Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For security reasons, I want to be able to connect to a Windows 2008 dedicated web server using Remote Desktop only from one DNS alias. The reason I want to use a DNS alias and not an IP address is that I don't have a static IP address from my ISP, I have a dynamic IP that changes every time I restart the DSL modem.

Your help is much appreciated ...

share|improve this question

As far as I am aware, RDP does not send the hostname being connected to in its connection headers. The certificate mismatches you receive sometimes when connecting to hosts is all done client-side.

Because of this, I don't think there will be any way to achieve this. If the hostname does not appear in the TCP packets, then there's no way to filter on it.

share|improve this answer
This makes sense but on the other hand I'm working with a web host that only allows access to your dedicated server from a specific IP or DNS alias. I don't have the exact details how they do it hence the reason for my question. – Mee Dec 22 '09 at 3:14
+1 - The hostname being used by and RDP client isn't exposed anywhere that will allow you to configure the server to differentiate connection attempts. There is no way to do what he poster is looking for, and no good reason to do it anyway. It's just security by obscurity, which is arguably worse than no security at all. – Evan Anderson Dec 22 '09 at 4:05
Actually, the RDP client does send the client name in the clientname variable, but I don't believe it's accessible from the TCP stream in such a way that the Windows Firewall could read it and make use of it in a rule (as Evan has implied). Additionally, I don't believe the Windows Firewall allows the creation of rules based on host names, only ip addresses or ip address ranges. – joeqwerty Dec 22 '09 at 4:23
To clarify: The client name passed in the clientname variable is the NetBIOS machine name not the FQDN. – joeqwerty Dec 22 '09 at 4:25

It seems to me that the solution is to use a dynamic DNS service to map the "alias" to whatever ip address you get from your ISP. This is no different than using a dynamic DNS service to assist in hosting web and email services on a dynamic ip address.

share|improve this answer
Thanks for your answer. Actually I don't have a problem creating the DNS alias (I can use for that), but I don't know what to configure in Windows 2008 to make Remote Desktop only works with the DNS alias. – Mee Dec 22 '09 at 2:02
OH, I get it. You want to create a rule in the Windows Firewall on the server that allows RDP connections only from the DNS "alias" that's mapped to your dynamic ip address on your client machine. Am I understanding you correctly? – joeqwerty Dec 22 '09 at 2:16
Yes, this is exactly what I want – Mee Dec 22 '09 at 3:09
In that case, I don't think it's possible. I've looked at the Windows Firewall on W2K8 and can't see a way to restrict by host name, only ip addresses or ip address ranges. – joeqwerty Dec 22 '09 at 4:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.