How to do RDP (port 3389) on the private LAN using OpenVPN tunnel

Question

How to do RDP (port 3389) on the private LAN using OpenVPN tunnel

Valdy 1

Hi there,

We have a few VMs on Azure (Windows 11, Ubuntu Server, Ubuntu Desktop, etc) on the same virtual private network (10.0.0.0/24). We installed the OpenVPN connector on one of the Ubuntu VM.

On our office after initiating the OpenVPN client, we can ping 10.0.0.5 (OpenVPN connector) and we can also ping 10.0.0.5 (Windows 11 device) after allowing a ping request on the box.

However, we are not able to do an RDP onto 10.0.0.4. Any ideas? Any config on the Azure Private Network that we need to do?

BTW if we do RDP to the public IP, it worked OK.

I'm appreciated your feedback.

Thanks

KapilAnanth-MSFT 49,621 Reputation points Microsoft Employee Moderator

2022-09-07T08:29:26.32+00:00
Hi @Valdy ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to set up a VPN connection between Azure and OnPrem via OpenVPN.

From your verbatim, I see 10.0.0.5 - is your Ubuntu VM where OpenVPN Connector is installed.
You have also mentioned that your Windows 11 device as same IP. I can only assume it should be 10.0.0.4, but please confirm

Technically, if Ping is succeeding towards 10.0.0.4, routing is fine.

Did you try to telnet from 10.0.0.5 to 10.0.0.4 on Port 3389

Did you try doing Telnet/psping (Not RDP) from any OnPrem server to 10.0.0.4?

Did you try ping/Telnet to any OnPrem server from 10.0.0.4 (reverse direction)

Cheers,
Kapil
Valdy 1 Reputation point

2022-09-07T09:15:51.903+00:00

Hi anonymous user-MSFT

Thanks for the feedback.

The Windows 11 on Azure is 10.0.0.4

Did you try to telnet from 10.0.0.5 to 10.0.0.4 on Port 3389

Yes. Worked OK

Did you try doing Telnet/psping (Not RDP) from any OnPrem server to 10.0.0.4?

Due to my machine is outside the Azure LAN, I use OpenVPN client, I can ping 10.0.0.4 and 10.0.0.5

However, not be able to telnet into 10.0.0.4 port 3389
KapilAnanth-MSFT 49,621 Reputation points Microsoft Employee Moderator

2022-09-08T06:12:11.497+00:00
Hi @Valdy ,

Thanks for the information.

Since you confirmed Ping is working, I do not suspect there is a routing blocker at Platform level.

I can only suspect that some configurations should be missing on the VPN Connector VM (10.0.0.5)

May I know if the VPN Connector is doing NAT or is just forwarding the packets.

If it's not doing NAT, did you create a Route Table to make sure the 10.0.0.4 is sending the packets destined to OnPrem address range to 10.0.0.5?

Did you get a chance to collect packet captures on Source (OnPrem server), 10.0.05 and 10.0.0.4 servers simultaneously?

Can you see the packet reaching the 10.0.0.5 and 10.0.0.5 is indeed sending it to 10.0.0.4?

If 10.0.0.5 is sending, are we receiving the packets in 10.0.0.4

This will help us isolate where the packets are dropping.

Feel free to let me know if you have any queries on this.

Cheers,
Kapil.

1 answer

Your answer

KapilAnanth-MSFT 49,621 Reputation points Microsoft Employee Moderator

2022-09-07T08:29:26.32+00:00

Hi @Valdy ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to set up a VPN connection between Azure and OnPrem via OpenVPN.

From your verbatim, I see 10.0.0.5 - is your Ubuntu VM where OpenVPN Connector is installed.
You have also mentioned that your Windows 11 device as same IP. I can only assume it should be 10.0.0.4, but please confirm

Technically, if Ping is succeeding towards 10.0.0.4, routing is fine.

Did you try to telnet from 10.0.0.5 to 10.0.0.4 on Port 3389

Did you try doing Telnet/psping (Not RDP) from any OnPrem server to 10.0.0.4?

Did you try ping/Telnet to any OnPrem server from 10.0.0.4 (reverse direction)

Cheers,
Kapil
Valdy 1 Reputation point

2022-09-07T09:15:51.903+00:00

Hi anonymous user-MSFT

Thanks for the feedback.

The Windows 11 on Azure is 10.0.0.4

Did you try to telnet from 10.0.0.5 to 10.0.0.4 on Port 3389

Yes. Worked OK

Did you try doing Telnet/psping (Not RDP) from any OnPrem server to 10.0.0.4?

Due to my machine is outside the Azure LAN, I use OpenVPN client, I can ping 10.0.0.4 and 10.0.0.5

However, not be able to telnet into 10.0.0.4 port 3389
KapilAnanth-MSFT 49,621 Reputation points Microsoft Employee Moderator

2022-09-08T06:12:11.497+00:00

Hi @Valdy ,

Thanks for the information.

Since you confirmed Ping is working, I do not suspect there is a routing blocker at Platform level.

I can only suspect that some configurations should be missing on the VPN Connector VM (10.0.0.5)

May I know if the VPN Connector is doing NAT or is just forwarding the packets.

If it's not doing NAT, did you create a Route Table to make sure the 10.0.0.4 is sending the packets destined to OnPrem address range to 10.0.0.5?

Did you get a chance to collect packet captures on Source (OnPrem server), 10.0.05 and 10.0.0.4 servers simultaneously?

Can you see the packet reaching the 10.0.0.5 and 10.0.0.5 is indeed sending it to 10.0.0.4?

If 10.0.0.5 is sending, are we receiving the packets in 10.0.0.4

This will help us isolate where the packets are dropping.

Feel free to let me know if you have any queries on this.

Cheers,
Kapil.

Answer 1

rafalzak 3,251

Hi @Valdy ,

Did you check Windows Firewall settings on Windows PC?

Valdy 1 Reputation point

2022-09-07T06:58:54.807+00:00

Hi @rafalzak

Due to we can access this VM (windows 11) via public IP, we assume the firewall is the same then for the private IP ? How do we check this particular setting on Windows device?

Thanks
rafalzak 3,251 Reputation points

2022-09-07T07:05:02.49+00:00

Please check this settings:
Valdy 1 Reputation point

2022-09-07T07:15:56.313+00:00

Checked that both Public and Private are ticked.
rafalzak 3,251 Reputation points

2022-09-07T07:29:58.767+00:00

What do you have in NSG? and can you ping any address from 10.0.0.0/24 like 10.0.0.4?
Valdy 1 Reputation point

2022-09-07T07:38:31.617+00:00

Here's what I've got on the NSG:

Yes ... from other device within 10.0.0.0/24 ... I can ping. I also can ping to 10.0.0.4/24 if we do tunneling (OpenVPN activated) from anywhere.

But we haven't tried to RDP within 10.0.0.0/24 due to this is the only Windows machine that we have. Not sure about RDP from Ubuntu Desktop to Windows 11 yet - thing to look at later. But surely this will work, isn't it?
rafalzak 3,251 Reputation points

2022-09-07T07:50:14.743+00:00

yes, RDP on Windows 11 for the same network will works by default (already tested it for you on my env.) The last idea I have is route table. Not sure what network address you have on on-prem but try to ping any local ip from Windows 11 on Azure. OR you can try tracert command to check each hop. Maybe this will give you some tip.
Valdy 1 Reputation point

2022-09-07T08:02:45.45+00:00

Try ping from 10.0.0.4 (Windows 11) to other devices within 10.0.0.0/24 worked OK.

This indicated to me that the routing is OK BUT somehow not the RDP port

Share via

How to do RDP (port 3389) on the private LAN using OpenVPN tunnel

1 answer

Your answer