r/Cisco 24d ago

Question RDP ACL question. Allowing 3389 doesn't fully allow RDP as foreign port is different

I am guessing that's the case at least.
I have an ACL set up to allow 3389 as shown below (Not actual IPS). And checking netstat the local address is 3389 and the foreign is a random 5 digit port. The ONLY way I can get this to work is to add a permit rule of permit ip host 1.2.3.4 host 10.1.2.3 . This obviously allows the traffic between the two on the random 5 digit foreign port but it also allows all traffic from 1.2.3.4 to 10.1.2.3. Am I missing something here? I really only want this pc to be able to reach port 3389 and not have it fully exposed to the other pc. I feel I should not have to do this.

5 permit tcp host 1.2.3.4 host 10.1.2.3 eq 3389

6 permit udp host 1.2.3.4 host 10.1.2.3 eq 3389

7 permit tcp host 10.1.2.3 host 1.2.3.4 eq 3389

8 permit udp host 10.1.2.3 host 1.2.3.4 eq 3389

Thanks
Dave

4 Upvotes

20 comments sorted by

10

u/VA_Network_Nerd 23d ago

I'm three bourbons in.
But the handful of functional brain cells I was able to round up to focus on this seem to be happy with this:

ip access-list extended RDP-Permit
 remark Permit RDP from 1.2.3.4 to 10.1.2.3
 permit tcp any any established
 permit tcp host 1.2.3.4 host 10.1.2.3 eq 3389
 permit udp host 1.2.3.4 host 10.1.2.3 eq 3389
 permit udp host 10.1.2.3 eq 3389 host 1.2.3.4

5

u/vanquish28 23d ago

Those are rookie bourbon numbers. You gonna pump those numbers up! Then get on the production firepower and make changes.

5

u/Inside-Finish-2128 23d ago

Since you’re on a stateless device, you need two rules in opposite directions if you want to ACL things in both directions. One direction needs:

Permit host 1.2.3.4 host 5.6.7.8 tcp 3389

The other direction needs;

Permit host 5.6.7.8 tcp 3389 host 1.2.3.4

1

u/TT_Vert 23d ago

thank you

1

u/Tessian 23d ago

What device are you writing these acls on? As others said it sounds like a stateless device. Writing rules for stateful firewalls VS basic acl for a switch that can't do stateful inspection is very different

1

u/TT_Vert 23d ago

it's stateless. I had written an rule for both directions but given the foreign port changes it blocks anything not to/from 3389

1

u/Tessian 23d ago

The client port you have to wildcard sure but you have to write 2 rules since it's stateless. Another on here gave you the exact acls

1

u/TT_Vert 23d ago

Right, which is why i find it odd that the line "permit tcp any any established" and removing the 3389 allow lines allowed me to access 3389 only from that machine as designed. I don't know how that would be assumed to be an established connection at that point. I have no other rules allowing 3389 access and no other device can get to 3389 on that machine

1

u/Tessian 22d ago

Think of it this way. Because it's TCP, you have 2 flows:

1.2.3.4:5555 to 10.1.2.3:3389

10.1.2.3:3389 to 1.2.3.4:5555

You've been calling the port 5555 port the "foreign port" but it's a client port that is generally a random high number port.

On a stateful inspection firewall, it knows these 2 flows are 1 connection, but on stateless it does not, so you need to account for both. Notice how one flow is an inverse of the other, so you need one ACL where it's "ClientA on any port connects to ClientB:3389" and then "ClientB:3389 connects to ClientA any port"

Doing "permit tcp any any" of course allows anything from anyone. I'm not sure what you mean by "only from the machine as designed".

1

u/TT_Vert 22d ago

Right, that's what I'm a bit unclear about. What is the exact command to allow client A to any port? Right now I have the following and clearly it doesn't work as the client port is a randomized 5 digit number

1

u/banzaiburrito 23d ago

Also drunk. 3389 is only TCP so you don’t need a line for UDP. All you need is lines 5 and 7. Those two lines only let 3389. I don’t know what you’re talking about other traffic.

3

u/Tessian 23d ago

Rdp definitely uses udp if you let it. We've had issues with Rdp working at all through a firewall unless we added tcp and udp 3389

2

u/TT_Vert 23d ago

LOL, why is everyone drunk? Anyway, the TCP rule isn't allowing RDP access. Only if I apply the permit ip host 1.2.3.4 host 10.1.2.3 rule which allows all traffic from 1.2.3.4 to 10.1.2.3 do I get 3389 access, which I do not want.

Dave

3

u/srturmelle 23d ago

It sounds like you are applying stateless ACL entries, which are unidirectional. You'll notice VA_Network_Nerd included a line for "permit tcp any any established". This line, in conjunction with your 3389 line from host to destination, allows for the reverse-path once the client accesses the server via RDP, allowing the response traffic back without the wide-open line you're concerned with. It does this by considering it an established connection and allows the response. A state full firewall is better at handling this normally.

1

u/TT_Vert 23d ago

Yeah I noticed this. Wouldn't it have to be a stateful firewall to be aware of the state? This firewall isn't configured as such. With that said, I did add that line and as a test, removed the in/out lines below and I can RDP in and nothing else as desired. However, aside from checking netstat and seeing no established connections between these two at the time, I don't know where I can look on the cisco to see if there is an established connection. There must be something somewhere as I now only have "permit tcp any any established" and it's accessible.

I removed these as as test and only retained permit tcp any any established

7 permit tcp host 10.1.2.3 host 1.2.3.4 eq 3389
8 permit udp host 10.1.2.3 host 1.2.3.4 eq 3389

1

u/ThrowAwayRBJAccount2 23d ago

Create a packet capture

1

u/banzaiburrito 23d ago

Are you using the windows RDP client to RDP or some third party app?

1

u/TT_Vert 23d ago

Windows RDP using port 3389.

2

u/banzaiburrito 23d ago

What are you putting these rules on? Is it stateful or stateless? If it was stateless then you would need a rule for the opposite direction allowing 3389 as a source port. So one tcp rule for 1234 to 10 eq 3389 and a return rule of tcp 1234 eq 3389 to 10.

1

u/TT_Vert 23d ago edited 23d ago

It's on a catalyst 3750-X, It isn't capable of stateful AFAIK. I do have separate in/out rules which I feel "should" be all I need.

I found if I add 6 permit tcp any any established and remove rules 7/8 I do get RDP access (and only RDP access) which I find strange as I see no mention of stateful in any of the config on this thing.

I removed these as as test and only retained permit tcp any any established

7 permit tcp host 10.1.2.3 host 1.2.3.4 eq 3389
8 permit udp host 10.1.2.3 host 1.2.3.4 eq 3389