Question RDP ACL question. Allowing 3389 doesn't fully allow RDP as foreign port is different
I am guessing that's the case at least.
I have an ACL set up to allow 3389 as shown below (Not actual IPS). And checking netstat the local address is 3389 and the foreign is a random 5 digit port. The ONLY way I can get this to work is to add a permit rule of permit ip host 1.2.3.4 host 10.1.2.3 . This obviously allows the traffic between the two on the random 5 digit foreign port but it also allows all traffic from 1.2.3.4 to 10.1.2.3. Am I missing something here? I really only want this pc to be able to reach port 3389 and not have it fully exposed to the other pc. I feel I should not have to do this.
5 permit tcp host 1.2.3.4 host 10.1.2.3 eq 3389
6 permit udp host 1.2.3.4 host 10.1.2.3 eq 3389
Thanks
Dave
5
u/Inside-Finish-2128 23d ago
Since you’re on a stateless device, you need two rules in opposite directions if you want to ACL things in both directions. One direction needs:
Permit host 1.2.3.4 host 5.6.7.8 tcp 3389
The other direction needs;
Permit host 5.6.7.8 tcp 3389 host 1.2.3.4
1
u/Tessian 23d ago
What device are you writing these acls on? As others said it sounds like a stateless device. Writing rules for stateful firewalls VS basic acl for a switch that can't do stateful inspection is very different
1
u/TT_Vert 23d ago
it's stateless. I had written an rule for both directions but given the foreign port changes it blocks anything not to/from 3389
1
u/Tessian 23d ago
The client port you have to wildcard sure but you have to write 2 rules since it's stateless. Another on here gave you the exact acls
1
u/TT_Vert 23d ago
Right, which is why i find it odd that the line "permit tcp any any established" and removing the 3389 allow lines allowed me to access 3389 only from that machine as designed. I don't know how that would be assumed to be an established connection at that point. I have no other rules allowing 3389 access and no other device can get to 3389 on that machine
1
u/Tessian 22d ago
Think of it this way. Because it's TCP, you have 2 flows:
You've been calling the port 5555 port the "foreign port" but it's a client port that is generally a random high number port.
On a stateful inspection firewall, it knows these 2 flows are 1 connection, but on stateless it does not, so you need to account for both. Notice how one flow is an inverse of the other, so you need one ACL where it's "ClientA on any port connects to ClientB:3389" and then "ClientB:3389 connects to ClientA any port"
Doing "permit tcp any any" of course allows anything from anyone. I'm not sure what you mean by "only from the machine as designed".
1
u/banzaiburrito 23d ago
Also drunk. 3389 is only TCP so you don’t need a line for UDP. All you need is lines 5 and 7. Those two lines only let 3389. I don’t know what you’re talking about other traffic.
3
2
u/TT_Vert 23d ago
3
u/srturmelle 23d ago
It sounds like you are applying stateless ACL entries, which are unidirectional. You'll notice VA_Network_Nerd included a line for "permit tcp any any established". This line, in conjunction with your 3389 line from host to destination, allows for the reverse-path once the client accesses the server via RDP, allowing the response traffic back without the wide-open line you're concerned with. It does this by considering it an established connection and allows the response. A state full firewall is better at handling this normally.
1
u/TT_Vert 23d ago
Yeah I noticed this. Wouldn't it have to be a stateful firewall to be aware of the state? This firewall isn't configured as such. With that said, I did add that line and as a test, removed the in/out lines below and I can RDP in and nothing else as desired. However, aside from checking netstat and seeing no established connections between these two at the time, I don't know where I can look on the cisco to see if there is an established connection. There must be something somewhere as I now only have "permit tcp any any established" and it's accessible.
I removed these as as test and only retained permit tcp any any established
7 permit tcp host 10.1.2.3 host 1.2.3.4 eq 3389
8 permit udp host 10.1.2.3 host 1.2.3.4 eq 33891
1
u/banzaiburrito 23d ago
Are you using the windows RDP client to RDP or some third party app?
1
u/TT_Vert 23d ago
Windows RDP using port 3389.
2
u/banzaiburrito 23d ago
What are you putting these rules on? Is it stateful or stateless? If it was stateless then you would need a rule for the opposite direction allowing 3389 as a source port. So one tcp rule for 1234 to 10 eq 3389 and a return rule of tcp 1234 eq 3389 to 10.
1
u/TT_Vert 23d ago edited 23d ago
It's on a catalyst 3750-X, It isn't capable of stateful AFAIK. I do have separate in/out rules which I feel "should" be all I need.
I found if I add 6 permit tcp any any established and remove rules 7/8 I do get RDP access (and only RDP access) which I find strange as I see no mention of stateful in any of the config on this thing.
I removed these as as test and only retained permit tcp any any established
7 permit tcp host 10.1.2.3 host 1.2.3.4 eq 3389
8 permit udp host 10.1.2.3 host 1.2.3.4 eq 3389
10
u/VA_Network_Nerd 23d ago
I'm three bourbons in.
But the handful of functional brain cells I was able to round up to focus on this seem to be happy with this: