{"id":40,"date":"2010-06-27T11:51:15","date_gmt":"2010-06-27T15:51:15","guid":{"rendered":"http:\/\/www.amixa.com\/blog\/?p=40"},"modified":"2010-06-27T11:55:04","modified_gmt":"2010-06-27T15:55:04","slug":"ts-gateway-the-poor-mans-gotomypc","status":"publish","type":"post","link":"https:\/\/www.amixa.com\/blog\/2010\/06\/27\/ts-gateway-the-poor-mans-gotomypc\/","title":{"rendered":"TS Gateway &#8211; the poor man&#8217;s GotoMyPC"},"content":{"rendered":"<p>Want to connect into your business network, but don&#8217;t want to spend the $$$ paying for multiple GoToMyPC accounts?\u00a0 Well, if you have control over your firewall, a static IP, Windows Server 2008 or later on your business server, and enough technical expertise, you can likely use Terminal Services Gateway service (TS Gateway)\u00a0to connect into your computer (or any modern Windows OS computer on your LAN), for free!<\/p>\n<ol>\n<li>Start by reading <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc771530(WS.10).aspx\" target=\"_blank\">the official Microsoft TS Gateway step-by-step guide<\/a>.\u00a0 Be aware even for me, a tech geek, that contains\u00a0a pretty heavy duty dose of tech-babble.<\/li>\n<li>Configure your Windows 2008 server <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc754252(WS.10).aspx#BKMK_StepsConfigureTSGateway\" target=\"_blank\">by reading these directions<\/a><\/li>\n<li>Configure each remote client (like your laptop) <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc754252(WS.10).aspx#BKMK_ConfigureBasicClient_TSGateway\" target=\"_blank\">by reading this<\/a><\/li>\n<\/ol>\n<p>Rather than re-hash all the above content, I will point out a few areas in which you may experience problems configuring\u00a0 TS Gateway.<\/p>\n<ul>\n<li>Configure a DNS record for your domain and point it at the office IP address, such as <span style=\"color: #ff0000;\">tsgateway.yourdomain.com<\/span> point to your office IP.\u00a0 If you don&#8217;t know your office IP, look at your firewall.\u00a0 You will need a static IP or the capability to use a Dynamic IP address tracking service. <em>If you don&#8217;t know what I am talking about already, this is not for you- use GoToMyPC!<\/em><\/li>\n<li>While setting up the server, just create a &#8220;self signed&#8221; SSL certificate, and make sure you use the domain name you configured above to generate the self signed SSL, such as <span style=\"color: #ff0000;\">tsgateway.yourdomain.com<\/span>\n<ul>\n<li>You will need to<span style=\"text-decoration: underline;\"> install this self-signed SSL into BOTH the server and client<\/span>\u00a0Trusted Root Certification Authorities store (the above links detail this process).<\/li>\n<\/ul>\n<\/li>\n<li>After the TS Gateway setup is complete, go check the IIS server BINDINGS for your default site and make sure the SSL certificate from above is properly installed onto your site.<\/li>\n<li>These self-signed SSL certs expire after 6 months, so every 6 months you&#8217;ll need to generate a new one using the TS Gateway manager, or you can obtain a low cost SSL from GoDaddy or somewhere else that you can use as well.\u00a0My advice is to just use the free self-signed ones.\u00a0 If you are using self-signed ones just setup an Outlook recurring calendar event to remind you a week before each 6 month period.<\/li>\n<li>Firewall configuration.\u00a0 This is the most important part of the whole setup.\u00a0 If the traffic can&#8217;t even get into your network, none of the above will work.\n<ul>\n<li>In general this is a two part process.\n<ul>\n<li>First, configure your NAT mappings, to map inbound port 443 TCP\u00a0to your internal server IP address.<\/li>\n<li>Second, add a rule to permit HTTPS traffic from anywhere to your internal server IP and HTTPS port 443<\/li>\n<\/ul>\n<\/li>\n<li>If you have properly configured your firewall, and imported in both the client and server SSL cert, go to an outside connection with your laptop (like a coffee shop) and go to <a href=\"https:\/\/tsgateway.yourdomain.com\">https:\/\/tsgateway.yourdomain.com<\/a> and see if you get the IIS 7.0 server multi-language single page splash screen.\u00a0 If yes, then your TS Gateway setup is one step closer to working.<\/li>\n<\/ul>\n<\/li>\n<li>Enable all logging via the AUDITING tab.\u00a0 These events will log to the Event Viewer in the area below.\u00a0 This is extemely handy for troubleshooting things.\n<ul>\n<li><a href=\"http:\/\/www.amixa.com\/blog\/wp-content\/uploads\/2010\/06\/6-27-2010-11-40-05-AM.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-41\" title=\"TS Gateway event logs\" src=\"http:\/\/www.amixa.com\/blog\/wp-content\/uploads\/2010\/06\/6-27-2010-11-40-05-AM.png\" alt=\"\" width=\"294\" height=\"112\" \/><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>TS Gateway getting knocked offline due to IIS Restart<\/strong><\/p>\n<p>If you restart your IIS server at anytime, your TS Gateway service will get knocked offline.\u00a0 As of June 27, 2010 this is a documented issue with Windows Server 2008 and later.<\/p>\n<p>If you see an error in the TS Gateway event log that looks like this:<\/p>\n<blockquote><p><strong>The TS Gateway service is shutting down. To diagnose possible causes for this problem, verify whether the <\/strong><strong>following services are installed and started: (1) World Wide Web Publishing Service (2) Internet Authentication Service (IAS) <\/strong><strong>(3) RPC\/HTTP Load Balancing Service. Also, check Event Viewer for Network Policy Server (NPS) <\/strong><strong>and IIS events that might indicate problems with NPS or IIS.<\/strong><\/p><\/blockquote>\n<p>or if your client computer (laptop) that is trying to connect from the outside, gets an error like this<\/p>\n<blockquote>\n<pre>Remote Desktop Disconnected\r\n----------------------------------------------\r\nThis computer can't connect to the remote computer.<\/pre>\n<pre>Try connecting again. If the problem continues, contact the owner of the remote computer or your network administrator.<\/pre>\n<\/blockquote>\n<p>You need to go to the service manager and make sure the following services are started:<\/p>\n<ul>\n<li>Terminal Services Gateway<\/li>\n<li>RPC\/HTTP Load Balancing Service<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Want to connect into your business network, but don&#8217;t want to spend the $$$ paying for multiple GoToMyPC accounts?\u00a0 Well, if you have control over your firewall, a static IP, Windows Server 2008 or later on your business server, and enough technical expertise, you can likely use Terminal Services Gateway service (TS Gateway)\u00a0to connect into your computer (or any modern<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[5,8,101,24,23],"class_list":["post-40","post","type-post","status-publish","format-standard","hentry","category-windows-server","tag-iis","tag-microsoft-windows-server","tag-ssl","tag-terminal-services","tag-ts-gateway"],"_links":{"self":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/40","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/comments?post=40"}],"version-history":[{"count":6,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/40\/revisions"}],"predecessor-version":[{"id":47,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/40\/revisions\/47"}],"wp:attachment":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/media?parent=40"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/categories?post=40"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/tags?post=40"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}