Securing Remote Desktop Server on Windows 7 For Internet Use

Question

I have a desktop and laptop both running Windows 7 Professional. My goal is to secure the desktop so that I can securely use "Remote Desktop" over the Internet from ONLY the laptop.

I have already done the following to secure the desktop:

1. Required encryption on the host (as per this article)
2. Forwarded the remote desktop port through my router to a random obscure port number.
3. Setup a complex password for my account on the host.

None of these allow connections ONLY from my laptop.

What else can I do to increase the security?

Answer 1

A couple of options...

1. If you use a Remote Desktop Gateway, you can configure a Remote Desktop Connection Authorization Policy (CAP) that requires computer to belong to a specified group. [EDIT] Information on setting up a RD CAP can be found here.
2. There's a 3rd party utility called SecureRDP sold by 2X that does exactly what you want. It's also now freeware.

Answer 2

On a router You may have possibility to restrict transmission by mac adres of Your laptop's network card. It is router dependent:here You have example: http://www.wikihow.com/Create-Machine-Address-Filter-List-on-a-Home-Router . Check Your router documentation.

Answer 3

While one option would be to use ipsec, it can be a PITA to get set up to run reliably across any network - tunnelled protocols are much more robust.

If it were me I'd drop the built-in encryption/random obscure port number/complex password and route the connection using stunnel with client certificate validation (and using a simpler password). That way you can limit access to a device holding the right client certificate (or a certificate signed by the right CA).

Running your own Certification Authority may be overkill for just one remote user - several CAs provide signed certs for email use relatively cheaply (compared with certs for use in webservers / VPNs). Indeed, Thawte used to give them out for free, Entrust currently charge 20 USD/annum. But its not that hard to create your own CA (although I've never tried to setup a CA on MSWindows).

Then firewall direct access to the RDP post on the desktop and opnly allow connections from the ip address where the serverside stunnel is running.

I've previously used such a setup for VNC, mail and telnet (yes, I know - it's a long story) for road warriors. RDP will work on this kind of setup.

Answer 4

Don't know if the RDP-client you are using, supports SOCKS5 proxies. But if it does, you can set up an ssh-encrypted tunnel with client-certificates.

SSH-tunnels are not that difficult to set up.