enable remote desktop access for VM

[endimion]

Hello,
I want to allow remote desktop access to one of my VMs (running windows + all the configuration for remote desktop). In proxmox I setup firewall rules at cluster level from the PVE interface using the predefined macro RDP (with both in and out directions). Same at node level. At VM level I did not setup a firewall. All rules and firewall are enabled.
I tried to connect using windows remote desktop to this VM, but it is not working.

1. Is there something else I should configure inside proxmox to make this work? I already have a rule on the vmbr2 bridge to forward traffic to VMs:
auto vmbr2
iface vmbr2 inet static
.......
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE

2. Are the firewall rules I setup from PVE persistent, if it is to reboot the server?

 

[wolfgang]

Hi,

you should only apply this rule on VM level.

to your second Question: Yes they are persistent.

 

[endimion]

Hi,
Thank you for your reply. It is still not clear how these levels work (if you know where I can find more info, please tell me). At datacenter level I have a firewall set, with default policy to drop, so I thought I have to open access for each protocol/port. Then, following your advice, I set the RDP in/out in the VM firewall (from the PVE interface). I test the remote desktop from inside another windows VM in the same local network, and it works fine.
But what I need is to make it work from outside. All my VMs hold local IPs, and only the server hosting my VMs has a public IP. I declared the name of my windows VM to a DNS provider so that it is visible from outside. If I want to reach my VM, I use the public name which points to the public IP of my server (see picture below). It still doesn't work. Do I have to set iptables manually?

 

[wolfgang]

for an overview https://pve.proxmox.com/wiki/Proxmox_VE_Firewall

The firewall can not be used for port forwarding.
What you want to to is forwarding because you hide your machines.
this you have to do manually.