0

We are currently using an IP whitelist in Windows Firewall to allow only certain machines to access Remote Desktop on our servers. Unfortunately, I have a new ISP now and my external IP address has started changing every week. Is there an easy alternative I can use instead of the IP whitelist in Windows Firewall?

5
  • 2
    Get a static IP, if this is a business, it should be on a business grade account.
    – DanBig
    Sep 5, 2013 at 17:56
  • @DanBig, I believe he is talking about remote administration from his home. The problem is that his home connection isn't static.
    – Zoredache
    Sep 5, 2013 at 20:46
  • 1
    My suggestion, require a VPN connection be established instead of whitelisting based on IP.
    – Zoredache
    Sep 5, 2013 at 20:47
  • @Zoredache, after re-reading, i think you are correct. VPN all the way.
    – DanBig
    Sep 6, 2013 at 11:59
  • Have you considered something like LogMeIn?
    – joeqwerty
    Sep 6, 2013 at 16:25

3 Answers 3

2

I would seriously recommend not putting your server directly on the Internet. As good as the Windows Firewall is these days, your risking the integrity of the machine and potentially anything that it has inbound connection to. Tools like Nessus and Metasploit have completely removed the complexity of exploit identification and deployment.

I would consider implementing some kind of SSL VPN and proxy your RDP traffic through it. The SSL VPN endpoint can then carry out authentication / endpoint compliance checks and possibly even remediation.


Apologies, I can't add comments these days, so I'll have to tag my comment here:

Even for you HTTP(S) traffic, I'd recommend some kind of 3rd party (non-host) firewall. The reason being that if your host firewall becomes compromised, so does your server. I must admit, I'm used to larger enterprise deployments, where security budgets exist, so I'd have to look around myself for SOHO style devices.

2
  • Well, can't really hide my web server from the Internet. That would defeat the purpose. Suggestions for a free/cheap VPN solution? We are a very small shop.
    – user21146
    Sep 5, 2013 at 21:27
  • @user21146 Try pfSense. It has really nice OpenVPN support
    – tegbains
    Sep 6, 2013 at 18:29
1

I agree with Simon above. Another option you can look into is PhoneFactor. It's free for up to 25 users I believe.

Agent runs on server, can work with Active Directory/LDAP/local users for back-end authentication; you just need to configure a phone number and choose whether to have a voice call or SMS message, additional PIN is optional. The agent ties into the logon process and after username and password authentication, the agent then phones home to PhoneFactor to initiate the callback verification process; the logon "hangs" and waits for the call to be completed and I'm usually in after 15 seconds, so have never had an issue with it timing out.

With the PIN option added onto your user account (in the agent settings), you're essentially getting three-factor authentication as there would be two "something you know" requirements (well, 4 if you disable the administrator account and create a unique admin user for yourself): the local user password and the PhoneFactor PIN; the third factor would be "something you have", which is your cell phone.

Works great; use it for our Terminal Server as I'm often in places where outbound VPN can be troublesome.

1
  • +1 for two-factor authentication.
    – joeqwerty
    Sep 6, 2013 at 16:24
0

If I'm reading the question correctly, you need to remotely administer boxes from varying IP's your ISP assigns via DHCP to your end user account such as at home or from a cellular modem and you can't possibly try to whitelist every IP at your firewall you might be connecting from?

We had the same issue and unable to define fixed IP's for roving admins with a fairly manageable number of servers,

  • Created Remote Desktop Invitations for distribution to the authorized remote admins.
  • Modified the listening port from 3389 for just another but not necessarily fool proof (nothing is fool proof in systems security) to a different non wellknown port. Based on the version of server, we had to modify the port in the servers registry http://support.microsoft.com/kb/187623

Services config
notepad.exe %systemroot%\system32\drivers\etc\services

The method enabled predefined roving admins traveling to remote locations to remotely admin their systems in moments of necessity.

2
  • Not seeing anything re: Remote Desktop Invitations. Are you mixing up Remote Desktop with Remote Assistance? Aren't those two different things?
    – user21146
    Sep 5, 2013 at 21:29
  • I don't see changing the RDP port as being very effective. Anyone running a port scan will discover the obfuscated port.
    – joeqwerty
    Sep 6, 2013 at 16:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .