Improve RDP security: router with VPN or IP whitelist on firewall

Question

I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly suspect it's from brute force. So I have the chance to setup a new RDP security strategy.

We use a router for internet connectivity and the workstation is wired to the router. RDP is reachable from outside through port forwarding. Given that I will change the port from 3389 to some other port and all sorts of setting to improve the security. I still cannot decide on one of the following options:

1. Setup RDP only to be accessible from the local network, i.e. use 192.168.X.X as my address of RDP host. Together with a router setup with VPN, the machine can still be accessed from home. I am a bit concerned if the VPN gets hacked, the university resources will be open to others.

2. I enabled the firewall and restrict the IPs that can access the port in question. I am concerned if it is not secure enough.

Which option is better?

Answer 1

First of all,

There are always risks when opening up ressources to the internet. A VPN seems to be a reasonable approach to minimize such risks.

Now, have you thought about segreation of networks to reduce the impact of a compromised VPN access?

Also, your two options are not mutually exclusive - why not use a VPN to allow for connectivity and at the same time use IP Whitelisting to restrict access to the VPN?

Additionally, identifying the actual vector of compromise is key - just guessing is not quite a good idea.

PS: changing the default port is making everyones lives harder for almost no benefit in security - it's called "security by obscurity" and supposed to not be neccessary if everything else is in order.

Answer 2

I don't really see a benefit of not using RDP from your machine at home. If you set up a VPN connection via e.g. IPSec you can start the RDP client and connect to your workstation within the VPN tunnel via RDP. That way, your traffic cannot be listened to or altered when transported over the internet.

If your VPN gateway get's hacked, you are screwed either way. If the RDP server of a connection is compromised, because your users are not cautious, you are also screwed.

If you follow the basic instructions of the setup of your gateway, your firewall (e.g. using ACLs) and the (measured in Microsoft standards) pretty good RDP documentation you should be fine.

When you have done all that, the key for security in this setup, are your users and what safety measures they take to secure their machines at home and their workstations within the lab. Set up guidelines on how to keep a desktop clean and how to use a VPN connection properly. For instance - if your VPN client doesn't have the option included - forbid your users to use their own internet connection for private use, while using RDP. Here is a helpful NIST special publication on how to setup those guidelines, and how to evaluate a lot of security considerations.

Answer 3

For protecting my online privacy I use vpn service. Try to use it too for improving RDP security. VPN service can be useful when you need to check blocked sites or watch online tv. And for analyze the efficiency of this program I sometimes use what is my ip address good luck.