Securely access a win2k8 server from behind a firewall

Question

This situation is a little unique in that I need to access the desktop (will be running on EC2, w2k8 R2) from behind my work firewall using my work laptop (win xp with no ability to install anything). I do not have Java on my laptop, only ports open from work are http & https. I understand xp's tsclient can't use TS gateway. So my only option seems to be an encrypted VNC session. I am unable to find any free or near-free versions of VNC servers that would handle encryption via https. And Oh btw, I do have an SSL certificate from a provider for secure access via https.

I tried searching on the net quite a bit, but nothing seemed to simply work for me this time. Any help would be truly and greatly appreciated.

Answer 1

Not really sure where you got the idea WinXP clients can't connect to a TS Gateway. We used to do it all of the time until we replaced them with Win7. The only requirement is that you have the latest version of the MSTSC package installed. If you're running SP3, like you should be, you should have the latest version.

Regardless, it sounds a lot like you are trying to bypass your IT department, as SysAdmins, we don't really like to help in situations where people are trying to circumvent their internal team. If its a legit business need, go talk to them, they won't bite. If they do you have bigger problems!

Answer 2

Well... given that I have the same problem regarding our corporate policy (as a SysAdmin where I work, even), and was explicitly instructed by my superiors I could and should use the idea below to "workaround" some of our policy constraints, I don't see the harm in sharing the knowledge.

http and https are not ports, they're protocols. Ports have numbers. The default port used for http is 80 (with 81 and 8080 being somewhat common alternate values), and the default port for https is 443. There's nothing saying that traffic on those protocols can't use a different port, or different protocols can't use those ports instead of the default protocols.

Given that, there's nothing preventing you from setting up a TS/RDP server at another location (perhaps at one's home, or on one's cloud instance) that listens for incoming connections on a non-standard port for RDP (perhaps port 443) and then attempt to connect to it from behind the corporate firewall by instructing mstsc.exe to connect out over a non standard port (the same non-standard port being listened to on the other end, like 443 in this purely hypothetical example). Through this RDP session, one could control the remote computer and, for example, run a Java app to execute occasional trades with one's broker. Or anything else that comes to mind.

This may or may not actually work, with the other options that enterprise firewalls have for restricting traffic, but it might, too.

Of course, if you try this, you'd want to make sure the remote computer (perhaps at one's home, or on one's cloud instance) is properly locked down, secured with a strong password on all accounts, with strong firewall rules to prevent being "hacked," is configured to accept RDP connections, is configured to listen on the desired port, and will actually receive inbound traffic, by configuring DMZ or port forwarding rules on the router in front of it, if applicable. And, of course, if you're directing your TS/RDP server to listen on port 443, be aware that it will try to serve https traffic as well, unsuccessfully, which would result in actual https traffic on port 443 to the machine in question failing.

If you wanted to try something like this, you could search around here or at SuperUser for answers on how to achieve all of that.