Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to keep an eye on our small company server while I'm away. I Have Windows2008 server with a spare NIC and went through all the steps to setup a WIndows VPN.

But before I set the port forward on the router - do I really need a VPN?
All I want to do is remote desktop into that one server I don't need to be on the LAN and don't need access to other machines.

What I would like to do is limit external access to only from one account = me (I have CXOs who think "password" is a good password !) and ideally only allow connections from a single external laptop.

I can do all this easily on Linux with SSH and shared keys, I could also go and buy a CISCO VPN router (although management would still make the password "password")

Any suggestions for doing this with Win2008?

share|improve this question
    
Have you considered simply installing an SSH server on your 2008 server? It sounds like you are familiar with that. –  Zoredache Feb 3 '12 at 20:16
    
@Zoredache - but on windows you need a Gui to fix a lot of stuff. I'm a programmer with sysadm dumped on me, I'm not a powershell guru –  Martin Beckett Feb 3 '12 at 20:19
2  
Right, but you could install an SSH daemon, and simply use it for port-forwarding, to enable access to RDP. –  Zoredache Feb 3 '12 at 20:21
    
@Zoredache - Thanks, looks like tunneling port 443 over SSH is pretty simple. I seem to remember it being possible with VNC but not with RDP - but that might be an old issue. –  Martin Beckett Feb 3 '12 at 20:34
    
No RDP Gateway? BTW I use a VPN off my PFsense box with RADIUS. –  Jacob Feb 3 '12 at 20:39

3 Answers 3

up vote 1 down vote accepted

Yes, you should secure your traffic somehow. It's a bad idea to use port forwarding for Remote Desktop because this can be detected in a port scan, and it makes your network a more attractive target. This is even more important when you're using RDP for administrative access.

If you need to access the host from outside the LAN, and you don't want that host to be visible to the public internet, then by definition you're looking at some kind of VPN. Of course, there are a variety of ways to implement this.

  • Traditional VPN technology such as IPsec, L2TP, and PPTP
  • SSL VPN can do "virtual" port forwarding over a secure connection
  • Other remote access services that use SSL, like LogMeIn

And one more thing to note: if your VPN server is configured in a particular way, you can get a point-to-point connection that only allows communication with the VPN server, and not any other hosts on the LAN.

  1. The VPN server is also the server you want to access with Remote Desktop
  2. The VPN server is configured to use a static pool of IP addresses in a different subnet
  3. The VPN server is not the default gateway for hosts on the LAN

In this scenario, the other hosts on the LAN don't have a route into the subnet used for VPN clients, so no communication can occur.

share|improve this answer

A service like LogMeIn or GotoMyPc will be the best option in this situation. They use encrypted SSL over http to connect directly to the server. You will then be able to connect from your laptop and can lock this down.

share|improve this answer
    
I've used this for my desktop - but not sure I want it running on a server. If they get hacked so does my company. –  Martin Beckett Feb 3 '12 at 20:18
    
I've used them on all my servers the SSL tunnell is secure the only weakness will be your paraphrase. –  t1nt1n Feb 3 '12 at 20:20
1  
It wasn't so much the traffic I was concerned about. If there was a backdoor discovered or their password store got hacked and a script went after every LogMeIn client on the net. –  Martin Beckett Feb 3 '12 at 20:22

I find the best solution for windows to linux RD is nomachine. Its fairly easy to setup and has plenty of security features to limit what users/machines can use it to connect to the machine. It also uses ssl to encrypt the connection.

EDIT: I misread the question. There is no windows to linux RD. Regardless I still use NoMachine for remote access regardless of platform. It also utilizes several different levels of compression if you need to change the settings to speed up a connection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.