I am going to setup a dedicated server running windows server 2012 and hyper-v. I want to setup some sort of vpn that would prevent rdp access from the public internet (i.e. you have to establish vpn first to reach the server via rdp).

I know that windows server has options for this, such as rras and direct access, and forefront (an option) can do this (I think). Are any of these viable?


Well I should probably note that VPNs don't prevent access they setup tunnels between networks. Firewalls prevent what access to ports/services such as RDP.

Personally I've never been a fan of the idea of running some sort of remote access on top of a Windows box, that breaks the one service per box rule in my book.

The traditional method is to get an ASA (or Security appliance of your choice) and set it up in front of your servers. You can then setup the Windows firewall on your boxen to only accept RDP connections from IPs in range of your VPNs DHCP pool.

| improve this answer | |
  • 1
    +1, EXCEPT: RDP has it's own windos internal security appliance - that few people know -that then runs a RDP session over HTTP and allows you to connect to it (terminal services gateway) and then from there forward into the company. VERY useful, expecially if you want to connect to more than one machine, without having them all on the internet. – TomTom Jan 3 '13 at 9:46

You really don't gain anything worth the bother by doing what you propose but if you really want to do it that way then simply block RDP from outside the local network on the server's own firewall. When someone connects via the VPN they will be in the internal network, and unless that's a different subnet to the one the server is in they will be able to RDP just fine, otherwise set a rule to allow RDP from that subnet as well.

| improve this answer | |

I would stick a Linux box on the network edge and configure SSHD (SSH daemon) on it. Lock everything else down so only port 22 is accessible. You can then use an SSH client, such as Putty, to connect to your SSHD box (fully encrypted) and tunnel your RDP traffic (using SSH's built-in tunneling feature) to your target server. Voila! A poor man's VPN.

| improve this answer | |
  • I'm not sure that solves the OP issue. However I have done this before using an existing server setup for this purpose and then using SSH port forwarding and allowing RDP only from the IP address of the server. – JamesBarnett Jan 5 '13 at 0:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.