2 pc with same ip

[m.elkhateib]

hello
i have
2  Pc
1 Hub
1 router
1 firewall ( XG125 sophos )
1 static Ip
so i want to know how i can make both pc can work with the same ip and same port to have ability to access on them via (RDP out side of my network )"online"
which mean by only one ip+port can access to pc No:1 but also have ability to some how close the port of pc1 and open for the pc2

**Note**
i can do this without the firewall as my router have ability to close and open the physical port so all what i do is connect the router online and change the port status.

so i need to know how to do that with the firewall sophos XG125 and if there no option in xg125 like this then what is the alternative solution

[Geek-9pm]

this then what is the alternative solution

I think the alternative is to use programs made for this kind of work.
Each PC must have some kind of unique identity over the internet. This allows remote control of each PC. Such programs require support from a server and are seldom free.

This web page might help you find a service:
https://alternativepedia.com/pcanywhere/

[DaveLembke]

I use to access multiple other systems from a single system RDP connection. So for example if I needed access remotely to another computer within the network that couldnt be connected to directly, I would connect via RDP to the single system that was accessible from anywhere and then once connected to that system I then used RealVNC to connect to any other computer on the network. There is a small amount of lag but whatever you need to do remotely can be done as long as it doesnt require video play back due to the frame rate of like 10 frames per second.

This way a single IP static is used and no special tricks.

[m.elkhateib]

thanks for answer \
but in fact 3rd program such as vnc , logmein ....etc. is not acceptable
and about access to PC via rdp and from it access the other one local also not acceptable as both PC have SQL and end users shouldn't know the Ip's
all what i have is
2 router +2 isp
1 load balance (ER5120)
1 HUB
2 PC EACH HAVE SQL
1 FIREWALL (SOPHOS XG125)

AND ALL WHAT I NEED IS pc1 , pc2 have ability to access them online via rdp (sure not in same time can access both only one can be ) and i will have the ability to disable or enable between them

[camerongray]

I presume you have a single public IP address and are then doing NAT/port forwarding to your machines on your local network.  In that case you would configure your port forward have a pair of diffferent ports for RDP, one of these ports should be forwarded to one machine, the other port should be forwarded to the other machine.  You would then connect to the appropriate port depending on what machine you want to connect to.

However, exposing RDP to the internet is a pretty bad idea, I wouldn't regard it as secure enough to be completely exposed.  At the very least you should configure you firewall to only allow a whitelist of IPs to connect to it however the better option would be to configure some sort of VPN server on your local network and then connect in to that if you need to access devices behind your firewall, this also eliminates the issue with having a single public IP address as you'd connect to the VPN and then access the RDP systems using their local IPs.

[m.elkhateib]

at first thanks for ur support and u r fully true but
i think what i want to do is not clear enough

ur idea if i want to access by 1 ip to 2 pc and i know that but what if i have 3 pc such as
pc 1 (192.168.1.10)
pc 2 ( 192.168.1.11)
pc 3 (192.168.1.12)
and have hub + load balance + firewall
i need a way to be able to disable the cable port of pc 3  or 1 to can swap between them as the end user don't do anything to access and i can swap only one of them (3-1) can be online while i'm a way

I presume you have a single public IP address and are then doing NAT/port forwarding to your machines on your local network.  In that case you would configure your port forward have a pair of diffferent ports for RDP, one of these ports should be forwarded to one machine, the other port should be forwarded to the other machine.  You would then connect to the appropriate port depending on what machine you want to connect to.

However, exposing RDP to the internet is a pretty bad idea, I wouldn't regard it as secure enough to be completely exposed.  At the very least you should configure you firewall to only allow a whitelist of IPs to connect to it however the better option would be to configure some sort of VPN server on your local network and then connect in to that if you need to access devices behind your firewall, this also eliminates the issue with having a single public IP address as you'd connect to the VPN and then access the RDP systems using their local IPs.

[camerongray]

It would probably help if you could explain the end goal of the project and the reasons for this configuration in more detail.  What are these machines being used for, are you just wanting RDP for administration or are they being used as remote desktop server for end users?  Are you trying to set up some sort of failover system in case one of the machines go down?

[m.elkhateib]

yes in fact  my goal is
PC 1 end user can access it (remote desktop)
PC 2 will be backup for one and also end user can access on it (WITH ANOTHER PORT OR ANOTHER IP )
PC 3 this one some time need all work on it for 1 or 2 h at max and then all back again to PC 1 (without make end user do any changes )

all have SQL, and all should be connected all time except PC 1,3 one of them only must be online as i need both with same name and same local .

[camerongray]

I'm struggling to work out why you need to share some sort of IP between them, what's the reason that users can't just connect to the correct machine at a given time, who are these end users?  We're going to need more information around the background to this setup.  Windows server (I presume you're running Windows server and not a desktop variant)  has options for remote desktop high availability but you run the risk of overcomplicating the setup it if it's not something that's actually required.  You're also talking about SQL, where does that come into this?  Are these replicated database servers that you want failover between?

[m.elkhateib]

camerongray   LETS say it with the easy way so simply ( how i can disable physical port in firewall xg125  ) without losing the configuration or what is the option to do that .

I'm struggling to work out why you need to share some sort of IP between them, what's the reason that users can't just connect to the correct machine at a given time, who are these end users?  We're going to need more information around the background to this setup.  Windows server (I presume you're running Windows server and not a desktop variant)  has options for remote desktop high availability but you run the risk of overcomplicating the setup it if it's not something that's actually required.  You're also talking about SQL, where does that come into this?  Are these replicated database servers that you want failover between?

[m.elkhateib]

any idea to do it ?

[Geek-9pm]

m.elkhateib,
What you ask sound too much like an attempt to break network security or get a service without paying for it. Either thing is prohibited on this forum.

Do you really have a legal reason to put two PC son one IP?
If so, Why don't people do it?

[camerongray]

I don't see anything that indicates malicious intentions however the question is still somewhat unclear so I doubt I'll be able to assist further without full information about the project and environment.

[Geek-9pm]

Maybe the OP will respond and explain his need.
For what it is worth...
Some time ago the Internet went from the use of a four byte IP address to the use of a six byte format. I am still not sure why this was done. Many web servers already had in place a way to separate different computers and customers in a complex wide area network. And I never understood how that worked. It was possible, somehow, to identify everything on the whole wide world. It blows my mind.There must more than a trillion things on the world wide network. 

[camerongray]

Maybe the OP will respond and explain his need.

That's what I need, in order to help I'd really need a full explanation of the problem you're trying to solve and the full setup, not just the small part of it around "sharing an IP address" - I need to understand the full picture to give advice.

For what it is worth...
Some time ago the Internet went from the use of a four byte IP address to the use of a six byte format. I am still not sure why this was done. Many web servers already had in place a way to separate different computers and customers in a complex wide area network. And I never understood how that worked. It was possible, somehow, to identify everything on the whole wide world. It blows my mind.There must more than a trillion things on the world wide network. 

It's not particularly related to the original thread but I presume you mean the move from IPv4 (32bit addresses) to IPv6 (128bit addresses). This is because we have literally already run out of new IPv4 addresses - there are less than 4.3 bullion total possible IPv4 addresses, sounds like a lot but when you factor in the number of people and internet connected devices, it's not that much! This is why your home connection will likely have a single public IP address and then use NAT to translate traffic to/from devices on your local network which all have private IP addresses (192.168.x.x, 10.x.x.x.etc).  Then with the current address exhaustion issues, ISPs are finding themselves not even having enough addresses to give one per customer and instead are using CG-NAT to share a single public IP address across multiple customers.

With IPv6 there are 2^128 addresses (over 340 undecillion whatever that is).  The idea being that each customer should get at least a /64 subnet which gives 2^64 addresses (over 18 quintillion) with larger sites easily being able to get a /48 subnet giving 65,536 /64 subnets.  This insane number of addresses completely removes the need for NAT and things such as private IP addresses, every device will have its own globally unique address.  Before I broke the config (really need to get around to sorting it one day) my own home network had a full /48 subnet of IP addresses (2^80 or over 1 septillion addresses) so let's just say there was more than enough to give every device I own a public IP!