Safe to allow RDP access from External

[SWICT]

Hi All,

So after receiving all our ees documentation and the additional CALS etc we successfully set up and configured a RDS server for users to connect to. This all works great internally, Id like to open this up for external access, now doing a quick search Ive logged a change request with the SWGFL to allow traffic on port 3389 and assign us an external ip pointing to our internal static ip

 

Is there anything else I should take in to consideration? The server itself is fully patched with the latest A/V and users are locked down via GPOs

 

Any guidance or a pointer in the right direction would be great

 

Thanks

 

Mike

[MicrosoftTechy]

I would not suggest doing this, maybe Remote Gateway or somthing? or VPN? Only last week i had to deal with a problem where someone was brute forcing a RDP session ( Port mapped 3389 to server ) and managed to get it !!!!

 

Remote Desktop gateway over 443 or VPN is much more secure!!

[SYNACK]

I'd look into the RDS role on Server 2008 and look into how much CALs cost.

[SWICT]

Ok sounds like a much better plan, this our first attempt at setting up anything for remote access since our manager went off long term sick

 

Ill have a google of the Remote Desktop Gateway, vpn we already use SSL Explorer which works great other than it doesnt support macs via RDP

[Achandler]

Use RD gateway, then it all goes over 443 as well which means you defo won't need more ports opening up.

[Domino]

SSL Explorer which works great other than it doesnt support macs via RDP

 

Do you mean macs RDPing to a windows machine on the network?

 

The microsoft rdp client for mac doesn't currently support remote desktop gateway - there are other alternatives (iTAP) that do, but most have a cost associated

[SWICT]

Good to know, if the RDP client for Mac doesnt support it might not be much point , We also use irdesktop on ipads to connect to the RDS server allowing teachers to fill in sims on their ipad

[ijk]

We do the following:

 

Bitvise SSH server running on a non-standard port.

Single SSH user allowed to connect (multiple concurrent sessions allowed) but no shell.

RDS server accepting connections, again on a non-standard port.

 

Users are provided with a copy of Bitvise Tunnelier and a pre-configured config file, which they can use to launch the client. (We have a few Mac users who like to connect and I teach them how to create the tunnel on the terminal.) This makes the connection, asks them for a password and then launches the RDP client preconfigured to connect to the RDS server through the tunnel. They log into the RDS server with their usual credentials.

 

It seems to work okay, but we're a very small institution with few users and I don't know how it would scale up.