Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 6 down vote favorite

I have a situation where I provide access to a Windows server by forwarding the remote desktop port 3389 with ssh from my Mac to the "inside" of an otherwise inacessible network.

I can now connect with the Windows version of Remote Desktop, but the Mac version of Remote Desktop time out and do not provide access. This is even when using the IP-number as the host to connect to.

Any idea why this happens and how I can work around it?

share|improve this question
This is still desirable due to changed software. Opening a bounty. – Thorbjørn Ravn Andersen Apr 12 at 8:21
Did you try with newer client, 2.1.2 ? – Buscar 웃 Apr 12 at 14:12
Not yet. I have 2.1.0. Thanks, I'll try upgrading. – Thorbjørn Ravn Andersen Apr 12 at 14:19
I've kept a virtual box with windows installed for situations like this. Sadly, I'd love to make things work natively on the Mac - but when a client can not or will not give me a proper VPN - running the OS they poke holes (or worse rely on non-standard one-off behaviors) in their firewall is far less work for me in the end. After all - I'm running RDC to see windows so it matters little that I've that OS running locally too. Since you explicitly need the Mac client, can you ssh in to a VPN connection? – bmike♦ Apr 14 at 13:11
What happens on the Mac if you simply telnet localhost:forwarded port? Does it work as expected? Sounds like there is a problem with your ssh tunnel. – user23122 Apr 17 at 14:20
show 1 more comment

7 Answers

up vote 3 down vote

Don't forward local port 3389, various versions of Remote Desktop are too smart for their own good.

My usual steps involve forwarding local 3390 to remote 3389. Then, in MacRDC I use: localhost:3390 as the address to connect too.

I don't know if you're using anything to assist in the ssh connection setup, but from the command line, it would be something like:

ssh -L 3390:172.16.5.32:3389 jason@remote.net

Where;
- 3390 is the local forwarding port on my box.
- 172.16.5.32 is the remote windows host. and;
- 3389 is the Remote Desktop Port (obviously).

share|improve this answer
I had a go at this, but unfortunately going through port 3390 didn't work either :( I tried adding the host name of the windows server to /private/etc/hosts (aliased to 127.0.0.1) to see if I could fool any "look for HOST" mechanism, but no. What Windows version is this against and what version of Remote Desktop for Mac? – Thorbjørn Ravn Andersen Feb 26 '11 at 12:58
MacRDC 2.0.1, Windows RDC it's been so long I couldn't tell you. I seem to remember it happening with stock mstsc from Windows XP and forward. – Jason Salaz♦ Feb 27 '11 at 7:07
Your original comment means that localhost:3390 in the RDC window didn't work? And you tried myhost:3390 (with myhost aliased in the 127.0.0.1 line in hosts file) as well, also to no avail? – Jason Salaz♦ Feb 28 '11 at 8:22
Also, do you get any output in your terminal window? Channel failures or anything of the sort? Any error messages external to the MacRDC app? – Jason Salaz♦ Feb 28 '11 at 8:23
I now had a look at this again, including the "myhost->localhost" hack, and it appears that it is not enough. The wheel spins in MacRDP trying to connect, but still times out. There is no messages in Console.app. I use a custom tool to port forward (no ssh access). I really wonder what it tries to do which fails. – Thorbjørn Ravn Andersen Apr 12 at 8:20
show 1 more comment
up vote 2 down vote
+250

The Windows Remote Desktop implements more authentication and encryption algorithms specific to Windows. This happened to us often, in fact we're forced to use Windows Remote Desktop by our network administrators as we're using authentication methods OSX doesn't implement. Let's cross fingers and hope Microsoft releases a match for the Windows-grade Remote Desktop asap.

share|improve this answer
Do you have any suggestions for me to look for to make MacRDP not time out? – Thorbjørn Ravn Andersen Apr 12 at 14:18
If it times out, no connection can be established at all. Either way, as Windows succeeds in the connection, my guess is authentication or encryption! :) – kenansulayman Apr 12 at 14:53
up vote 2 down vote

Did you try to disable requirement for "Network Level Authentication" from "Control Panel -> System -> Allow Remote Access" on the target machine?

Native Level Authentication

share|improve this answer
He's able to connect with a Windows RDP installation.. so, yes he did that already :) – kenansulayman Apr 13 at 11:37
1  
The version 2.1.1 has added support for NLA - see macupdate.com/app/mac/8431/microsoft-remote-desktop-connection: Verifies the identity of the Windows-based computer before establishing a Remote Desktop connection. You can select this option when you connect to a computer that is running Windows Vista or Windows 7. Network Level Authentication is more secure than authentication options in earlier versions of Windows. If you disable this requirement (we speak about the very last checkbox) he should be able to login with 2.1.0 client through SSL tunnel. – brablc Apr 13 at 13:49
Sorry, didn't see you wanted to point out the NTLM part of the shot. Maybe worth a try! – kenansulayman Apr 13 at 23:13
I'm actually not sure that NLA is related to NTLM. NLA just tries to verify credentials before bringing a login screen to the user. This eliminates one attack vector. But his Windows is behind a firewall so he does not need to consider this. – brablc Apr 14 at 0:19
up vote 2 down vote

On your mac, perhaps try out this solution:

  • install sshuttle ( implements ssh tunnel/proxy, but also implements some routing changes ) ( https://github.com/apenwarr/sshuttle.git )

  • configure sshuttle to only route for the ip address of the windows box you want to reach:

    sshuttle --dns -r YourUserName@YourSSHBox.com 1.1.1.1/32

    Replace:

    1.1.1.1/32 with the ip address of the windows host. If there are a number of hosts you need to access and they are in the same subnet, you can just change the /32 to something wider, say /24.

  • Fire up your Mac RDP client and attempt to access the IP address of the Windows machine. Perhaps can use the hostname if you are also forwarding DNS queries to the box you are using as a bridge.

This is a variation of the -D3389 method, but employs the socks proxy features of ssh.

share|improve this answer
1  
Impressive...good job. – Buscar 웃 Apr 18 at 21:57
up vote 1 down vote

Try CoRD: enter link description here

I've found it works better than the official RDP client, and tends to handle imperfect setups smoother.

share|improve this answer
I am using CoRD now, but it has a few wrinkles, and I'd rather use the official client. – Thorbjørn Ravn Andersen Apr 16 at 9:10
up vote -1 down vote

Sometimes just Updating the software solves the problem.

enter image description here

Pending your OS you should make sure to have the correct version of WRDC.

Since you have the outdated 2.1.0 you should update to one of the following. Ver. 2.1.1 from Microsoft or the latest ver. 2.1.2. from below.

http://www.cloud9realtime.com/Guides/Macintosh%20RDP%20Guide.pdf

enter image description here

If updating software does not help and if you cannot connect with the IP address, the host name, or the computer name, then it is likely that port 3389 is blocked somewhere in your WAN.

To test your ssh tunneling setup try telneting to the port on your local machine.

share|improve this answer
Please add at least the link :-) Also: Is this just a guess or have you verified that it solves the probem? – patrix♦ Apr 12 at 14:27
1  
@patrix I do not have the setup to verify, but I read about it. – Buscar 웃 Apr 12 at 14:33
THANK YOU @kenansulayman, thats it, I lost it and you found it. – Buscar 웃 Apr 12 at 14:34
1  
2.1.1 is a free download for those that want that one instead. Google will get you there, but at least for now this link shows you the available downloads: microsoft.com/en-us/download/… – Tim B Apr 12 at 20:07
show 4 more comments
up vote -2 down vote

Forwarding to port 3389 is bound to give you trouble. The system will recognize what you're trying to do and basically short circuit itself. This is the drawback of DIY Remote Desktop, imho.

share|improve this answer
1  
Then why does it work with Windows Remote Desktop but not the Mac version of Remote Desktop (from Microsoft too)? – Thorbjørn Ravn Andersen Mar 15 '11 at 22:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.