0

I've seen plenty of people suggesting that you can limit RDP access to a range of IP addresses by using IPsec instead of using the built in Windows Firewall. This is exactly what I need to be able to do, but I have not been able to find any examples of how to actually set it up...and I'd rather not mess it up and boot myself off the server and not be able to reconnect.

Can anybody explain how to use IPsec to limit RDP access to a range of IPs?

2 Answers 2

1

IPSEC is not the tool for this. You need to use a firewall of some kind: Either the built-in Windows firewall or one positioned elsewhere on your network.

You may want to consider using IPSEC to encrypt & authenticate the RDP traffic in addition to a firewall to restrict access to the RDP port, but these are separate considerations from a security standpoint.


Note that you can effectively use IPSEC to block access to RDP (simply require IPSEC encryption/authentication on all RDP traffic, and anyone trying to talk without encryption/authentication won't get through), but this is a side effect and isn't the most correct approach to restricting access. It also means more work for your server (it's going to try to negotiate IPSEC for each connection attempt, rather than simply refusing the attempt if you use a standard firewall to restrict access to the port).

3
  • Windows firewall is not really a feasible solution for me right now. I do not want to block any communication besides RDP, and you'd can't just turn on RDP blocking...you have to add exceptions for everything you want to allow. I can not afford to miss anything and have downtime for this public facing server.
    – wham12
    May 16, 2011 at 21:21
  • 1
    @wham12 - this is how firewalls work (at least if they're set up by anyone sane): You block everything and allow only what you need. Conduct an assessment to determine what ports/services you need available (and to whom) and proceed accordingly. A firewall that just blocks one or two ports is the equivalent of trying to stop a tank division with a cardboard cutout...
    – voretaq7
    May 16, 2011 at 21:41
  • I understand that. We have a physical firewall unit seperate from the server, which is configured correctly...but I can not access it's settings (hosted externally). I just need to limit RDP to a certain range of IPs as soon as possible.
    – wham12
    May 17, 2011 at 14:40
0

This is an old thread, but I just ran across this today search for the same thing as the requester. Unfortunately, the responses are terrible, as they are in a couple of other threads I've found. Using the Windows FW, which is not a "real" firewall, is much better if we were able to easily use the Security Connection Rules for something like limiting RDP access to specific hosts, because it enables the FW rules to use computer accounts rather than IP addresses. IP addresses are more difficult to manage; computer names are much easier to manage than IP addresses.

It's sad that seemingly no one on the Internet has posted some simple steps to facilitate using the "remote computers" tab of the Windows FW rules to limit access for something like RDP. I have had a call open to Microsoft Premier Support for over a day and still don't have a working solution.

As for the rules, overall, they are not prioritized and seem to be in a least-privilege wins model. If you created an "any-to-any" rule for ALL ports (and don't set the services or programs so that ALL services and programs are included) EXCEPT for RDP (TCP/3389), you would allow all traffic to and from the server, and then you could add a rule SPECIFICALLY for RDP (TCP/3389) where you could limit the scope of RDP access.

By the way, using the above suggestion, when enabling the WIndows FW, you could leave all of the default rules in place, simply disable the RDP-specific rules, add the "any-any except RDP" rule, and add the new RDP access rule. That way, if you later decide to further lock down access, you already have working rules in place.

Also, using a GPO is a lot easier to manage while testing because if you mess something up, you can simply revert on the GPO. You can filter the GPO to a specific computer, too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .