Solved

changed IP and name of terminal server, now no one can access it!

Posted on 2011-09-28
16
462 Views
Last Modified: 2012-05-12
I'm doing a restructure of our internal network and I changed the static IP of our terminal server (which is not on a domain) to near the end of the range rather than the middle.
I also changed the name of it from "new-tserver" (because it is far from new now) to "rdp-server".
I've done a number of restarts, but no one can access it (using the normal RDC in windows) from OUTSIDE our office.  We can access it internally by typing in 192.168.1.253, but if someone is outside the office, they'd normally type our DSL's external IP.... this isn't working now.
0
Comment
Question by:Reece Dodds
  • 9
  • 4
  • 3
16 Comments
 
LVL 1

Expert Comment

by:archmuk
ID: 36812722
I understand that if someone has to access this server from outside the office, he has to come through firewall (or gateway security as implemented). Since you have changed both IP & name, you need to make the rules accordingly at the firewall for access from outside, only then the DSL / router / firewall can redirect the request to the terminal server at the nw IP.
Regards
Archmuk
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36812739
i did that.
We have a Juniper NetScreen-25 firewall and the RDP (TCP 3389) service was already there.
The policy was already there too, all I did was change the destination address.

I don't know what is going on...
0
 
LVL 21

Expert Comment

by:yo_bee
ID: 36812773
What are you using as a dest address (ip or name)?
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36812781
i've tried the new IP and the private IP range (192.168.1.0/24) and the option "ANY"

is there something on the terminal server that needs to be modified?
(but don't forget we can access it with RDC using the local IP)
0
 
LVL 1

Assisted Solution

by:archmuk
archmuk earned 100 total points
ID: 36812843
Have you  NATed the internal IP also ? can u check the firewall log to see what is blocking the request?
 
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36812979
i've NATed it now, and turned on logging...
I had someone outside our office try again and they can't connect.
The log shows:

2011-09-29 16:19:54      
DESTINATION= 165.228.xxx.yyy:3389      
SOURCE= 165.228.xxx.yyy:3482      
TRANSLATED DESTINATION= 192.168.1.204:3389         
SERVICE= TCP PORT 3389      
DURATION= 21 sec.      
BYTES SENT= 132      
BYTES RECEIVED= 0

The translated destination it shows is the old local IP.  The new one is .253
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36813106
i think i found where the problem is...
in the firewall, under interfaces, I can see the "ethernet3" interface, which connects to the DSL modem.
It's public IP is assigned by the ISP, which I can't change, but if I look at the MIP page (there is Basic, MIP, DIP, VIP, Track IP and Track IP Options), I can see a MIP existing that has our public IP as the Mapped IP and the terminal server's old private IP as the Host IP.    It says that it's "In Use".
There is no option to delete or edit this, but I can create a new one.
If I do this and set it up the way I think it should go, then click OK, I get an error that says "One IP in range [165.228.xxx.yyy-165.228.xxx.yyy] is in use!! Mip: can't be added"
0
 
LVL 1

Expert Comment

by:archmuk
ID: 36813496
Is the server mapped IP the same as the DSL modem public IP provided by the ISP?
I can suggest a work around, as you have not changed the subnet, why do you not configure an additional IP which is the old IP on the server network adapter in use? (through advanced tab in the TCP/IP properties)
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 21

Expert Comment

by:yo_bee
ID: 36814193
Can you reboot the router?
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36818770
ok, the issue is definately in the juniper firewall.
i changed the IP back to 192.168.1.204 and rebooted and external staff can access it fine.

I really do want to move this server to an end-range IP, so I somehow need to change/delete this MIP in the firewall.
Any ideas how I can do this?
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36818772
@archmuk:  yes, the mapped IP is the same as the public IP the DSL modem gets given by the ISP...
0
 
LVL 21

Expert Comment

by:yo_bee
ID: 36818791
Did you try rebooting router?
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36818841
yes, I have rebooted the Juniper firewall and the d-link DSL modem... twice.
Once with the RDP server's IP set as 1.204 and once with it set as 1.253

I can see how to create a MIP, but how do I delete or modify an existing one?  I assume it has something to do with it being "in use", but how can I even change that status?
0
 
LVL 21

Accepted Solution

by:
yo_bee earned 400 total points
ID: 36819027
Have you read this kb article ?
http://kb.juniper.net/InfoCenter/index?page=content&id=KB6659&cat=NS_5XP&actp=LIST

Looks like you need to remove the policy first then you can modify or delete the MIP.
0
 
LVL 7

Author Closing Comment

by:Reece Dodds
ID: 36819076
looking at the logs helped me find that it was being forwarded via a MIP not using NAT.
0
 
LVL 7

Author Comment

by:Reece Dodds
ID: 36819079
thanks guys
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
Learn about cloud computing and its benefits for small business owners.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now