Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Fair warning: I'm a programmer, not an IT person. Thus I have no idea what I'm talking about and put myself entirely at your mercy.

I have three dedicated machines that we currently administer through RDP via the Internet. We also have a virtual machine where we do the same. The virtual machine and the dedicated machines are all on the same LAN.

I would like to restrict access to the dedicated machines such that RDP sessions to them can only be started from the virtual server. In short, we don't want RDP sessions to the dedicated machines being allowed over the Internet.

The end goal being: You RDP via the Internet to the virtual machine and then RDP from there to the dedicated machines.

This was proposed as a way of protecting the Dedicated Machines from external intrusion.

So I guess two things:

  1. Does this make sense to do? Does it actually add any level of security? If not, then what would be a right way to lessen the risk of unauthorized access to the dedicated servers?
  2. If it does, then in which direction should I look? Even just a few terms to get me started on Google would be awesome.
share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Restricting access in this way is probably a security gain (less exposed services), but only if you make sure that the virtual machine is highly locked down, user accounts are limited and use strong passwords, that the RDP version and clients you're using are to the latest spec and use encryption, and you monitor the hell out of it.

That being said, there's plenty of tools you can use to implement this sort of model, depending on your network architecture. The arguably best place to do this is at your border firewall or router - simply make sure that ONLY the virtual machine has the RDP port exposed to the internet, and that the other machines are not so exposed. Ideally of course, you have such a router/firewall, and it's locked down to not allow connections willy-nilly - allowing only the ports that are required to be available to clients on the internet.

If you don't have that, you have larger problems, which should likely be tackled before this one.

Alternately, you can use the windows firewall on the three dedicated machines (I'm assuming you're using a version of windows that has a host firewall available) to only allow RDP connections from the virtual machine.

If none of this makes sense or seems easy, I would suggest finding a network admin to assist. If that isn't possible, I'd read the docs for your particular version of windows specific to the firewall settings - perhaps by starting here

Good luck!

share|improve this answer
    
Wish I could accept both answers. Also, I would upvote, but I haven't the reputation! –  Alec Sloman Sep 22 '11 at 5:08
add comment

It sounds like Remote Desktop Gateway (RDG) (so called in Server 2008 R2. Called Terminal Services Gateway in Server 2008) would serve you very well in this situation.

It provides you the same benefit as your virtual machine idea (less surface area and enabled ports for attack) while also ensuring SSL transmission, and user/computer policies that you define.

The idea is you set up RDG on a single server, and port forward 443 from the Internet to it. You then create Connection Authorization Policies (CAP) that define who can use the RDG, and then Resource Authorization Policies (RAP) that define which internal computers on the LAN can be access through the RDG.

From there, you can view users currently logged into the RDG, as well as set events on custom log entries for notifications if you desire (through Server 2008 event log tools).

Here's a step-by-step guide to using RDG: http://www.microsoft.com/download/en/details.aspx?id=5177

A quick google search for Remote Desktop Gateway will provide a few simple to follow introductions to RDG.

share|improve this answer
    
As I said in Malcolm's answer, wish I could accept both. Both contain very helpful info. Thanks! –  Alec Sloman Sep 22 '11 at 5:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.