Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In what circumstances would you setup a VPN instead of just allowing Remote Desktop to a machine in a network?

share|improve this question

If all you need to share is a single computer via Remote Desktop, then opening a single port to that computer is probably the easiest solution. It's extremely quick and doesn't require remote users to do anything except run their Remote Desktop Client.

If you need to share multiple computers, printers, and other devices, then allowing VPN access into your local network is probably easier. Once someone is VPN'd in, they can connect to any intranet computer allowed to them without having to poke more holes through your firewall. However, they'll need to VPN before they can do anything.

No one can tell you which one is better for your situation; one is not better than they other, they're just different. You could also just allow Remote Desktop to a single Windows Server terminal server, then users can connect to other internal computers from there. Or, if you have a Windows Server 2008 machine running IIS, you could set up the Remote Desktop Gateway feature and not have to expose any ports to the public Internet other than 443 for the HTTPS server.

share|improve this answer
what do you think of the security risks of RDP compared to VPN? – CJ7 Jun 19 '10 at 3:42
RDP has various levels of encryption. I'm sure it works well for most purposes, but I prefer VPN or RD Gateway if you're really worried about security. – Stephen Jennings Jun 19 '10 at 5:15

RDP is great if you simply want to have access to a machine on an office (or home) network but the performance can be greatly limited by the connection speed you have to the computer.

Using a VPN would allow you to work on your own computer and access files on the network when you need them although obviously any large transfers would suffer due to network speed limitations as well.

There's a lot of pros and cons to both so it really does depend on what your intentions are. You may even find it handy to setup both methods so you can have the benefits of either!

share|improve this answer

As already mentioned by Stephen Jennings, VPN and RDP are used for two slightly different scenarios: RDP is great for the casual connection, but if you're going to have users connecting simultaneously for different purposes, I'd go with VPN as it gives you more functionality and control. Of course, what is more suitable for you entirely depends on your network configuration, how many remote users you expect to have, and the reasons for having remote connections.

One thing Stephen Jennings didn't mention is security. While both protocols use 128-bit encryption, I'd suggest that VPN is more secure as it allows validation of the server through certificates, and you can implement other authentication methods such as SecurID tokens; I've heard that RDP doesn't validate the server's identity, which effectively leaves it open to MITM attacks. Unfortunately I don't know much more about securing RDP, but I'm sure someone will mention anything important.

When it comes to usability, VPN is the defacto standard for masses of remote users who need to connect to your network. In saying that, I'd still prefer to setup a VPN connection to my home network rather than using RDP on it's own.

share|improve this answer
This really would depend on which type of VPN he implements. Not all of them are truly secure and some are unweildy (ex. openvpn) to setup. For 1 system over RDP, he could always setup a secure tunnel but that would also complicate things. – wag2639 Jun 18 '10 at 7:35
@trent: can you elaborate on the MITM risk of Remote Assistance? If the passwords are one-way encrypted and the communication encryption is RC4 128-bit, what are the actual risks? – CJ7 Jun 18 '10 at 9:02
@wag2639 - excellent point, that's definitely something to be conscious about when choosing a particular setup. – ItsOnlyOneLineOfCode Jun 18 '10 at 14:26
@Craig Johnston - the (dated) SecuriTeam article will explain the MITM attack. As long as the connection isn't using Network Level Authentication, this MITM should work as the client protocol version will be downgraded to a vulnerable version. – ItsOnlyOneLineOfCode Jun 18 '10 at 16:19
@Trent: Does VPN also have this security issue? – CJ7 Jun 19 '10 at 3:43

Stephen and Trent gave great answers, here a shorter one:

If you only need remote screen access to your computer, Remote Desktop (RDP) is sufficient, especially for more than one computer.

If you have a network with lots of computers, a VPN may be easier to use if you want to be able to remote desktop into any/all of them. Also, you'll be able to use Windows Network share folders and such.

Remote desktop will only require you to port forward one port (3389) on your router for one computer. A VPN will require a VPN host server if your router doesn't have that feature.

share|improve this answer

I will use VPN if I want secure remote access to a network or a computer. Rest, I will prefer using logmein, GoSupportNow, GoToMyPC etc. remote support tools for remotely accessing computers.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .