1

We are needing to use RDP for a client, but the VPN and internet connection is just too flaky to use VPN anymore. VPN is NOT an option anymore for us.

Currently the plan is to open a bunch of ports (not 3389) on the firewall, and direct them to the 3389 ports internally. The issue with security arises when all that is stopping access is a single RDP connection with the correct password.

We could set up rules on the firewall to prevent access to only certain IP addresses, but this becomes an issue with dynamic IP's.

What would be the next best option to secure VPN?

Improve this question
2
  • I'm struggling to see how simply just using RDP isn't also going to give you "flaky" results. The overhead of a VPN connection isn't that much more so wouldn't it be a better solution to find out what's causing the "flakiness" of your inbound connectivity?
    – Kinnectus
    Apr 23, 2015 at 9:28
  • @BigChris To be honest, Most users have Macs, and since the latest mac updates, all of them, including our testing on a seperate network have had drops in the VPN connectivity. This isn't an issue with Windows.
    – HippoDuck
    Apr 23, 2015 at 14:14

2 Answers 2

Reset to default
2

Use rdp certificate authentication.

@Scott Chamberlain described this https://superuser.com/a/750943/440206:

Yes but you will need to install and configure your Remote Desktop Session host to use a Remote Desktop Gateway to do it.

Once you are using a Remote Desktop Gateway you can set up Remote Desktop Connection Authorization Policies (RD CAPs) and Desktop Resource Authorization Policies (RD RAPs) in those you can set things up like requiring that a connecting machine has a client certificate (per machine or per user).

Improve this answer
0

You could look into DirectAccess for secure access to your network:

DirectAccess allows remote users to securely access internal network file shares, Web sites, and applications without connecting to a virtual private network (VPN). An internal network is also known as a private network or intranet. DirectAccess establishes bi-directional connectivity with an internal network every time a DirectAccess-enabled computer connects to the Internet, even before the user logs on. Users never have to think about connecting to the internal network and IT administrators can manage remote computers outside the office, even when the computers are not connected to the VPN.

Source Link

Improve this answer
1
  • Not heard of this one before, I will look into it more.
    – HippoDuck
    Apr 23, 2015 at 9:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .