@PimpJuiceIT So I did some more tests and confirmed a few things. First of all the server and clients are on the same subnet (255.255.255.0). I can also locally telnet into the rdp port (telnet 192.168.0.30 3389). The logs posted above are from the rdp mac client(app log file). The rdp clients can "connect" to the server, but they get stuck at the "negotiating credentials" step

@PimpJuiceIT They are both on 192.168.0.x correct. It only works with the WAN IP, that includes when I'm on the LAN or when I'm external.

Thanks for all the clarifications. Are you certain the RDP server Firewall is disabled for ALL interfaces from Control Panel on that machine? If you do a tracert <internal IP> and an tracert <external IP> does that help you troubleshoot based on where you see it routing one versus the other or can you show screen shots of this with a link I can view?

@PimpJuiceIT Did a traceroute internally using the internal & external ip but didn't see anything interesting, both were just 1 hop. However I did find something interesting. With all my tests I was using wifi, when I connect using ethernet I can RDP using my local ip! but then situation reverses and I can no longer rdp using my external address. It's weird, maybe there's some sort of wifi isolation? There shouldn't be since I can definitely telnet and ping into the computer regardless if I'm on wifi or ethernet. And generally consumer routers only turn on isolation on guest access points.

Interesting but check the router that serves to the WLAN access and see if there's something there that looks obvious; otherwise, your workaround is to use Ethernet rather than WiFi for local RDP access. And really the "reverse" should not matter since you should not need to connect on the internal LAN to the external IP address and since that works externally as-needed, nothing to worry about with it not working on the Ethernet so I would not chase that. Figure out what's different on the WLAN and do same TCP/IP settings, subnet, DNS address, etc. LAN DHCP vs WLAN DHCP that same, trace etc.?

Maybe your WLAN is isolated or something based on it's IP address it uses to connect to the LAN not on the WLAN like the isolation or whatever you were talking about. Maybe it uses 192.168.0.<some IP> and there are rules with it's interface IP and access to the LAN. Check the routers I would think maybe as a next step too plus verifying differences with the subnets and DHCP and whast DNS is used too maybe too. Be thorough.

I mean 192.168.0.<some IP octet> ... lol for the last octet of the IP address which is assigned to the interface the WLAN connected machines use to access or connect to the LAN?

Correct, I'll never need to use the external ip locally. It was just an interesting observation. I'll do a thorough passover the router settings.

Does the Wi-Fi router connect to the LAN to another router on it's LAN port or some other configuration if even applicable?

It's a combined Modem + Router, and the server is connected directly to it.

So incoming DSL, Cable, Fiber or what from the ISP?

Gigabit cable from the isp

So does the router that connects to the ISP gigabit also serve the WLAN too or is that a separate router?

Same router. In this entire equation there's only 3 physical devices: The combined modem+router(singular device), server (connected using ethernet), and the personal laptop in question

okay

It must be the way the router routes WLAN vs LAN to the LAN side or some protocol it uses for the negotiation like kerberos vs NTLM or something that cannot get through with the encryption of the RDP or whatever although I'd be surprised if that were the same. You say server firewall is off so the I assume it's not LAN vs WLAN trusted zones at the OS level.

Something in the router and however that's playing with TCP/IP or DHCP settings or the isolation or whatever like you were talking about. I'm curious what you come up with for sure in this sort of setup. Like the WLAN doesn't allow access to LAN connected devices and to the WAN for Internet only and segregating the two somehow. That's my guess.

Let me know though regardless.