RDP fails over VPN

[ISDPCMAN]

Recently (last week) we started having issues with the VPN/RDP connection for a couple of users. One user has no issue. Here's the setup:
- remote user logs in to the VPN server. Connection established
- User can ping IP address of remote server through the VPN tunnel
- User launches [Windows 10 Pro x64] RDP client with server IP address in the destination
- System times out with error "An internal error occurred" (big help that is!)

If we create a firewall rule to allow RDP connection specifically from the RDP client, over the WAN, to the public IP of the firewall, RDP works fine! If we VPN into the firewall and try to run RDS it fails (with the error listed).

We can RDP INSIDE the LAN just fine so this is DEFINITELY a Sonicwall firewall issue...we just can't understand where it came from! Firmware on the firewall is SonicOS Enhanced 5.9.1.7-2o.

The model is: NSA-250M
There are 17 VPN licenses (2 are being used).

Any thoughts what the issue could be? We can't find anything in the logs where the RDP connection is getting denied, over the VPN, but it sure works if we go directly to the WAN IP! Except we need the VPN so we need to get that working.

Any help is greatly appreciated!

 

[gkittelson]

When you have users connecting via VPN you need to make sure that the network that is trusted for RDP to the client computer is trusted in the firewall for that network.

For example, when you create port forwarding in the Sonicwall the remote IP appears as the Sonicwall IP. When you VPN in the network the VPN is on, which could be different, might not be allowed through the firewall of the client computer.

Additionally, the VPN network you have setup might not allow traffic from all clients on the networks to pass properly.

I typically setup my Sonicwall to use the local server for DHCP and DNS and use DHCP over VPN with a central gateway.

You also must have the proper network setup for access from the VPN for users / local users and groups / your vpn group / VPN Access tab to make sure they can properly access those addresses when connected via VPN.

I hope this helps!

Guy Kittelson
Plan-IT Computing