VPN or RemoteDesktop?

Question

I need to keep an eye on our small company server while I'm away. I Have Windows2008 server with a spare NIC and went through all the steps to setup a WIndows VPN.

But before I set the port forward on the router - do I really need a VPN?
All I want to do is remote desktop into that one server I don't need to be on the LAN and don't need access to other machines.

What I would like to do is limit external access to only from one account = me (I have CXOs who think "password" is a good password !) and ideally only allow connections from a single external laptop.

I can do all this easily on Linux with SSH and shared keys, I could also go and buy a CISCO VPN router (although management would still make the password "password")

Any suggestions for doing this with Win2008?

Answer 1

Yes, you should secure your traffic somehow. It's a bad idea to use port forwarding for Remote Desktop because this can be detected in a port scan, and it makes your network a more attractive target. This is even more important when you're using RDP for administrative access.

If you need to access the host from outside the LAN, and you don't want that host to be visible to the public internet, then by definition you're looking at some kind of VPN. Of course, there are a variety of ways to implement this.

• Traditional VPN technology such as IPsec, L2TP, and PPTP
• SSL VPN can do "virtual" port forwarding over a secure connection
• Other remote access services that use SSL, like LogMeIn

---

And one more thing to note: if your VPN server is configured in a particular way, you can get a point-to-point connection that only allows communication with the VPN server, and not any other hosts on the LAN.

1. The VPN server is also the server you want to access with Remote Desktop
2. The VPN server is configured to use a static pool of IP addresses in a different subnet
3. The VPN server is not the default gateway for hosts on the LAN

In this scenario, the other hosts on the LAN don't have a route into the subnet used for VPN clients, so no communication can occur.

Answer 2

A service like LogMeIn or GotoMyPc will be the best option in this situation. They use encrypted SSL over http to connect directly to the server. You will then be able to connect from your laptop and can lock this down.

Answer 3

I find the best solution for windows to linux RD is nomachine. Its fairly easy to setup and has plenty of security features to limit what users/machines can use it to connect to the machine. It also uses ssl to encrypt the connection.

EDIT: I misread the question. There is no windows to linux RD. Regardless I still use NoMachine for remote access regardless of platform. It also utilizes several different levels of compression if you need to change the settings to speed up a connection.