Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This situation is a little unique in that I need to access the desktop (will be running on EC2, w2k8 R2) from behind my work firewall using my work laptop (win xp with no ability to install anything). I do not have Java on my laptop, only ports open from work are http & https. I understand xp's tsclient can't use TS gateway. So my only option seems to be an encrypted VNC session. I am unable to find any free or near-free versions of VNC servers that would handle encryption via https. And Oh btw, I do have an SSL certificate from a provider for secure access via https.

I tried searching on the net quite a bit, but nothing seemed to simply work for me this time. Any help would be truly and greatly appreciated.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Not really sure where you got the idea WinXP clients can't connect to a TS Gateway. We used to do it all of the time until we replaced them with Win7. The only requirement is that you have the latest version of the MSTSC package installed. If you're running SP3, like you should be, you should have the latest version.

Regardless, it sounds a lot like you are trying to bypass your IT department, as SysAdmins, we don't really like to help in situations where people are trying to circumvent their internal team. If its a legit business need, go talk to them, they won't bite. If they do you have bigger problems!

share|improve this answer
    
Thanks for the answer Brent. All I need is the ability to run my brokers Java trading app for the occasional order. I talked to the IT guys about getting Java, and they empathized with me but couldn't help because of policy. In fact the idea came from a buddy in this team. –  Generalenthu Sep 13 '12 at 0:52
    
Just a suggestion but did you ask them about bringing in your own laptop to connect to the guest WiFi? This would probably be best, no expensive EC2 instance and you don't compromise policies. –  Brent Pabst Sep 13 '12 at 2:29
    
unfortunately, there is no guest wifi. the other option was to get my laptop and get a tethering plan for the iphone. And Ec2 turns out to be pretty much a free option when I launch the occasional spot instance. I do abide by the spirit of the rules though and appreciate your concern. –  Generalenthu Sep 13 '12 at 3:40
    
@Generalenthu Smart phone app or 3G/4G card to use the cell network to access your broker? –  HopelessN00b Sep 13 '12 at 6:27
    
Just got me thinking but you could always use a web-based program like LogMeIn or GoToMyPC to connect to your computer running at home. Works great for me and doesn't require any firewall changes or exposing your computer directly to the internet. –  Brent Pabst Sep 13 '12 at 12:35

Well... given that I have the same problem regarding our corporate policy (as a SysAdmin where I work, even), and was explicitly instructed by my superiors I could and should use the idea below to "workaround" some of our policy constraints, I don't see the harm in sharing the knowledge.

http and https are not ports, they're protocols. Ports have numbers. The default port used for http is 80 (with 81 and 8080 being somewhat common alternate values), and the default port for https is 443. There's nothing saying that traffic on those protocols can't use a different port, or different protocols can't use those ports instead of the default protocols.

Given that, there's nothing preventing you from setting up a TS/RDP server at another location (perhaps at one's home, or on one's cloud instance) that listens for incoming connections on a non-standard port for RDP (perhaps port 443) and then attempt to connect to it from behind the corporate firewall by instructing mstsc.exe to connect out over a non standard port (the same non-standard port being listened to on the other end, like 443 in this purely hypothetical example). Through this RDP session, one could control the remote computer and, for example, run a Java app to execute occasional trades with one's broker. Or anything else that comes to mind.

This may or may not actually work, with the other options that enterprise firewalls have for restricting traffic, but it might, too.

Of course, if you try this, you'd want to make sure the remote computer (perhaps at one's home, or on one's cloud instance) is properly locked down, secured with a strong password on all accounts, with strong firewall rules to prevent being "hacked," is configured to accept RDP connections, is configured to listen on the desired port, and will actually receive inbound traffic, by configuring DMZ or port forwarding rules on the router in front of it, if applicable. And, of course, if you're directing your TS/RDP server to listen on port 443, be aware that it will try to serve https traffic as well, unsuccessfully, which would result in actual https traffic on port 443 to the machine in question failing.

If you wanted to try something like this, you could search around here or at SuperUser for answers on how to achieve all of that.

share|improve this answer
    
That's a good point. You can always run a Windows box directly off the internet. I guess I just try to avoid this simply because of the potential security risk. –  Brent Pabst Sep 13 '12 at 12:34
1  
I did go down this path and figured RDP server doesn't work if the port is less than 1000. I think it was possible to do that in the past. I haven't checked if 8080 could be used for this purpose, but TS gateway works fine for me. Also, to your other point, java app > web browser > smartphone app. I am in the middle trying to move up. –  Generalenthu Sep 15 '12 at 16:48
    
@generalenthu OK, you probably found that it didn't work below port 1024, which would be because that's the border between two categories of ports that are treated differently by firewallls ("low" and "high" port ranges). If that's the case, you would probably not be able to easily find a way around the restrictions on your corporate network, and probably have to live with just accessing this app from your smartphone or home. Seems like dumb policy to me, but that's not always anything we have any control over. :( –  HopelessN00b Sep 16 '12 at 4:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.