Не работает RDP

[zerber]

Добрый день, настроен микротик, в правилах запретов нет, пока теститься на одном компьютере, при подключении RDP, подключается только на 3 или 4 раз. Где посмотреть настройки, что бы RDP работало нормально?

[Chupaka]

Добрый. Вы спрашиваете, где посмотреть настройки роутера? Потому что эти настройки неплохо бы знать тем, кто хочет вам помочь

В Терминале команда "/export hide-sensitive" - неплохой вариант.

[zerber]

Код: Выделить всё

# dec/14/2022 11:52:00 by RouterOS 6.49.7
# software id = 8B1W-Z7ED
#
# model = RouterBOARD 952Ui-5ac2nD
# serial number = 924E090363BD
/interface bridge
add name=Br-Loopback
add arp=proxy-arp dhcp-snooping=yes name=LAN
/interface ethernet
set [ find default-name=ether1 ] name=IS74
set [ find default-name=ether3 ] arp=proxy-arp name=LAN3
set [ find default-name=ether4 ] arp=proxy-arp name=LAN4
set [ find default-name=ether5 ] arp=proxy-arp name=LAN5
set [ find default-name=ether2 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full arp=proxy-arp \
    name=TTK
/interface pptp-server
add name=pptp-in1 user=agent_satka
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
set [ find default-name=wlan2 ] ssid=MikroTik
/interface list
add name=LOCAL
add name=INTERNET
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-server option
add code=6 name=DNS value="'192.168.3.7'"
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=md5 enc-algorithms=3des
/ip pool
add name=dhcp_pool1 ranges=192.168.1.2-192.168.1.14
add name=dhcp_pool2 ranges=192.168.2.2-192.168.2.254
add name=PPTP-VPN-Clients ranges=192.168.16.2-192.168.16.40
add name=dhcp_pool7 ranges=192.168.3.10-192.168.3.254
/ip dhcp-server
add address-pool=dhcp_pool3 disabled=no interface=LAN3 name=dhcp1
add add-arp=yes address-pool=dhcp_pool4 disabled=no interface=LAN4 name=dhcp2
add address-pool=dhcp_pool7 disabled=no interface=LAN5 name=dhcp4
/ppp profile
add change-tcp-mss=yes local-address=192.168.16.1 name=PPTP-GENERAL-PROFILE \
    only-one=no remote-address=192.168.16.40 use-compression=yes \
    use-encryption=yes use-mpls=no use-upnp=no
/interface pptp-client
add connect-to=192.168.3.6 disabled=no name=pptp-out1 password=111111 \
    profile=PPTP-GENERAL-PROFILE user=MT-User
/ip neighbor discovery-settings
set discover-interface-list=all
/interface l2tp-server server
set authentication=mschap2 default-profile=default
/interface list member
add interface=LAN3 list=LOCAL
add interface=LAN4 list=LOCAL
add interface=LAN5 list=LOCAL
add interface=IS74 list=INTERNET
add interface=TTK list=INTERNET
/interface pppoe-server server
add disabled=no interface=<l2tp> service-name=service1
/interface pptp-server server
set default-profile=PPTP-GENERAL-PROFILE enabled=yes
/ip address
add address=1.11.1.1 interface=WAN1 network=1.11.1.2
add address=192.168.1.1/28 interface=LAN3 network=192.168.1.0
add address=192.168.2.1/24 interface=LAN4 network=192.168.2.0
add address=192.168.3.1/24 interface=LAN5 network=192.168.3.0
add address=2.22.2.2 interface=WAN2 network=2.22.2.3
add address=10.10.10.1/16 interface=pptp-in1 network=10.10.0.0
add address=192.168.16.1/26 interface=pptp-in1 network=192.168.16.0
/ip arp
add address=192.168.3.253 interface=LAN5 mac-address=B4:2E:99:BC:89:9C
add address=192.168.3.49 interface=LAN5 mac-address=BC:EE:7B:9D:B3:60
add address=192.168.3.5 interface=LAN5 mac-address=D4:3D:7E:FD:69:1F
add address=192.168.3.6 interface=LAN5 mac-address=6C:F0:49:77:EB:E9
/ip dhcp-client
add disabled=no interface=WAN2 use-peer-dns=no
/ip dhcp-server network
add address=192.168.1.0/28 dns-server=192.168.1.1 domain=main.main.ru \
    gateway=192.168.1.1
add address=192.168.2.0/24 gateway=192.168.2.1
add address=192.168.3.0/24 dns-server=192.168.3.5,192.168.3.7 gateway=\
    192.168.3.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.3.0/24 list=winbox_remote
add address=1.11.1.1 list=INTERNET
add address=2.22.2.2 list=INTERNET
/ip firewall filter
add action=accept chain=forward dst-port=5222,5223 protocol=tcp
add action=accept chain=input comment=VPN connection-state=new protocol=gre \
    src-address=192.168.16.0/27
add action=accept chain=forward dst-port=3389 protocol=tcp
add action=accept chain=input connection-state=new dst-port=1723 protocol=tcp \
    src-address=192.168.16.0/27
add action=accept chain=input dst-port=47 protocol=tcp
add action=accept chain=input comment="accept established,related,untracked" \
    connection-state=established,related
add action=accept chain=forward dst-address=2.22.2.2 dst-port=445 \
    protocol=tcp
add action=accept chain=input comment=PPTP dst-address=2.22.2.2 \
    dst-port=47 in-interface=WAN2 protocol=tcp
add action=accept chain=forward connection-nat-state="" connection-state=\
    established,related,new log=yes log-prefix=forward
add action=accept chain=input connection-state=established,related,new
add action=accept chain=forward in-interface=all-ppp protocol=tcp
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established disabled=yes
add action=accept chain=forward comment=\
    "accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="Layer 7 protocols" disabled=yes \
    layer7-protocol=lo.uralreg.ru src-address-list=""
add action=accept chain=forward dst-address=2.22.2.2 in-interface=WAN2 \
    src-address=192.168.1.4
add action=accept chain=input dst-address=192.168.3.251 dst-port=5222,5223 \
    protocol=tcp
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes
add action=accept chain=forward comment="accept http & https from LAN" \
    dst-port=80,443 in-interface=LAN3 out-interface=WAN1 protocol=tcp
add action=accept chain=input comment="ALLOW DNS (TCP) inbound" dst-address=\
    2.22.2.2 dst-port=53,80,443,110 protocol=tcp
add action=accept chain=input comment="ALLOW DNS (UDP) inbound" dst-address=\
    2.22.2.2 dst-port=53,80,443,110 protocol=udp
add action=accept chain=forward connection-state=established,related \
    in-interface=LAN3 out-interface=LAN4
add action=accept chain=forward connection-state=established,related \
    in-interface=LAN4 out-interface=LAN5
add action=accept chain=forward connection-state=established,related \
    dst-address=192.168.1.0/29 in-interface=LAN4 out-interface=LAN3 \
    src-address=192.168.2.0/24
add action=accept chain=forward connection-state=established,related \
    dst-address=192.168.3.0/24 in-interface=LAN3 out-interface=LAN5 \
    src-address=192.168.1.0/29
add action=accept chain=forward connection-state=established,related \
    in-interface=LAN5 out-interface=LAN4
add action=accept chain=forward connection-state=established,related \
    dst-address=192.168.1.0/29 in-interface=LAN5 out-interface=LAN3 \
    src-address=192.168.3.0/24
add action=accept chain=input comment=L2TP dst-port=1701 ipsec-policy=\
    in,ipsec protocol=udp
add action=accept chain=input comment=DNS dst-port=53 in-interface-list=\
    !INTERNET protocol=udp
add action=accept chain=input comment=NTP,DNS,DHCP dst-port=53,123,67-68 \
    protocol=udp
add action=accept chain=inputO comment=DHCP dst-port=67-68 protocol=udp
add action=accept chain=input dst-address=2.22.2.2 src-address=\
    192.168.3.253
add action=accept chain=input dst-address=192.168.1.4 in-interface=LAN \
    src-address=192.168.1.38
add action=accept chain=input src-address=192.168.1.4
add action=accept chain=input src-address=192.168.1.11
add action=accept chain=input src-address=192.168.1.9
add action=accept chain=input dst-address=2.22.2.2 protocol=tcp \
    src-address=192.168.3.136
add action=accept chain=input dst-address=2.22.2.2 protocol=tcp \
    src-address=192.168.3.136
add action=accept chain=input dst-address=2.22.2.2 dst-port=3333 \
    protocol=tcp src-address=192.168.3.0/24
add action=accept chain=input dst-address2.22.2.2 dst-port=22 protocol=\
    tcp src-address=192.168.3.13
add action=accept chain=input dst-address=2.22.2.2 dst-port=22 protocol=\
    tcp src-address=192.168.3.253
add action=accept chain=input dst-address=2.22.2.2 dst-port=22 protocol=\
    tcp src-address=192.168.3.105
add action=accept chain=input dst-address=2.22.2.2 dst-port=3052 \
    protocol=udp src-address=192.168.3.249
add action=accept chain=input dst-address=2.22.2.2 src-address=\
    192.168.1.38
add action=accept chain=input dst-address=2.22.2.2 dst-port=53 protocol=\
    udp src-address=192.168.1.38
add action=accept chain=input dst-address=2.22.2.2 protocol=tcp \
    src-address=192.168.3.251
add action=accept chain=input comment=DNS dst-address=2.22.2.2 dst-port=\
    53 protocol=udp src-address=10.100.0.0/16
add action=accept chain=input comment=DNS dst-address=2.22.2.2 dst-port=\
    53 protocol=udp
add action=accept chain=input comment=WEB dst-address=2.22.2.2 dst-port=\
    80 protocol=tcp
add action=add-src-to-address-list address-list=ssh_blacklist \
    address-list-timeout=3h chain=input connection-state=new dst-port=22 \
    protocol=tcp src-address-list=ssh_stage3
add action=accept chain=input comment="Allow access from local network" \
    src-address=192.168.0.0/24
add action=accept chain=input comment=Energoaudit dst-address=2.22.2.2 \
    dst-port=2041,2042 protocol=tcp src-address=192.168.3.27
add action=accept chain=input dst-address=2.22.2.2 dst-port=5938 \
    protocol=udp
add action=accept chain=input comment=botnet_search dst-address=2.22.2.2 \
    protocol=tcp src-address=192.168.3.0/24
add action=accept chain=input dst-address=2.22.2.2 src-address=\
    192.168.3.61
add action=accept chain=input dst-address=2.22.2.2 dst-port=22 protocol=\
    tcp src-address=192.168.3.253
add action=accept chain=input dst-address=2.22.2.2 dst-port=22 protocol=\
    tcp src-address=192.168.3.105
add action=accept chain=input dst-address=192.168.1.4 protocol=tcp \
    src-address=192.168.3.8
add action=accept chain=input dst-address=192.168.1.4 protocol=udp \
    src-address=192.168.3.8
add action=accept chain=forward dst-address=192.168.3.0/24 src-address=\
    192.168.1.9
add action=accept chain=forward dst-address=192.168.1.9 src-address=\
    192.168.3.0/24
add action=accept chain=forward dst-address=192.168.2.0/24 src-address=\
    192.168.1.9
add action=accept chain=forward comment="Access buh to Antivirus server" \
    dst-address=192.168.3.9 src-address=192.168.2.0/27
add action=accept chain=input comment="ALLOW DNS (TCP) inbound" dst-address=\
    192.168.3.6 dst-port=53 protocol=tcp
add action=accept chain=input comment="ALLOW HTTP,HTTPS inbound" dst-address=\
    192.168.3.6 dst-address-type="" dst-port=80,443 protocol=tcp
add action=jump chain=forward in-interface=LAN3 jump-target=forward-from \
    src-address=192.168.1.0/28
add action=jump chain=forward-from dst-address=192.168.1.0/28 in-interface=\
    LAN3 jump-target=forward-from-rules
add action=jump chain=forward-from dst-address=192.168.3.0/24 in-interface=\
    LAN5 jump-target=forward-from-rules
add action=jump chain=forward-from dst-address=192.168.2.0/24 in-interface=\
    LAN4 jump-target=forward-from-rules
add action=jump chain=forward in-interface=LAN5 jump-target=forward-from \
    src-address=192.168.3.0/24
add action=jump chain=forward in-interface=LAN4 jump-target=forward-from \
    src-address=192.168.2.0/24
add action=drop chain=input dst-port=53 in-interface-list=INTERNET protocol=\
    udp
add action=drop chain=forward comment="drop all from WAN to LAN" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=\
    INTERNET
add action=drop chain=input comment="Drop SSH brutforce" dst-port=22 \
    protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=input dst-address=2.22.2.2 protocol=tcp \
    src-address=192.168.3.0/24 src-port=2041,2042
add action=drop chain=input dst-address=2.22.2.2 protocol=tcp \
    src-address=192.168.2.0/24 src-port=2041,2042
add action=accept chain=forward dst-port=2121 protocol=tcp
add action=add-src-to-address-list address-list="dns flood" \
    address-list-timeout=1h chain=input dst-port=53 in-interface=TTK \
    protocol=udp
add action=drop chain=input dst-port=53 in-interface=WAN2 protocol=udp \
    src-address-list="dns flood"
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=main passthrough=\
    yes src-address=192.168.3.2-192.168.3.254
add action=passthrough chain=prerouting src-address=192.168.2.2-192.168.2.254
add action=mark-connection chain=prerouting connection-mark=WAN2 \
    new-connection-mark=WAN2 passthrough=no
add action=mark-connection chain=prerouting connection-mark=WAN1 \
    new-connection-mark=WAN1 passthrough=no
add action=mark-routing chain=output connection-mark=WAN2 new-routing-mark=\
    to_WAN2 passthrough=no
add action=mark-routing chain=output connection-mark=WAN1new-routing-mark=\
    to_WAN1 passthrough=no
add action=mark-packet chain=prerouting comment="NAT Loopback detect" \
    connection-state=new dst-address=1.11.1.1 dst-address-list="" \
    in-interface-list=LOCAL new-packet-mark=nat-loopback passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=TTK new-connection-mark=WAN2 passthrough=yes
/ip firewall nat
add action=dst-nat chain=dstnat comment=USER1 dst-port=15555 \
    in-interface-list=INTERNET log=yes log-prefix=15555 protocol=tcp \
    to-addresses=192.168.3.13 to-ports=3389
add action=masquerade chain=srcnat out-interface-list=INTERNET
add action=masquerade chain=srcnat dst-address=2.22.2.2 dst-port=5222 \
    out-interface-list=INTERNET protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat dst-address=2.22.2.2 dst-port=5222 \
    out-interface-list=LOCAL protocol=tcp src-address=192.168.2.0/24
add action=masquerade chain=srcnat comment="NAT Loopback replace address" \
    packet-mark=nat-loopback
add action=accept chain=srcnat dst-address=192.168.3.0/24 src-address=\
    192.168.1.0/24
add action=masquerade chain=srcnat dst-address=!192.168.3.0/24 src-address=\
    192.168.1.0/24
add action=accept chain=srcnat dst-address=192.168.3.6 out-interface=all-ppp \
    src-address=192.168.16.0/27
add action=accept chain=srcnat dst-address=192.168.3.5 out-interface=all-ppp \
    src-address=192.168.16.0/27
add action=masquerade chain=srcnat dst-address=192.168.3.0/24 out-interface=\
    all-ppp src-address=192.168.16.0/27
add action=accept chain=srcnat dst-address=192.168.16.0/27 out-interface=\
    all-ppp src-address=192.168.3.0/24
add action=masquerade chain=srcnat dst-address=!192.168.16.0/27 \
    out-interface=Br-Loopback src-address=192.168.3.0/24
add action=src-nat chain=srcnat out-interface=all-ppp to-addresses=\
    192.168.3.6
add action=masquerade chain=srcnat src-address=192.168.16.0/27
add action=masquerade chain=srcnat out-interface-list=LOCAL src-address=\
    192.168.1.0/29
add action=masquerade chain=srcnat out-interface-list=LOCAL src-address=\
    192.168.3.0/24
add action=masquerade chain=srcnat comment="VPN masq" out-interface=all-ppp
add action=masquerade chain=srcnat dst-address=192.168.1.4 dst-port=80 \
    out-interface-list=LOCAL protocol=tcp src-address=192.168.3.0/24
add action=masquerade chain=srcnat dst-address=192.168.1.4 dst-port=80 \
    out-interface-list=LOCAL protocol=tcp src-address=192.168.3.0/24
add action=masquerade chain=srcnat dst-address=192.168.1.4 dst-port=80 \
    out-interface-list=LOCAL protocol=tcp src-address=192.168.2.0/24
add action=src-nat chain=srcnat dst-address=2.22.2.2 dst-port=80,22 \
    protocol=tcp to-addresses=192.168.1.1
add action=dst-nat chain=dstnat dst-port=25,80,443 in-interface-list=INTERNET \
    protocol=tcp to-addresses=192.168.1.4
add action=dst-nat chain=dstnat dst-port=25,80,443 in-interface-list=INTERNET \
    protocol=tcp to-addresses=192.168.1.4
add action=dst-nat chain=dstnat comment=main.ru dst-port=80 \
    in-interface-list=INTERNET protocol=tcp to-addresses=192.168.1.4 \
    to-ports=80
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=src-nat chain=srcnat out-interface=WAN2 routing-table=main \
    to-addresses=2.22.2.2
add action=dst-nat chain=dstnat comment="DNS: main.ru" dst-port=53 \
    in-interface-list=INTERNET protocol=tcp to-addresses=192.168.3.6 \
    to-ports=53
add action=src-nat chain=srcnat comment="NAT From" src-address=192.168.3.0/24 \
    to-addresses=2.22.2.2
add action=dst-nat chain=dstnat comment="NAT To" dst-address=2.22.2.2 \
    to-addresses=192.168.1.0/29
add action=src-nat chain=srcnat comment="NAT From" src-address=192.168.1.0/24 \
    to-addresses=2.22.2.2
add action=accept chain=dstnat in-interface-list=INTERNET
add action=accept chain=dstnat
add action=accept chain=input comment=------DNS------ in-interface-list=\
    INTERNET protocol=udp src-port=53
add action=accept chain=input in-interface-list=INTERNET
add action=dst-nat chain=dstnat comment=JABBER_Filial dst-port=5222 \
    in-interface-list=INTERNET protocol=tcp to-addresses=192.168.3.251 \
    to-ports=5222
add action=dst-nat chain=dstnat comment=Spark dst-port=5222,5223 \
    in-interface-list=INTERNET protocol=tcp src-port="" to-addresses=\
    192.168.3.251 to-ports=5222-5223
add action=dst-nat chain=dstnat comment=Zabbix dst-port=10050 \
    in-interface-list=INTERNET protocol=tcp src-port=10050 to-addresses=\
    192.168.1.9
add action=dst-nat chain=dstnat comment=192.168.1.4 dst-port=10050 \
    in-interface-list=INTERNET protocol=tcp src-port=10050 to-addresses=\
    192.168.1.4
add action=dst-nat chain=dstnat comment="RDP Filial" dst-port=2122 \
    in-interface-list=INTERNET protocol=tcp src-address=188.43.0.0/16 \
    src-port="" to-addresses=192.168.3.6 to-ports=3389
add action=dst-nat chain=dstnat comment=TCP dst-port=110 in-interface-list=\
    INTERNET protocol=tcp src-port="" to-addresses=192.168.1.1 to-ports=110
add action=dst-nat chain=dstnat comment="Transmission at 65534" dst-address=\
    2.22.2.2 dst-port=65534 protocol=tcp to-addresses=192.168.1.1
add action=accept chain=input comment="--------------------\E4\EE\F1\F2\F3\EF\
    \EA \EC\E8\EA\F0\EE\F2\E8\EA\F3 \E8\E7 \E2\ED\E5--------------------------\
    -----" dst-port=80,3987,8291 protocol=tcp
add action=accept chain=input dst-port=3987 protocol=tcp
add action=accept chain=input dst-port=8291 protocol=tcp
add action=dst-nat chain=dstnat comment=VPN dst-port=47,1723 \
    in-interface-list=INTERNET protocol=tcp to-addresses=192.168.3.6 \
    to-ports=47-1723
add action=dst-nat chain=dstnat comment=VPN dst-port=500,4500,1701 \
    in-interface-list=INTERNET protocol=tcp to-addresses=192.168.3.6 \
    to-ports=500-4501
add action=dst-nat chain=dstnat comment="RDP Filial" dst-port=2122 \
    in-interface-list=INTERNET protocol=tcp src-address=188.43.0.0/16 \
    to-addresses=192.168.3.6 to-ports=3389
add action=src-nat chain=srcnat dst-address=2.22.2.2 dst-port=22 \
    protocol=tcp to-addresses=192.168.1.1 to-ports=22
add action=dst-nat chain=dstnat dst-address=1.11.1.1 dst-port=5222 \
    protocol=tcp to-addresses=2.22.2.2
add action=src-nat chain=srcnat dst-address=1.11.1.1 dst-port=5222 \
    protocol=tcp to-addresses=2.22.2.2 to-ports=5222
/ip firewall raw
add action=drop chain=prerouting comment="drop brute forcers" disabled=yes \
    src-address-list=blacklist
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp ports=40,1723
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip route
add distance=1 gateway=1.11.1.1
add distance=1 gateway=2.22.2.2
add distance=1 gateway=192.168.16.10 pref-src=192.168.3.1
add distance=1 gateway=pptp-in1
add disabled=yes distance=254 gateway=Br-Loopback
add distance=1 dst-address=192.168.1.0/24 gateway=192.168.16.1 pref-src=\
    192.168.3.1
add distance=1 dst-address=192.168.2.0/24 gateway=pptp-in1
add distance=1 dst-address=192.168.3.0/24 gateway=*F00007
add distance=1 dst-address=192.168.3.5/32 gateway=*F00007
add distance=1 dst-address=192.168.3.6/32 gateway=*F00007
add distance=1 dst-address=192.168.3.95/32 gateway=*F00007
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.3.0/24,192.168.2.0/24,192.168.1.0/29 port=8080
set ssh address="192.168.3.13/32,192.168.3.253/32,192.168.3.105/32,192.168.1.0\
    /24,192.168.2.0/24"
set www-ssl disabled=no
set api disabled=yes
set winbox address=192.168.2.0/24,192.168.3.0/24,192.168.1.0/24
set api-ssl disabled=yes
/routing ospf interface
add interface=pptp-in1
/routing ospf network
add area=backbone network=192.168.16.0/27
/tool mac-server
set allowed-interface-list=LOCAL
/tool mac-server mac-winbox
set allowed-interface-list=LOCAL

[zerber]

Вот какое сообщение в логах:
15556 dstnat: in:WAN1 out:(unknown 0), src-mac 02:09:c0:5e:e1:f4, proto TCP (SYN), 193.1.6.6:9482->1.11.1.1:15556, len 60

[Chupaka]

Ну, вроде выглядит всё более-менее адекватно: в filter forward порт RDP разрешён, правила DST-NAT без ограничений (только по Src IP?).

Вы подключаетесь к внешнему адресу WAN1 из Интернета - и первые соединения не проходят? Ошибку какую-нибудь показывает? Таймаут большой?

[zerber]

ошибок нет, таймаут секунд 20, потом, сбрасываешь подключение, пробуешь опять и подключение срабатывает

[zerber]

хотя ошибка при подключение вот такая:
Error code: 0*104

[zerber]

и подключаюсь к внешнему ip с инета

[Chupaka]

Попробуйте, может, Telnet'ом подключаться сначала для диагностики?

Ещё попробуйте открыть порт 3389 по UDP, если версии операционок позволяют.

[zerber]

Попробуйте, может, Telnet'ом подключаться сначала для диагностики?

Ещё попробуйте открыть порт 3389 по UDP, если версии операционок позволяют.

Telnetom попробовать с компа который подключается из вне, или с микрота попробовать?

[zerber]

я тестирую подключение с мобильника по remote desktop

[Chupaka]

Телнетом с компьютера. Мобильник с мобильного интернета или с какого-нибудь вайфая? А то может и в мобильном операторе быть причина.

[zerber]

Телнетом с компьютера. Мобильник с мобильного интернета или с какого-нибудь вайфая? А то может и в мобильном операторе быть причина.

Telnetom соединение проходит нормально, при подключении по RDP некоторые запросы имеют длинный ответ, больше 1000 милсек это странновато.

[zerber]

Может просто подключить новый микротик только для RDP? или есть какие то предположения что у меня настроено не так?

[Chupaka]

Хм... А попробуйте уменьшить MSS для этих запросов:

Код: Выделить всё

/ip firewall mangle add chain=prerouting in-interface-list=INTERNET protocol=tcp tcp-flags=syn \
    tcp-mss=1301-65535 action=change-mss new-mss=1300 place-before=0 passthrough=yes

[zerber]

tcp mss change works only on tcp syn packets(6)
ошибка при сохранении правила

[Chupaka]

"protocol=tcp tcp-flags=syn" - но ведь это же и есть "tcp syn packets"... Вы прямо так и вставляете команду в Терминал?..

[zerber]

правило прописал, RDP так же подключается с 3 или 4 раза или вообще не подключается

[Chupaka]

Ну, можно, конечно, использовать тяжёлую артиллерию и запустить Tools -> Packet Sniffer, а потом изучить, что там и куда ходит, через Wireshark... У меня больше идей нет