source static tcp 192.168.2.10 18082 interface FastEthernet4 18082
ip nat inside source static tcp 192.168.2.10 18083 interface FastEthernet4 18083
ip nat inside source static tcp 192.168.2.150 8000 interface FastEthernet4 8000
ip nat inside source static tcp 192.168.2.2 110 interface FastEthernet4 110
ip nat inside source static tcp 192.168.2.2 25 interface FastEthernet4 25
ip nat inside source static tcp 192.168.2.2 443 interface FastEthernet4 443
ip nat inside source static tcp 192.168.2.2 53 interface FastEthernet4 53
ip nat inside source static udp 192.168.2.2 53 interface FastEthernet4 53
!
ip access-list extended Internet-inbound-ACL
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any traceroute
permit gre any any
permit esp any any
permit tcp any any eq 3389
permit tcp any any
ip access-list extended Internet-inbounf-ACL
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.2.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
!
!
!
control-plane
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------

Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username "cisco" for one-time use. If you have already
used the username "cisco" to login to the router and your IOS image supports the
"one-time" user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.

It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you want to
use.

-----------------------------------------------------------------------
^C
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

 

[Minue]

Hello
Have you made in config changes before it stop working?Also try a reload if you haven't already to clear any stuck processes.
Regards

 

[NOLAChris]

Absolutely no changes. A microsoft update was installed on about the time it stopped working to fix a security flaw in rdp, but rolling it back did not help.

 

[Minue]

Hello
I think thats the problem.Check to see if RDP has change ports,try another host without the update and also do a reload on the router.
Regards

 

[burtsbees]

! Last configuration change at 12:36:41 PCTime Thu Sep 18 2008 by ***USERNAME***
! NVRAM config last updated at 12:34:33 PCTime Thu Sep 18 2008 by ***USERNAME***

Nobody has made any changes.

Burt

 

[NOLAChris]

Yea I know, which is why it's wierd that it would suddenly stop refusing connections.

 

[burtsbees]

Well, I totally agree it's the microsoft thing...

I would try making this...

ip nat inside source static tcp 192.168.2.2 3389 interface FastEthernet4 3389

with a different IP address in the 2.0 subnet. Also, isn't RDP UDP and not TCP?

One more thing...I like this fat finger that serves as a reminder...

ip access-list extended Internet-inbounf-ACL

lol

Burt

 

[NOLAChris]

You've never heard of the old inbounf, eh? Cleaned up the config and reloaded the router, but no such luck.

Microsoft RDP is a TCP on 3389

Any quick way to test if a connection is getting through the router but killed by the server?

 

[tjbradford]

does it work from inside the network by chance ?

rdp across the lan to test and work outwards from that

 

[NOLAChris]

I have no trouble accessing the remote desktop from inside the network, correct.

I am just trying to figure out a way to see if connections from outside are getting stopped at the router, or are getting past the router, to the server, but then being refused.

 

[burtsbees]

Port scan...

Burt

 

[Minue]

Hello
Check the nat translation on the router.Also debug ip or tcp.And use Wireshark on the host in question.
Regards

 

[tjbradford]

i'm a bit rusty with ACL's but isn't this config missing the new destination IP address as you have only declared an interface not a destination host address, i would think its passing the packet onto your eth4 lan with the destination as the orginal external address it won't have nat translated to the inside IP address, of course if your server is hosting a real address then exclude this thought. . . .

If this is the case then i expect there is an old arp entrie that was keeping it working until it failed.

 

[burtsbees]

By putting the interface name in there instead of an IP address, the router will use whatever IP address is on that interface. You have to do this with dynamic schemes (like dynamic adsl addresses).

Burt