Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a desktop and laptop both running Windows 7 Professional. My goal is to secure the desktop so that I can securely use "Remote Desktop" over the Internet from ONLY the laptop.

I have already done the following to secure the desktop:

  1. Required encryption on the host (as per this article)
  2. Forwarded the remote desktop port through my router to a random obscure port number.
  3. Setup a complex password for my account on the host.

None of these allow connections ONLY from my laptop.

What else can I do to increase the security?

share|improve this question
add comment

4 Answers

A couple of options...

  1. If you use a Remote Desktop Gateway, you can configure a Remote Desktop Connection Authorization Policy (CAP) that requires computer to belong to a specified group. [EDIT] Information on setting up a RD CAP can be found here.
  2. There's a 3rd party utility called SecureRDP sold by 2X that does exactly what you want. It's also now freeware.
share|improve this answer
add comment

On a router You may have possibility to restrict transmission by mac adres of Your laptop's network card. It is router dependent:here You have example: http://www.wikihow.com/Create-Machine-Address-Filter-List-on-a-Home-Router . Check Your router documentation.

share|improve this answer
add comment

While one option would be to use ipsec, it can be a PITA to get set up to run reliably across any network - tunnelled protocols are much more robust.

If it were me I'd drop the built-in encryption/random obscure port number/complex password and route the connection using stunnel with client certificate validation (and using a simpler password). That way you can limit access to a device holding the right client certificate (or a certificate signed by the right CA).

Running your own Certification Authority may be overkill for just one remote user - several CAs provide signed certs for email use relatively cheaply (compared with certs for use in webservers / VPNs). Indeed, Thawte used to give them out for free, Entrust currently charge 20 USD/annum. But its not that hard to create your own CA (although I've never tried to setup a CA on MSWindows).

Then firewall direct access to the RDP post on the desktop and opnly allow connections from the ip address where the serverside stunnel is running.

I've previously used such a setup for VNC, mail and telnet (yes, I know - it's a long story) for road warriors. RDP will work on this kind of setup.

share|improve this answer
add comment

Don't know if the RDP-client you are using, supports SOCKS5 proxies. But if it does, you can set up an ssh-encrypted tunnel with client-certificates.

SSH-tunnels are not that difficult to set up.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.