HIPS 8:00 Firewall Rules Blocked RDP connection

[Mask118]

It appeared that right after I Enable Firewall Rules in HIPS , we can't RDP to our servers anymore. If we turn the Firewall rules off then it working just fine. I created Firewall rules to allow RDP in HIPS Firewall rules but that did not seem to work.  What I did was just add new rules in Firewall then at Protocol I selected " RDP" I did not really adding any specific IPs or anything like that. I am wondering if there is a specific way to create this RDP rule to make it to work? Will appreciate any inputs. Thank you !

[Pravas]

Hi @Mask118 

The default RDP port is 3389. You can create 2 HIPS rule for RDP.

1) Allow Inbound RDP

Direction - IN

Transport Protocol - TCP

Local Port - 3389

2) Allow outbound RDP

Direction - Out

Transport Protocol - TCP

Remote Port - 3389

I hope this helps.

Thanks

[Mask118]

Hello I dont think I have any options like that for port 3389 to fill in. I believe the one you mention is ENS firewall. The one that I use is HIPS firewall rules. Please see my attached of what available to me. Thank you!

[ktankink]

Hi @Mask118 Please see the KB article below for details about this.

KB74021 - Endpoint Security/Host Intrusion Prevention firewall rules differ for Reliable Data Protocol and Microsoft Remote Desktop
https://kc.mcafee.com/corporate/index?page=content&id=KB74021