Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to prevent Remote Desktop from replying when requesting for it through a domain name? In other words if I type in "www.example.com" into the Remote Desktop Connection prompt it will resolve to my server, how do I prevent that?

If it matters, the server is a Windows Server 2008 64-bit.

Thanks in advance!

share|improve this question

3 Answers 3

up vote 5 down vote accepted

No you can't DNS resolution is a separate process done by the system. If you have both a webserver and rdp server on www.example.com if you remove www.example.com from the DNS, the website will no longer be reacheable using the name.
So you can't solve your problem but I don't see why it's a problem

share|improve this answer
    
I see. Without going into great detail, I've recently made substantial changes to some of my web applications and I unfortunately know of malicious people that would like to do bad things to them... Wanted to see if it was possible to avoid revealing the server at least through the domain name. Is it instead possible to have RDP listen on a separate "private" IP? –  Alex Aug 13 '10 at 9:53
2  
Of course you can't hide the server IP as it's needed by the client to access the web server. You can enable a firewall on your server to only allow access to RDP server from some trusted IPs, this would be a better solution than using a 2nd public IP dedicated to RDP. –  radius Aug 13 '10 at 10:01
    
I see. I was going to ask for a guide, but then I realized that my IP can change at any time from my ISP thus causing me to loose access to the server if I were to restrict it to an IP... Thanks for the help! –  Alex Aug 13 '10 at 10:16
    
You could use thing like VPN, someone will still be able to try to connect to your VPN service but this reduce risk in case of a security hole in RDP (but of course you could have a security hole in VPN software, so ...) –  radius Aug 13 '10 at 12:21
2  
Well for one, they are not necessarily using Windows servers (even for ASP code, you can still be running *nix with Apache). But for the most part they will restrict things via a firewall so that the only thing the "world" can touch on the servers are ports they allow (port 80, 443, etc). RDP (port 3389) will most likely be limited to people on their corporate network, or even a subset of that, since they don't necessarily want sales people and the cleaning lady to have access to production servers... –  peelman Aug 13 '10 at 18:09

"Security through obscurity" is a bad idea, because it only works if your enemies are stupid and not particularly determined. However, you certainly can change the listening port for RDP: http://support.microsoft.com/kb/306759

What you may really want to do is to configure a VPN connection, and, when it is working, block outside connections to port 3389 using Windows Firewall. This tutorial from Microsoft is overkill, but it should include all the details that you need.

share|improve this answer

It does not answer your question but would it not be more simple to configure firewall to "deny all" on port 3389 (RDP) and open it for specific (your home pc) IP-addresses and optionally add IPSec "Secure Only"?

share|improve this answer
2  
It's not me that downvoted on you, but from what you can understand by reading the whole thing, the server is connect to internet and he is connecting from home to his remote server, so there is no internal network. –  radius Aug 13 '10 at 12:18
    
Added answer in Update1 –  Gennady Vanin Геннадий Ванин Aug 13 '10 at 12:42
1  
@vgv8, I appreciate the attempt, but as @radius has suggested, I'm remoting in from an outside network and I have no control of the DNS servers as well. –  Alex Aug 13 '10 at 17:20
1  
@vgv8 - If you have an issue with how this site is run, perhaps you should bring it up over at meta.stackoverflow.com That is the "governing body" for Serverfault, Super User, and Stack Overflow. –  MDMarra Aug 14 '10 at 16:30
1  
Your answer is rambling, you need to edit it to work a a single piece in time for future readers - not a tracked discussion (you can view the revisions if you want, you don't have to insert formatting stating what is new and not). –  Oskar Duveborn Aug 15 '10 at 13:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.