Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to set up my work laptop to enable me to use Remote Desktop to connect to it from home, like I can with our network server. Using ZoneEdit, I have the domain mypc.company.com pointing to the IP address of our router, let's say the IP is 66.45.192.180 (that's not the real IP of it). The server also points to this router, since it's own IP address is, obviously, internal to our network.

On the router itself (it's a Linksys), I have port range forwarding configured so that requests for port 3399 (Remote Desktop) from mypc.company.com should be forwarded to the IP address of my workstation, which is 192.168.1.201. I also have it configured so that dev.mycompany.com forwards to the server, 192.168.1.200.

However, what happens is that when I try to connect to mypc.mycompany.com, it connects instead to the network server that's already set up, and not to my computer. I can only imagine this has something to do with the fact that the IP for the router is the same for both computers, but shouldn't port forwarding ensure that it's sent to the right.

I've not had to set up something like this on my own in the past; I'm used to having it already configured so I'm not entirely sure what I'm doing wrong and how to fix it. I want to set up the workstation for remote access.

share|improve this question
2  
Remote desktop uses port 3389 by default (I assume 3399 is a typo?). –  Justin Scott Jun 16 '09 at 14:32

8 Answers 8

You would need to setup RD to listen on different ports for each machine, otherwise the first entry in the port forwarding list is used.

share|improve this answer

Skip all the hassle and use Live Mesh it handles all of the firewall/router traversal and allows you to remotely connect from pretty much anywhere.

share|improve this answer
    
It's not as fast as Remote Desktop though. –  Joseph Jun 16 '09 at 14:31
    
Speed vs. security - I'll stick with the latter. –  Kara Marfia Jun 16 '09 at 14:38
    
@Joseph what makes you see that? The speed limitation tends to be slow upload speeds on the home connection, not Mesh... IIRC it uses the same RDP protocol. I use it all the time and it is very usable. –  Sean Earp Jun 16 '09 at 14:44
    
I tested it the other day and found it not nearly as responsive as RDP. I was actually surprised that Mesh was noticeably slower on the same connection. –  Joseph Jun 16 '09 at 23:56

You would be better off, and more secure, to do this via VPN.

OpenVPN is a free option for this, and is even available as a firmware upgrade for many LinkSys routers with dd-wrt.

share|improve this answer
    
I would like OpenVPN, but it does not work on Windows yet. –  Wayne M Jun 16 '09 at 14:44
    
Brent is suggesting that OpenVPN be loaded on the Linksys router. There is a Windows client .. I use it several times a week. –  tomjedrz Jun 16 '09 at 20:08
    
i'll chime in too, I have both Linux and Windows XP/Vista clients off of OpenVPN –  bobby Jun 17 '09 at 4:39

This is not a good way to do this. You are exposing well-known services (RDP) to the internet. At the very least, you need to make sure that you are using non-standard ports for RDP, although this isn't nearly enough security. A good port scanning program can look at the response on a port and deduce the actual protocol behind it.

You need a VPN. The Linksys may do it, or there may be a firmware upgrade or open source firmware replacement for the Linksys to do it, or you may need a small firewall. I like Astaro.

This question is one of many that discusses this dilemma in more detail.

share|improve this answer
    
This x100. RDP uses a tiny amount of bandwidth. Introducing some encryption will not noticeably slow your connection, with huge benefits in security. –  Kara Marfia Jun 16 '09 at 14:41
    
I'll look at this - honestly at this point I'm looking for the simplest possible way to do this free of charge since I have no IT budget at all, and it's not something that the business understands but something that will make my job easier. –  Wayne M Jun 16 '09 at 14:45
1  
ewww!!! Suggesting using non-standard ports sucks. It does not solve any problem. If your system was not secure, switching ports won't help. It might stop some attacks or slow them down, but your time is better spent elsewhere. Just make sure that RDP is encrypted- if you have proper passwords in place and have a fully-patched system, you should be ok. –  alex Jun 16 '09 at 18:36
    
Did you read the sentences before and after I mentioned non-standard ports? I stated that it was a poor solution and I recommended VPN. One reason for that recommendation is that a Microsoft system is only secure until the next exploit is discovered. –  tomjedrz Jun 16 '09 at 20:06
1  
A VPN solution is only secure until the next exploit is discovered as well... The VPN is overall the right solution, but not for the reasons you give. A firewall is useless unless you only have incoming RDC/VPN connections from a particular IP range or bunch of static addresses. And RDP uses encryption. –  Neobyte Jun 17 '09 at 4:21

LogMeIn is a very good (and more secure) alternative.

I use it all the time and I am very happy with it... when using it in full-screen it isn't much of a difference with having a direct RDP connection in full-screen.

share|improve this answer
    
this crawls sometimes. –  Joset Jun 17 '09 at 4:29
    
This is the best way. It may crawl sometimes so you need to turn the screen color down to the B&W setting and us a smaller screen size but it works great and does not open any external ports. –  SpaceManSpiff Jun 17 '09 at 12:09

I think you said this is your configuration:

DNS::
router public IP: 1.2.3.4
mypc.company.com public IP: 1.2.3.4
dev.company.com public IP: 1.2.3.4

Router config::
Forward traffic addressed to dev.company.com to 192.168.1.200
Forward traffic addressed to mypc.company.com port 3389 to 192.168.1.201 3389

Your router is going to store it's routing rules by IP, not by hostname. It doesn't understand hostnames. So your router actually has rules saying:

Forward traffic addressed to 1.2.3.4 to 192.168.1.200
Forward traffic addressed to 1.2.3.4 port 3389 to 192.168.1.201 3389

If the rules are in that order, your router will send 3389 traffic to 200 because the first rule covers all traffic to 1.2.3.4.

You will need to use a different port on the router for each system you want to tunnel through to (the systems themselves can all be left with 3389), or change the rule order.

UPDATE

Seeing as everyone appears to be going on about it: yes, overall a VPN is the better way to go for the task you are trying to accomplish, as it reduces your attack surface (you only have to keep 1 VPN server obsessively patched rather than X machines you port forward to).

However I restricted my answer to resolving the actual question you had, rather than criticizing your architecture choice.

share|improve this answer
    
This one solves the original poster's problem. As for security, I believe rdp is encrypted, so in theory it should not be necessary to add a VPN to the mix. –  alex Jun 16 '09 at 18:32
    
As I noted in the comment above .. Microsoft is only secure until the next exploit is discovered. Leaving RD open to the internet, even on an alternate port, is not a wise idea. –  tomjedrz Jun 16 '09 at 20:12
    
A VPN server is only secure until the next exploit is discovered as well. Any port open to the internet has a risk associated with it. –  Neobyte Jun 17 '09 at 4:10
    
Although I will qualify that and say if you have a VPN solution then that is only 1 way into your internal network you have to obsess over securing, while if you have lots of port forwarding to individual workstations, each one of them has to be carefully patch managed as well. So overall a VPN solution is better as it reduces your attack surface. –  Neobyte Jun 17 '09 at 4:12

SSH is an established secure remote connection method if setup properly.

I usually tunnel my rdp sessions over a secure SSH connection. If you manage to configure SSH properly on that server or laptop then you have the added benefit of controlling where each tunnel is going. Just make sure whatever port you pick for the SSH communication is forwarded to the right machine, server or laptop. From outside use an SSH client to initiate a connection and setup a tunnel. Then launch your rdp client over that connection. Search with terms like "using rdp over ssh" and you get results like "Remote Desktop and SSH for the home user"

This is an alternative to the recommended "use a full blown VPN" solution or even "expose RDP ports" option.

You can easily alter the listen ports on both the SSH service and the RD service as well instead of using the standard ports.

Just make sure your router knows how to forward that initial SSH traffic to the proper SSH server on the inside of the network.

share|improve this answer
    
Interesting idea. I have heard about it but never tried it. It looks like someone (wissh.com) has put RDP and SSH together to do exactly this. –  tomjedrz Jun 16 '09 at 20:14

Maybe you could use Terminal Services Gateway Server from Microsoft - it's bundled with Windows Server 2008, no more additional payment. It allows to publish only it, and it will authenticate incoming connections against Active Directory and make the tunnel to the internal machine, if you are allowed. Moreover, it encapsulates RDP traffic to SSL, so you only need port 443 to be opened on the router. When you make mstsc connection from outside, you need to specify to use Gateway Server, that's possible in RDP 6.1 (XP SP3, Vista or Seven). That's really great and handy solution - only one port, that is for sure already opened, integration with NAP policies, and ability to remotely connect to any machine in your internal network - works awesome for us! Try it.

http://technet.microsoft.com/en-us/library/cc731264.aspx - look here, the initial setup is very easy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.