topic RDP Access-List in Network Security

RDP Access-List

islam.irshaid — Mon, 11 Mar 2019 21:12:10 GMT

Dear Experts,

Just want to ask you if can i permit RDP connection to AD Server but at the same time deny all outgoing traffics from such server - if I am connected through RDP ?

Example :

AD : 192.168.0.100

Exchange : 192.168.0.200

If someone connects to AD through RDP , I need to deny him to make telnet to Exchange or make any access to LAN servers (Just if he connected through RDP)

Thanks

RDP Access-List

Jon Marshall — Tue, 16 Aug 2011 12:12:41 GMT

If you want to do that then you really need to have the AD server on a separate DMZ. Even private vlans would not help in this situation because the AD server needs to communicate with other LAN servers.

So you would need a DMZ on the firewall for the AD server or at the very least a different vlan for the AD server that you can apply an access-list to.

Having said that if you did move your AD server to a DMZ then you would have to open a fair few ports to allow it to communicate to the servers on the LAN.

It's not an easy thing to do either way.

Jon