Access Terminal Server Farm behind firewall WITHOUT RD GATEWAY!!!

In my last post I showed how easy it is to setup an RDS (terminal services) Farm.  You also will find out just how well it works... on your internal network.  The problem I quickly discovered is what seemingly almost every other person discovered when they setup a RDS Farm... accessing it from outside is not as simple as using an RDP client and logging into one of the terminal servers.  The behavior you will get is that it may or may not connect you.  When it does connect you to a RDS server it connects you exactly to the one you specified and other times it will not connect you.  This may lead you to believe that the Broker is not doing its job, but in fact it is.  If you look at the log files for the broker sessions on the Broker server at: EventViewer > Applications and Services Logs > Microsoft > TerminalServices-RemoteConnectionManager > Operational > TerminaServices-SessionBroker you will see that the broker is indeed doing its job and passing you to the RDS server it believes is less utilized based on load and connections.

Great... so you know its not the broker so what is it?  Well... you are outside the network and your Broker as well as your RDS servers are all addressed for your internal network.  Quick logic tells you to simply create a NAT rule on your firewall for all your RDS servers.  Unfortunately that won't work because your Broker is still telling your RDP client to go to another server whose IP address is  on your internal network.  When you are outside your network your RDP client is not going to find that internal network.

I cannot tell you how many things I have tried based on logic and what other users posted in forums.  The one trend you will see with 98% of the answers to solve this problem is to use the RD Gateway.  I agree that is the best solution especially because its more secure.  I would even suggest to anyone to do this.  However, on the network I work on we have over 20,000 devices on our network and a lot of them are Mac OS X devices.  The Microsoft RDP client for Mac OS X does not work with TS Gateway.  I know there are other RDP clients out there for the Mac OS that do work with TS Gateways but the good ones cost some coin so we wanted to avoid that if possible.

So here we go... To make your RDS Farm work for users outside your network you need to configure a NAT rule for each terminal server on your firewall.  They have to be separate outside IP's that you own and can put in your firewall and NAT'd to the internal IP of an RDS server.  So these will be a one-to-one NAT not a one-to-many... if you do a one-to-many you will basically create a loop for your broker.

Next, on each RDS server add a second NIC. (Easy for me because I run all VM's on VMware).  For our environment we created a new Vlan for these NIC's to be sure they did not talk to the firewall and have ARP freak out over a conflicted IP address because of those NAT rules we just created.  Address each of the second NIC's with the outside IP address that corresponds to the NAT rule you created.  (i.e. Use the outside IP from the rule for TS01's because thats NAT'd to the internal IP of the same hostname).

Next be sure to go into each RDS servers and add that second address and NIC to be used in the Farm.  Open up Server Manager and go to: Roles > Remote Desktop Services > RD Session Host Configuration: SERVERNAME.  Under the "edit settings" section open up "Member of farm in RD Connection Broker".  The window where it says "Select IP Addresses to be used for reconnection" you should now see that second network adapter with that outside IP you gave it.  Select it and "OK" your way out.  Be sure to do this on each RDS server only.  YOU DON'T NEED TO DO THIS STEP ON THE BROKER!!!

Thats it!  Now your RDS servers are sending the login requests to your broker with each of its IP addresses,  and in turn your broker will send the RDP client your connecting from two IP addresses for the RDS server in the farm it wants you to connect to, the internal IP and the external IP!

See the diagram below for the visual representation.

I will note that the IP's in the diagram are not my own but used for the purposes of visualizing the solution.

Some notes:

- You do not need to add any additional DNS entries to your internal DNS servers for the RDS servers or farm name that contain the outside IP addresses.

- For us we made the Vlan the second nics are connected to a "dead" Vlan.  Meaning nothing routes or from it.  We had to do this so that all the ESXi hosts on our network could Vmotion the RDS server VM's to each other and have them still communicate on those second NICs.

- Nothing on the firewall is routed to those second NICs, nor should there be.  You don't want a direct connection to the second NIC of your RDS servers from outside if you can help it.  (I read a post where someone solved this problem by doing just that).  That's why we NAT the outside IP to the internal IP of each server.

- Don't believe any post that talks about using a Microsoft Loop Back adapter on the RDS servers... it does not work.

- Don't even begin to think you can simply edit the local "hosts" file on these servers to accomplish this task.  It won't work.

There you go.  This was a 3 day long, brain-bending problem for me.  In the end it was one of the most gratifying solutions I have done in IT!

Cheers!