I'm trying to create a design for a secure machine, basically a Microsoft PAW, however this machine needs a VPN for use while in a home office. It will essentially only be a "clean-source machine" to further remote to a VM with tools within the work location.


  1. The PC is to be used for doing admin tasks on on-premise servers by RDP'ing to a virtual admin-desktop as a jump host.
  2. The PC should NOT reach ANY online service. ever... (updates it should get from WSUS and other services in the on-premise network after its connected).
  3. VPN server will be placed behind the same firewall as the virtual desktop.
  4. User of the PC will be normal user only, with no local admin rights.
  5. Users have the skills to take shortcuts (if found) to bypass security measures.

Q1: What VPN software (server/client) would you recommend to be installed (maybe preferably as a service on the client), to create an always-on connection?

Q2: Are the proposed solution safe from user tampering? I.E. would the user be able to change configuration files etc. and gaining access to other servers of similar server software?

Q3: Is using the Windows Firewall as a"Kill-switch" or "Lock-Down" a workable way to go, if blocking everything except the VPN software exe, or maybe better, the IP to the VPN server?

closed as too broad by Anders, Xander, Matthew, Xiong Chiamiov, crovers Jan 5 '17 at 21:17

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Software recommendations are off topic here, I'm afraid. The other two questions are probably OK, but Q2 might be a bit too broad. – Matthew Jan 5 '17 at 15:04
  • I'm not convinced this is really a PAW as Microsoft define it since you are moving the supposedly secure PC to a non-secure environment and then knocking a great big hole into the secure network to allow it in. If you MUST have home-based admin, securing RDS with multi-factor auth and only allowing from specific IP addresses and at pre-agreed dates/times would be the best route, treat the PC as any other semi-trusted device in an untrusted environment. – Julian Knight Jan 5 '17 at 17:26

Q1: I'll echo this same question. The closest I have found is Microsoft Direct Access but I haven't dug in to see if it is a viable solution. Maybe that will get you started on the right path?

Q2: If the user(admin) has admin rights to the PAW, nothing is safe from tampering. You will need to configure the PAW so the administrators using it do not have administrative rights to it.

Q3: I'm reaching here because I just don't know for sure, but I think if you use Direct Access you can force all network traffic to go through the VPN connection. what you are trying to prevent is called "split-tunnel" where VPN traffic is only used for IP addresses associated with your org and everything else goes out the home internet...this is bad.

I hope that helps some even if it isn't a complete answer!

Not the answer you're looking for? Browse other questions tagged or ask your own question.