0

For security reasons, I want to be able to connect to a Windows 2008 dedicated web server using Remote Desktop only from one DNS alias. The reason I want to use a DNS alias and not an IP address is that I don't have a static IP address from my ISP, I have a dynamic IP that changes every time I restart the DSL modem.

Your help is much appreciated ...

2 Answers 2

1

As far as I am aware, RDP does not send the hostname being connected to in its connection headers. The certificate mismatches you receive sometimes when connecting to hosts is all done client-side.

Because of this, I don't think there will be any way to achieve this. If the hostname does not appear in the TCP packets, then there's no way to filter on it.

4
  • This makes sense but on the other hand I'm working with a web host that only allows access to your dedicated server from a specific IP or DNS alias. I don't have the exact details how they do it hence the reason for my question.
    – Mee
    Dec 22, 2009 at 3:14
  • +1 - The hostname being used by and RDP client isn't exposed anywhere that will allow you to configure the server to differentiate connection attempts. There is no way to do what he poster is looking for, and no good reason to do it anyway. It's just security by obscurity, which is arguably worse than no security at all. Dec 22, 2009 at 4:05
  • Actually, the RDP client does send the client name in the clientname variable, but I don't believe it's accessible from the TCP stream in such a way that the Windows Firewall could read it and make use of it in a rule (as Evan has implied). Additionally, I don't believe the Windows Firewall allows the creation of rules based on host names, only ip addresses or ip address ranges.
    – joeqwerty
    Dec 22, 2009 at 4:23
  • To clarify: The client name passed in the clientname variable is the NetBIOS machine name not the FQDN.
    – joeqwerty
    Dec 22, 2009 at 4:25
0

It seems to me that the solution is to use a dynamic DNS service to map the "alias" to whatever ip address you get from your ISP. This is no different than using a dynamic DNS service to assist in hosting web and email services on a dynamic ip address.

4
  • Thanks for your answer. Actually I don't have a problem creating the DNS alias (I can use no-ip.com for that), but I don't know what to configure in Windows 2008 to make Remote Desktop only works with the DNS alias.
    – Mee
    Dec 22, 2009 at 2:02
  • OH, I get it. You want to create a rule in the Windows Firewall on the server that allows RDP connections only from the DNS "alias" that's mapped to your dynamic ip address on your client machine. Am I understanding you correctly?
    – joeqwerty
    Dec 22, 2009 at 2:16
  • Yes, this is exactly what I want
    – Mee
    Dec 22, 2009 at 3:09
  • In that case, I don't think it's possible. I've looked at the Windows Firewall on W2K8 and can't see a way to restrict by host name, only ip addresses or ip address ranges.
    – joeqwerty
    Dec 22, 2009 at 4:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .