<div>
what is the problem? &nbsp;Are you using the netbios name, fqdn, or ip address to connect with rdp? &nbsp;Can you ping the server over the vpn with all three?
</div>


<div>
When RDP access is enabled it creates an exception to allow access but the default is only from the local subnet. You are connecting from a different subnet when connecting by VPN. You will need to change the firewall exception to allow all remote connections or just your subnet. Pete Long has outlined nicely how to do this with group policy which is the better option than device by device:<br />
<a href="http://www.petenetlive.com/KB/Article/0000193.htm" rel="ugc">http://www.petenetlive.com/KB/Article/0000193.htm</a>
</div>


<div>
The the strange thing is I can rdp to the sbs server itself over the vpn by both ip or computer name but can't get to other machines either way
</div>


<div>
SBS is configured for internet access for management, PC's are not.<br />
<br />
The other issue you can run into, if you can access RRAS server but not PC's is if you are using the the SBS VPN and the site from which you are connecting uses the same subnet locally. For example if both sites use 192.168.1.x The two sites MUST be different, if not sometimes you can connect to the VPN server but you will not be able to connect to anything else.
</div>


<div>
Even after that GP change I still can't rdp to the machine.<br />
<br />
I can't even resolve the name when i ping it unless i specify a DNS suffix in the VPN connection itself and then it does resolve the computer name but I still can't access it by rdp over the rdp!
</div>


<div>
Cay you ping the PC to which you are trying to connect using the IP.<br />
If so can you access by by RDP using the IP?<br />
keep in mind unless you run gpupdate /force on the PC at the SBS site, group policy can take 90 minutes to be applied and the computer will have to be logged off for it to be applied.<br />
<br />
If you are having to add the DNS suffix it is because the machine is not a member of the domain. That should be a different issue than RDP not working but you can add the suffix such as mydomain.local to the connecting client's PC under network adapter properties | IPv4 TCP/IP properties | advanced | DNS | &quot;append these DNS suffixes (in order)&quot; 
</div>


<div>
I can ping the pc im trying to connect to by its ip address but it still wont let me connect by rdp with its ip address.<br />
<br />
Almost seems like abit of a DNS issue<br />
<br />
I have been gpupdate /force 'ing on the machine on the same site as the sbs.<br />
<br />
Its definitely been added to the domain and its in the correct Ou {SBS Computer}
</div>


<div>
When connecting to the PC using the IP, DNS is not involved.<br />
Can you connect to the PC using RDP from the same LAN (the SBS site)?
</div>


<div>
yeah can connect locally no problem at all both name and ip and and connect to the sbs server via vpn aswell by both the ip and name
</div>


<div>
If you can ping from the remote site, and you can connect from the same LAN using the IP then it is almost certainly a problem with the firewall.<br />
Are there any other security applications on the PC that have firewalls, such as McAfee security suite, Trend Micro, Symantec, etc.. They too will block remote &quot;untrusted networks&quot;. It is a common problem.<br />
<br />
Once resolved we can address DNS if it is still a problem. Or if you can post an &nbsp;ipconfig /all &nbsp;while the VPN is connected from a client machine I can have a look at that now as well.
</div>


<div>
It had symantec installed on the machine but have since removed and rebooted it. Have also tried turning off the windows firewall. The server has symentec installed surely that isn't a issue as we can connect to the server
</div>


<div>
No it shouldn't be server firewall issue.<br />
Interesting you were able to turn off the Windows firewall? GP must be modified, though that shouldn't be n issue.<br />
<br />
The only other thought is the subnets, but if that was a problem you shouldn't be able to ping the PC.<br />
Can you post the results of &nbsp;ipconfig /all &nbsp;while the VPN is connected from a client machine?<br />

</div>


<div>
 Connection-specific DNS Suffix &nbsp;. :<br />
&nbsp;Description . . . . . . . . . . . : AermecUK<br />
&nbsp;Physical Address. . . . . . . . . :<br />
&nbsp;DHCP Enabled. . . . . . . . . . . : No<br />
&nbsp;Autoconfiguration Enabled . . . . : Yes<br />
&nbsp;IPv4 Address. . . . . . . . . . . : 192.168.0.14(Preferred)<br />
&nbsp;Subnet Mask . . . . . . . . . . . : 255.255.255.255<br />
&nbsp;Default Gateway . . . . . . . . . : 0.0.0.0<br />
&nbsp;DNS Servers . . . . . . . . . . . : 192.168.0.2<br />
&nbsp;NetBIOS over Tcpip. . . . . . . . : Enabled<br />
<br />
That is with it no DNS suffix specified and below is with it specified so i can ping machine names.<br />
<br />
&nbsp;Connection-specific DNS Suffix &nbsp;. : aermec.local<br />
&nbsp;Description . . . . . . . . . . . : AermecUK<br />
&nbsp;Physical Address. . . . . . . . . :<br />
&nbsp;DHCP Enabled. . . . . . . . . . . : No<br />
&nbsp;Autoconfiguration Enabled . . . . : Yes<br />
&nbsp;IPv4 Address. . . . . . . . . . . : 192.168.0.13(Preferred)<br />
&nbsp;Subnet Mask . . . . . . . . . . . : 255.255.255.255<br />
&nbsp;Default Gateway . . . . . . . . . : 0.0.0.0<br />
&nbsp;DNS Servers . . . . . . . . . . . : 192.168.0.2<br />
&nbsp;NetBIOS over Tcpip. . . . . . . . : Enabled
</div>


<div>
I was looking for the whole config but that may be enough. Assuming that is the output for the PPP adapter it appears the SBS site uses 192.168.0.x &nbsp;No user can connect from a remote site that also uses that same subnet or they will experience the RDP issues you are having.
</div>


<div>
The site I'm connecting from is on a 192.168.1. Range
</div>


<div>
I am stumped then.<br />
Might possibly help if you posted tracert from client to the problematic PC.
</div>


<div>
PS- A long shot, if any where between client and server a subnet mask of 255.255.0.0 is used instead of 255.255.255.0 that will put them on the same subnet and cause problems. As mentioned though pinging should not work in this case.
</div>


<div>
C:\Users\james&gt;tracert 192.168.0.188<br />
<br />
Tracing route to aermec-pc5.aermec.local [192.168.0.188]<br />
over a maximum of 30 hops:<br />
<br />
&nbsp; 1 &nbsp; &nbsp;26 ms &nbsp; &nbsp;25 ms &nbsp; &nbsp;25 ms &nbsp;AERMEC [192.168.0.18]<br />
&nbsp; 2 &nbsp; &nbsp;26 ms &nbsp; &nbsp;27 ms &nbsp; &nbsp;24 ms &nbsp;aermec-pc5.aermec.local [192.168.0.188]
</div>


<div>
Also on the router subnet is set as 255.255.255.0 so all looks ok there
</div>


<div>
Sorry I thought that would confirm the local connection but I just verified on another VPN no it does not.<br />
<br />
I am afraid I am totally stumped. It still sounds like a firewall issue on the PC to which you are connecting as local or remote ICMP requests (pings) are accepted by default, as are local RDP connections, but remote RDP connections are blocked.<br />
<br />
On another note why are you using RDP? The default configuration of SBS allows remote access through Remote Web Access which requires no firewall re-configurations, offers same capabilities, and is more secure than the VPN. Or do you need the VPN for other reasons?
</div>


<div>
Is the VPN terminated on the SBS server, or on something else ?
</div>


<div>
the ip address of the vpn connection its showing in DHCP correctly
</div>


<div>
Right I have gone for the remote.mydomain.com option and have a few questions.<br />
<br />
Firstly where do I find the self issued cert to install on the machines that are connecting ?<br />
<br />
Also when logging in locally to RWW all works fine apart from it fails to show the shared folders widget any idea?<br />
<br />
Help much appreciated !
</div>


<div>
&gt;&gt;&quot;Firstly where do I find the self issued cert to install on the machines that are connecting ?&quot;<br />
\\SBSname\Public\Downloads<wbr />\Certifica<wbr />te Distribution Package<br />
&nbsp; Copy the zip file (or extracted files) to the remote device and click on InstallCertificate.exe &nbsp;On some mobile devices just click on the cert will work.<br />
<br />
&gt;&gt;&quot;fails to show the shared folders &quot;<br />
If you go to &nbsp;SBS console | shared folders and web sites | web sites | highlight RWA and select properties | Home page links | is File sharing checked?
</div>


<div>
Yes file sharing is ticked<br />
<br />
Also the public shared folder I actually removed this as I just wanted to keep the data drive with the shared folders from the old server, is there anything i can do ?
</div>


<div>
The wizard will only show shared folders on the SBS itself. They do not have to be in the public folder. I assume there are some present? If they are on another server there is a work around.<br />
<br />
With SBS :<br />
-always uses the wizards<br />
-leave all components installed<br />
-accept defaults whenever possible.<br />
<br />
If you removed the public folder I have no idea what the SBS would do with the certificate, if create it at all. You don't have to use the default folder structure but it can be problematic if you delete it. I would do a search for &quot;fails to show the shared folders .zip&quot; and see if it is present somewhere else. If that doesn't work I would recommend buying a 3rd party certificate. Godady has them for about $30/year. The 3rd party certificate is the recommended method anyway as you don't have to install it on remote clients, they accept it by default. Also it can be very problematic to install the self signed cert on some mobile devices 
</div>


<div>
Yeah looks like I will just go for a 3rd party cert and learn my lesson, after a few sbs installs before I tried using the wizards for everything on this one yet still manage to remove a folder i need grrr!
</div>


<div>
<div class="content wysiwyg-content">
Having a issue where rdp isn't working over vpn on a sbs 2011 server. Any ideas?
</div>
</div>


Having a issue where rdp isn't working over vpn on a sbs 2011 server. Any ideas?

RDP over VPN not working correctly

Small Business Server (SBS) is a line of server operating systems targeted at small businesses by bundling the operating system with a number of other Microsoft products that would normally need to be purchased or licensed separately. The most notable inclusions are Exchange, SQL Server, SharePoint and ISA/TMG (Microsoft's firewall and proxy server).