RDP. Connecting to a terminal server on the same subnet as the client via an external IP

Question

RDP

Hello, help me solve the problem. There is a subnet 192.168.0.0/24. The terminal server has Ip 192.168.0.1, it looks to the Internet with a static address, for example 222.222.222.222. There is a client located at 192.168.0.100, the default gateway uses the terminal server 192.168.0.1. All nodes on the subnet go online without problems. From the client 192.168.0.100, the connection to the terminal server at 192.168.0.1 passes without problems. Port 3389 is open on the terminal server. When you try to connect to the terminal server from the client 192.168.0.100 at the external address 222.222.222.222:3389, nothing happens, you only need to transfer the client to another subnet (for example, connect with a friend to the Internet) RDP connection is established. Prompt in what direction to dig to solve this question.

Answer 1

Dig towards the firewall. It is he who deals with this issue =)
Why do you need to connect from your network to the external address of your own network?

Answer 2

Not a firewall deals with this issue, but NAT, possibly being treated through NAT NVI It is
enough to run wireshark and see what's wrong.
Look:
1. [SYN] Soure(192.168.0.2)->Dest(222.222.222.222)
2. [SYN, ACK] Soure(192.168.0.1)->Dest(192.168.0.2)
The handshake is not installed because different srcs are obtained and dst ip, because 192.168.0.1, having received the first packet, in which source 192.168.0.2 is specified, starts communicating with it via L2, substituting 192.168.0.1 into its src, not 222.222.222.222 as it should, but 192.168.0.1
As a result, we get Previous segment not captured

Answer 3

On the firewall, you need to make snat/dnat packets arrive with a destination address of 222.222.222.222 and port 3389 so that the firewall acts as the source of the request to the terminal server. Then the server will send its responses back to the firewall, which in turn will give the address 192.168.0.100.