Windows Firewall RPC Dynamic Range not working

Question

Hi

I am setting some firewall rules through GPO, and I have to open Dynamic Port Range. I made a rule using TCP / Dynamic Port Range and another for TCP / RPC Endpoint Mapper. Port 3389 is also opened, because I try to make remote assistance to work on those servers.

But it doesn't work due to the rule Dynamic Port Range not being correctly interpreted, If I manually enter the range 49152-65535 then it works, but not with the value "Dynamic Port Range".

Anyone has seen this ?

Answer 1

Hello there,

By default, RPC uses ports in the ephemeral port range (1024-5000) when it assigns ports to RPC applications that have to listen on a TCP endpoint. This behavior can make restricting access to these ports challenging for network administrators. This article discusses ways to reduce the number of ports available to RPC applications and how to restrict access to these ports by using a registry-based IPsec policy.

https://support.microsoft.com/en-us/topic/how-to-configure-rpc-to-use-certain-ports-and-how-to-help-secure-those-ports-by-using-ipsec-2a94b798-063a-479a-8452-9cf07ac613d9

This article helps you modify the Remote Procedure Call (RPC) parameters in the registry to make sure RPC dynamic port allocation can work with firewalls. https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-rpc-dynamic-port-allocation-with-firewalls

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--