How can RDP get secured using IPSec and IPv4, rather than IPv6 on Windows 10

Question

I found this approach to secure RDP-connections on a post at the University of Rostock.

On the Server (W10):

netsh ipsec static set store location=local
netsh ipsec static add policy name="IPFilter" description="IP Filter Policy"
netsh ipsec static add filteraction name=Permit description="Permit Traffic" action=permit
netsh ipsec static add filteraction name="Encrypt" description="Forces communications using encryption" action=negotiate qmsecmethods="ESP[3DES,SHA1]" inpass=no soft=no qmpfs=no
netsh ipsec static add filter filterlist="RDP-In" srcaddr=me dstaddr=any description="RDP Traffic (TCP-In)" protocol=tcp srcport=3389 dstport=0
netsh ipsec static add rule name="Encrypt RDP-In" policy="IPFilter" filterlist="RDP-In" filteraction=Encrypt Kerberos=No PSK=%PSK%
netsh ipsec static set policy name="IPFilter" assign=yes

On the Client (W10):

netsh ipsec static set store location=local
netsh ipsec static add policy name="IPFilter" description="IP Filter Policy"
netsh ipsec static add filteraction name=Permit description="Permit Traffic" action=permit
netsh ipsec static add filteraction name="Encrypt" description="Forces communications using encryption" action=negotiate qmsecmethods="ESP[3DES,SHA1]" inpass=no soft=no qmpfs=no
netsh ipsec static add filter filterlist="RDP-Out" srcaddr=me dstaddr=any description="RDP Traffic (TCP-Out)" protocol=tcp srcport=0 dstport=3389
netsh ipsec static add rule name="Encrypt RDP-Out" policy="IPFilter" filterlist="RDP-Out" filteraction=Encrypt Kerberos=No PSK=%PSK%
netsh ipsec static set policy name="IPFilter" assign=yes 

It works fine and it uses IPv6 according to Wireshark.

Here is the problem: Using an Azure-VM (W10) as the server it ceases to work. Since I believe it is due to IPV6 not being available on Azure (by default, uncertain how to achieve that), I turn off IPV6 on my test environment (2 Virtualbox VMs W10) and bingo: No connection can be established any longer.

Anyone has an idea how to get this working using IPv4, please?

Thanks a lot. Urs

Answer 1

Your problem is not IPv6. The Azure Firewall does not permit IPSec traffic to flow to a VM. IPSec requires ESP, which the Azure Firewall does not support.

Look into using Azure VPN Gateway, OpenVPN, WireGuard, or other VPN type products.