VPN or Remote Access?

Question

In what circumstances would you setup a VPN instead of just allowing Remote Desktop to a machine in a network?

Answer 1

If all you need to share is a single computer via Remote Desktop, then opening a single port to that computer is probably the easiest solution. It's extremely quick and doesn't require remote users to do anything except run their Remote Desktop Client.

If you need to share multiple computers, printers, and other devices, then allowing VPN access into your local network is probably easier. Once someone is VPN'd in, they can connect to any intranet computer allowed to them without having to poke more holes through your firewall. However, they'll need to VPN before they can do anything.

No one can tell you which one is better for your situation; one is not better than they other, they're just different. You could also just allow Remote Desktop to a single Windows Server terminal server, then users can connect to other internal computers from there. Or, if you have a Windows Server 2008 machine running IIS, you could set up the Remote Desktop Gateway feature and not have to expose any ports to the public Internet other than 443 for the HTTPS server.

Answer 2

RDP is great if you simply want to have access to a machine on an office (or home) network but the performance can be greatly limited by the connection speed you have to the computer.

Using a VPN would allow you to work on your own computer and access files on the network when you need them although obviously any large transfers would suffer due to network speed limitations as well.

There's a lot of pros and cons to both so it really does depend on what your intentions are. You may even find it handy to setup both methods so you can have the benefits of either!

Answer 3

As already mentioned by Stephen Jennings, VPN and RDP are used for two slightly different scenarios: RDP is great for the casual connection, but if you're going to have users connecting simultaneously for different purposes, I'd go with VPN as it gives you more functionality and control. Of course, what is more suitable for you entirely depends on your network configuration, how many remote users you expect to have, and the reasons for having remote connections.

One thing Stephen Jennings didn't mention is security. While both protocols use 128-bit encryption, I'd suggest that VPN is more secure as it allows validation of the server through certificates, and you can implement other authentication methods such as SecurID tokens; I've heard that RDP doesn't validate the server's identity, which effectively leaves it open to MITM attacks. Unfortunately I don't know much more about securing RDP, but I'm sure someone will mention anything important.

When it comes to usability, VPN is the defacto standard for masses of remote users who need to connect to your network. In saying that, I'd still prefer to setup a VPN connection to my home network rather than using RDP on it's own.

Answer 4

Stephen and Trent gave great answers, here a shorter one:

If you only need remote screen access to your computer, Remote Desktop (RDP) is sufficient, especially for more than one computer.

If you have a network with lots of computers, a VPN may be easier to use if you want to be able to remote desktop into any/all of them. Also, you'll be able to use Windows Network share folders and such.

Remote desktop will only require you to port forward one port (3389) on your router for one computer. A VPN will require a VPN host server if your router doesn't have that feature.