RDP fails over NAT -Known issue (KB3002657)

This is the scenario, there are two remote desktop servers both on the same static IP.To distinguish them I was given a different external port NATed to the corresponding internal server IPs.To make it more clear:

RDS1----> 10.10.10.1:3389 (internal) <--NAT--> ***.***.**.34:3389

RDS2----> 10.10.10.3:3389 (internal) <--NAT--> ***.***.**.34:3389

That was given by my ISP.I have no control over the external IPs or the router.

Now when dialing RDS1 & RDS 2  either by IP or Socket, locally or remotely,  all is good.

RDP IS NOT WORKING WHEN DIALLING OVER NAT  

####################

Resolution

We have removed the patch – KB3002657 and it’s resolved the issue (known issue)

Updated version of “KB3002657”.

The 32 bit version is at: http://www.microsoft.com/en-us/download/details.aspx?id=46147

The ia64 version is at: http://www.microsoft.com/en-us/download/details.aspx?id=46204

and amd64 is at: http://www.microsoft.com/en-us/download/details.aspx?id=46054

For the first couple days after March's Patch Tuesday, things were pretty quiet. For some this tends to indicate that Microsoft could have been moderately successful in delivering updates without problems for the first time in years. But, the first couple days have now become test and patch for companies with policies and procedures in place and patch and pray for the others.

Microsoft spent much of its March collateral fixing up old issues. Things like fuzzy fonts, VPN problems, Excel forms controls issues, and an evolved Stuxnet were addressed. But, amid the fixes, a couple new problems were introduced. The first is a reboot loop caused by KB3033929 that affects only some customers with specific configurations.

Over the weekend, we've learned about a new issue of which you need to be aware.

KB3002657, which addresses a NETLOGON vulnerability, is causing connection issues for customers still running Windows Server 2003 and using NTLM for authentication.

A post by Jason Sherry, MVP and Microsoft Infrastructure Architect and Professional Services Consultant, details the issues that he's discovered. Some of the applications and services affected by this update are: SMB/SMB2/SMB3, IIS, SharePoint, Exchange, SQL, and AD authentication for Windows 2003 domain controllers.

Here's the specific Security Bulletin associated with this issue:

MS15-027

Vulnerability in NETLOGON Could Allow Spoofing (3002657)

Some additional references and reports: