跨双防火墙配置嵌套Remote Desktop连接的技术求助

Hey there! Let's work through your nested RDP setup issue step by step—no fancy networking jargon needed, promise.

First, let's clear up why your two-default-gateway approach isn't working: A Windows (or most OS) machine can only use one default gateway at a time. When you set two, the OS will prioritize one and ignore the other, which is why you can only get one side of the connection working. The fix here is using static routes instead of multiple default gateways.

Here's exactly what you need to do:

Step 1: Map out your Buffer PC's network interfaces #

First, note down two key pieces of info for your Buffer PC:

• The external-facing NIC: This is the one connected to the external network (the one you want to RDP into from outside). It should have an IP address and a default gateway pointing to your external firewall/router.
• The internal-facing NIC: This is the one connected to the Target PC's network. It should have an IP address on the same subnet as the Target PC (or a subnet that can reach it), but do NOT set a default gateway here.

Step 2: Set a single default gateway #

On the Buffer PC, only set the default gateway for the external-facing NIC. This tells the machine: "All traffic that doesn't have a specific route should go out to the external network"—which lets you RDP into the Buffer PC from outside.

Step 3: Add a static route for the Target PC's network #

You need to tell the Buffer PC: "Any traffic going to the Target PC's subnet should use the internal NIC instead of the default gateway." To do this:

1. Open Command Prompt as Administrator on the Buffer PC.
2. Run this command (replace the placeholders with your actual network details):

   route add -p [TargetPC_Subnet] mask [Subnet_Mask] [Internal_Network_Gateway]
   

   • Example: If your Target PC is on the 192.168.5.0/24 subnet, the internal network gateway is 192.168.5.1, the command becomes:

     route add -p 192.168.5.0 mask 255.255.255.0 192.168.5.1
     

   • The -p flag makes the route permanent (it won't disappear when you restart the Buffer PC).

Step 4: Verify firewall rules #

Don't forget to check firewalls at every level:

• External firewall: Make sure it allows incoming RDP traffic (port 3389) to the Buffer PC's external IP address.
• Internal firewall (if exists): Allow incoming RDP traffic from the Buffer PC's internal IP to the Target PC's IP.
• Buffer PC local firewall: Enable inbound RDP (for external connections) and outbound RDP (to connect to Target PC).
• Target PC local firewall: Enable inbound RDP from the Buffer PC's internal IP.

Step 5: Test the connection #

1. First, test connecting to the Buffer PC from the external network—this should work if the default gateway and external firewall are set correctly.
2. Once you're logged into the Buffer PC, ping the Target PC. If the ping succeeds, your static route is working.
3. Finally, launch Remote Desktop Connection on the Buffer PC and connect to the Target PC's IP—this should now go through the internal NIC as intended.

If you run into issues, double-check the static route command (make sure the subnet and mask match your Target network) and verify all firewall rules are allowing RDP traffic.

备注：内容来源于stack exchange，提问作者CKP