1

I want to set up my work laptop to enable me to use Remote Desktop to connect to it from home, like I can with our network server. Using ZoneEdit, I have the domain mypc.company.com pointing to the IP address of our router, let's say the IP is 66.45.192.180 (that's not the real IP of it). The server also points to this router, since it's own IP address is, obviously, internal to our network.

On the router itself (it's a Linksys), I have port range forwarding configured so that requests for port 3399 (Remote Desktop) from mypc.company.com should be forwarded to the IP address of my workstation, which is 192.168.1.201. I also have it configured so that dev.mycompany.com forwards to the server, 192.168.1.200.

However, what happens is that when I try to connect to mypc.mycompany.com, it connects instead to the network server that's already set up, and not to my computer. I can only imagine this has something to do with the fact that the IP for the router is the same for both computers, but shouldn't port forwarding ensure that it's sent to the right.

I've not had to set up something like this on my own in the past; I'm used to having it already configured so I'm not entirely sure what I'm doing wrong and how to fix it. I want to set up the workstation for remote access.

1
  • 2
    Remote desktop uses port 3389 by default (I assume 3399 is a typo?). Jun 16, 2009 at 14:32

8 Answers 8

7

LogMeIn is a very good (and more secure) alternative.

I use it all the time and I am very happy with it... when using it in full-screen it isn't much of a difference with having a direct RDP connection in full-screen.

2
  • this crawls sometimes.
    – setzamora
    Jun 17, 2009 at 4:29
  • This is the best way. It may crawl sometimes so you need to turn the screen color down to the B&W setting and us a smaller screen size but it works great and does not open any external ports. Jun 17, 2009 at 12:09
4

You would be better off, and more secure, to do this via VPN.

OpenVPN is a free option for this, and is even available as a firmware upgrade for many LinkSys routers with dd-wrt.

3
  • I would like OpenVPN, but it does not work on Windows yet. Jun 16, 2009 at 14:44
  • Brent is suggesting that OpenVPN be loaded on the Linksys router. There is a Windows client .. I use it several times a week.
    – tomjedrz
    Jun 16, 2009 at 20:08
  • i'll chime in too, I have both Linux and Windows XP/Vista clients off of OpenVPN
    – bobby
    Jun 17, 2009 at 4:39
3

This is not a good way to do this. You are exposing well-known services (RDP) to the internet. At the very least, you need to make sure that you are using non-standard ports for RDP, although this isn't nearly enough security. A good port scanning program can look at the response on a port and deduce the actual protocol behind it.

You need a VPN. The Linksys may do it, or there may be a firmware upgrade or open source firmware replacement for the Linksys to do it, or you may need a small firewall. I like Astaro.

This question is one of many that discusses this dilemma in more detail.

6
  • This x100. RDP uses a tiny amount of bandwidth. Introducing some encryption will not noticeably slow your connection, with huge benefits in security. Jun 16, 2009 at 14:41
  • I'll look at this - honestly at this point I'm looking for the simplest possible way to do this free of charge since I have no IT budget at all, and it's not something that the business understands but something that will make my job easier. Jun 16, 2009 at 14:45
  • 1
    ewww!!! Suggesting using non-standard ports sucks. It does not solve any problem. If your system was not secure, switching ports won't help. It might stop some attacks or slow them down, but your time is better spent elsewhere. Just make sure that RDP is encrypted- if you have proper passwords in place and have a fully-patched system, you should be ok.
    – alex
    Jun 16, 2009 at 18:36
  • Did you read the sentences before and after I mentioned non-standard ports? I stated that it was a poor solution and I recommended VPN. One reason for that recommendation is that a Microsoft system is only secure until the next exploit is discovered.
    – tomjedrz
    Jun 16, 2009 at 20:06
  • 1
    A VPN solution is only secure until the next exploit is discovered as well... The VPN is overall the right solution, but not for the reasons you give. A firewall is useless unless you only have incoming RDC/VPN connections from a particular IP range or bunch of static addresses. And RDP uses encryption.
    – Neobyte
    Jun 17, 2009 at 4:21
2

I think you said this is your configuration:

DNS::
router public IP: 1.2.3.4
mypc.company.com public IP: 1.2.3.4
dev.company.com public IP: 1.2.3.4

Router config::
Forward traffic addressed to dev.company.com to 192.168.1.200
Forward traffic addressed to mypc.company.com port 3389 to 192.168.1.201 3389

Your router is going to store it's routing rules by IP, not by hostname. It doesn't understand hostnames. So your router actually has rules saying:

Forward traffic addressed to 1.2.3.4 to 192.168.1.200
Forward traffic addressed to 1.2.3.4 port 3389 to 192.168.1.201 3389

If the rules are in that order, your router will send 3389 traffic to 200 because the first rule covers all traffic to 1.2.3.4.

You will need to use a different port on the router for each system you want to tunnel through to (the systems themselves can all be left with 3389), or change the rule order.

UPDATE

Seeing as everyone appears to be going on about it: yes, overall a VPN is the better way to go for the task you are trying to accomplish, as it reduces your attack surface (you only have to keep 1 VPN server obsessively patched rather than X machines you port forward to).

However I restricted my answer to resolving the actual question you had, rather than criticizing your architecture choice.

4
  • This one solves the original poster's problem. As for security, I believe rdp is encrypted, so in theory it should not be necessary to add a VPN to the mix.
    – alex
    Jun 16, 2009 at 18:32
  • As I noted in the comment above .. Microsoft is only secure until the next exploit is discovered. Leaving RD open to the internet, even on an alternate port, is not a wise idea.
    – tomjedrz
    Jun 16, 2009 at 20:12
  • A VPN server is only secure until the next exploit is discovered as well. Any port open to the internet has a risk associated with it.
    – Neobyte
    Jun 17, 2009 at 4:10
  • Although I will qualify that and say if you have a VPN solution then that is only 1 way into your internal network you have to obsess over securing, while if you have lots of port forwarding to individual workstations, each one of them has to be carefully patch managed as well. So overall a VPN solution is better as it reduces your attack surface.
    – Neobyte
    Jun 17, 2009 at 4:12
1

You would need to setup RD to listen on different ports for each machine, otherwise the first entry in the port forwarding list is used.

1

Skip all the hassle and use Live Mesh it handles all of the firewall/router traversal and allows you to remotely connect from pretty much anywhere.

4
  • It's not as fast as Remote Desktop though.
    – Joseph
    Jun 16, 2009 at 14:31
  • Speed vs. security - I'll stick with the latter. Jun 16, 2009 at 14:38
  • @Joseph what makes you see that? The speed limitation tends to be slow upload speeds on the home connection, not Mesh... IIRC it uses the same RDP protocol. I use it all the time and it is very usable.
    – Sean Earp
    Jun 16, 2009 at 14:44
  • I tested it the other day and found it not nearly as responsive as RDP. I was actually surprised that Mesh was noticeably slower on the same connection.
    – Joseph
    Jun 16, 2009 at 23:56
0

SSH is an established secure remote connection method if setup properly.

I usually tunnel my rdp sessions over a secure SSH connection. If you manage to configure SSH properly on that server or laptop then you have the added benefit of controlling where each tunnel is going. Just make sure whatever port you pick for the SSH communication is forwarded to the right machine, server or laptop. From outside use an SSH client to initiate a connection and setup a tunnel. Then launch your rdp client over that connection. Search with terms like "using rdp over ssh" and you get results like "Remote Desktop and SSH for the home user"

This is an alternative to the recommended "use a full blown VPN" solution or even "expose RDP ports" option.

You can easily alter the listen ports on both the SSH service and the RD service as well instead of using the standard ports.

Just make sure your router knows how to forward that initial SSH traffic to the proper SSH server on the inside of the network.

1
  • Interesting idea. I have heard about it but never tried it. It looks like someone (wissh.com) has put RDP and SSH together to do exactly this.
    – tomjedrz
    Jun 16, 2009 at 20:14
0

Maybe you could use Terminal Services Gateway Server from Microsoft - it's bundled with Windows Server 2008, no more additional payment. It allows to publish only it, and it will authenticate incoming connections against Active Directory and make the tunnel to the internal machine, if you are allowed. Moreover, it encapsulates RDP traffic to SSL, so you only need port 443 to be opened on the router. When you make mstsc connection from outside, you need to specify to use Gateway Server, that's possible in RDP 6.1 (XP SP3, Vista or Seven). That's really great and handy solution - only one port, that is for sure already opened, integration with NAP policies, and ability to remotely connect to any machine in your internal network - works awesome for us! Try it.

http://technet.microsoft.com/en-us/library/cc731264.aspx - look here, the initial setup is very easy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .