topic Re: How to change RDP's default port in General Topics

How to change RDP's default port

xiaguoxian — Fri, 30 Jun 2017 07:44:47 GMT

As you know, the RDP's default port is 3389, but someone always try to connect via this default port, this result the domain

accounts are locked frequently. so I would like to chang its default port,such as 33089, then others don't know the port,

so they can't use this port to try remote desktop access, the question is How I config in Palo Alto to achieve this target?

My device is PA-500.

thanks in advance

Re: How to change RDP's default port

reaper — Fri, 30 Jun 2017 07:59:32 GMT

you can accomplish this by creating a NAT policy to do port translation

回复： How to change RDP's default port

xiaguoxian — Fri, 30 Jun 2017 08:06:53 GMT

Thank you for your reply, but could you tell me the entire process? what is the service 7777 in your screenshot?

回复： How to change RDP's default port

reaper — Fri, 30 Jun 2017 08:16:44 GMT

in my example port 7777 is the 'original' destination port

so what this rule does is from my trust network 192.168.0.0/24 to my dms 10.0.0.0/24

the firewall takes the role of host 192.168.0.5

anyone in the trust network connecting to 192.168.0.5 from trust, on port 7777 will be translated to dmz server 10.0.0.5 on port 3389

i can create a security policy that blocks direct connections to 3389 and only allows 7777

回复： How to change RDP's default port

xiaguoxian — Fri, 30 Jun 2017 08:24:55 GMT

Ok ,my question is where I can create the "original' destination port 7777"? Thanks

回复： How to change RDP's default port

xiaguoxian — Fri, 30 Jun 2017 08:26:01 GMT

could you kindly show me the service 7777's screenshot?

回复： How to change RDP's default port

reaper — Fri, 30 Jun 2017 08:30:55 GMT

sure! you can create service objects in 'Objects > Services'

Here's an article that might be useful: Getting Started: Network Address Translation (NAT)

Re: How to change RDP's default port

Mark_Silva — Fri, 30 Jun 2017 14:29:10 GMT

You can also try to change the default port of the RDP via the registry on the server itself. 😉

Re: How to change RDP's default port

xiaguoxian — Fri, 30 Jun 2017 14:39:44 GMT

Hi,

I have tried to change the default port number 3389 to 33089 in the server in registry. and I can use remote desktop to

connect to this server by 192.168.0.5:33089 in my LAN, but I can't connect to this server's external IP address in the internet,

I mean I can't connect to 218.104.xxx.xxx:33089 in the internet, then could you tell me how should I config in the PALO ALTO?

Thanks in advance.

Re: How to change RDP's default port

BPry — Fri, 30 Jun 2017 14:47:31 GMT

@xiaguoxian,

That would depend on how your NAT and security policies are setup. Is your NAT statement an any-any bi-directional policy or do you have NAT policies specific to service? You're security policy will also need to have ms-rdp allowed on the service port that you've specified, or create a custom app-id based off of the ms-rdp signature but with the service being the 33089.

Re: How to change RDP's default port

xiaguoxian — Fri, 30 Jun 2017 14:59:30 GMT

Hi,

I have created a app-id based on ms-rdp, could you have a look at the screenshot and tell me is it right?

Re: How to change RDP's default port

reaper — Fri, 30 Jun 2017 15:45:57 GMT

you won't need the custom application as your connection is normal RDP and APP-ID will identify it as that application, even if it is not running on the default port

you will need to make sure your security policy allows the connection

Re: How to change RDP's default port

xiaguoxian — Fri, 30 Jun 2017 16:23:01 GMT

Hi,

According to your suggestion, my situation now is :

1. the server's RDP port is default port 3389

2. I create a new service on Palo Alto named KJC-RDP,please see pic1

3.In the security policy,I create a policy,please see pic 2

4.In the NAT policy, Icreate a policy,please see pic 3

Is it correct? anything else should I do?

Re: How to change RDP's default port

xiaguoxian — Sat, 01 Jul 2017 05:22:25 GMT

Hi,

With the help of two experts, I've solved this problem. Thank you so much.