4

I'm a developer of a server-based web application. My client has organised a virtual server to be hosted with one of their ISPs. The server is running Windows Server 2008 R2. It's a completely standalone machine (i.e. no domain, no policies pushed down, etc) and I have total control over it. I should note that while I know a reasonable amount about Windows, I'm not a server admin myself and don't know a great deal about how to manage servers.

However, the ISP doesn't provide any sort of VPN or other security for accessing the machine. They've opened the ports I need publicly open, but the RDP ports are causing me some concern. I need to be able to RDP in from a few machines, and unfortunately some of these have dynamic IPs due to being mobile machines.

Although the application is minimal risk, I still really don't like having RDP open to the world as well - unfortunately, the options they've given me are:

  • open RDP to the world so I can use Windows Firewall on the server to manage the IPs that are allowed to access the machine
  • open RDP to specific IPs at their firewall level

I was wondering if there are any other solutions anyone can think of which will let me secure RDP but somehow open it to particular IPs as I need to, and that would work on a standalone machine like this?

Improve this question

4 Answers 4

Reset to default
2

A software VPN is another option. Unfortunately I haven't actually implemented one myself so you'd have to do a little research there. Maybe try OpenVPN?

I'd suggest you look at This "top 5" list.

logmein might suit your needs ... it works for me.

Improve this answer
2
  • Thanks very much - I hadn't thought of LogMeIn too, I use this for some of my desktops but no servers. I'll check it out - thanks for the suggestion.
    – John
    Jun 22, 2011 at 4:24
  • You bet, hope it works for you.
    – Daniel B.
    Jun 22, 2011 at 6:01
3

Perhaps you could implement your own VPN? OpenVPN is cross platform and could be run on that Windows machine; then you wouldn't need to leave RDP open to the world.

Improve this answer
1
  • Thanks for the suggestion - I took a quick look at OpenVPN, it looks like it would do exactly what I want, but it also seems to need a bit more infrastructure knowledge and experience than I have! However I'll pass this on to a couple of infrastructure friends and see if I can call in a favour - thanks!
    – John
    Jun 22, 2011 at 4:23
2

One thing I've done for some Security through Obscurity is to change the Remote Desktop port number from the default 3389, to something else. That and a very strong username/password combo on the server is about all you're going to be able to do without adding additional software to the mix (something I always try to avoid whenever possible).

You could try running an SSH server on it (I think there are Windows ports of SSH, never used any myself) and you could setup an SSH tunnel, through which you could run Remote Desktop.

Improve this answer
1
  • Thanks - changing the RDP port is a good idea as a very worst case, so I'll definitely organise that.
    – John
    Jun 22, 2011 at 4:24
1

Enabling the PPTP on the server and requiring one or some of the encrypted authentication mechanisms should be fine as the RDP session is also encrypted as well. No new software for the most part, mainly just enabling the PPTP functionality and then running the RDP through it (and closing its port to the rest of the Internet).

Improve this answer
1
  • Thanks for the suggestion - I'd be a bit afraid of screwing something up if I did this myself, but I'll take a look at it!
    – John
    Jun 22, 2011 at 4:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .