Server 2012 Firewall is blocking RDP over VPN

Question

I have a 2012 server running a VPN and I cannot connect to the server itself over RDP when I am connected through the VPN. I can connect without issue though from a machine on the local physical network. The standard RDP firewall exceptions are enabled.
If I turn off the server firewall completely, I can connect with both, so clearly it is a firewall issue, but only with the VPN connections. Turned on logging, and this is what I get. I am not sure why these are different or what adjustment needs to be made
to the firewall, as I don't want to leave the firewall off.
#Version: 1.5
#Software: Microsoft Windows Firewall
#Time Format: Local
#Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path                                                                                                                                                                                                               
2014-07-08 23:01:05 ALLOW TCP 192.168.20.100 192.168.20.125 1242 3389 0 - 0 0 0 - - - RECEIVE
2014-07-08 23:01:26 DROP TCP 192.168.20.200 192.168.20.125 39646 3389 52 S 748485790 0 8192 - - - RECEIVE
The top line is when I RDP from a local machine (20.100), the second line is an RDP from a remote machine while connected over the VPN (20.200).
Matt Kleinwaks - MSMVP MSDN Forums Moderator - www.zerosandtheone.com

Answer 1

Hi,
Make sure you have enabled all of three Remote Desktop rules in firewall:
Remote Desktop - Shadow(TCP-In)
Remote Desktop - User Mode(TCP-In)
Remote Desktop - User Mode(UDP-In)
Have you checked the detailed setting of the Remote Desktop rules in firewall? Be caution of Scope tab in the properties.
If the issue persists, please enable the auditing of windows firewall events
To enable auditing of Windows Firewall events, please follow the steps below,
Open the Group Policy Object Editor snap-in to edit the Group Policy object (GPO) that is used to manage Group Policy settings in your organization.
Open Computer Configuration, open
Windows Settings, open Security Settings, open
Local Policies, and then click Audit Policy.
Double-click Audit process tracking, select the
Success and Failure check boxes, and then click
OK.
Double-click Audit policy change, select the
Success and Failure check boxes, and then click
OK.
For detailed information, please view the link below,
Enable Auditing of Windows Firewall Events
http://technet.microsoft.com/en-us/library/cc786961(v=ws.10).aspx
Hope this helps.
Steven Lee
TechNet Community Support