I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly suspect it's from brute force. So I have the chance to setup a new RDP security strategy.
We use a router for internet connectivity and the workstation is wired to the router. RDP is reachable from outside through port forwarding. Given that I will change the port from 3389 to some other port and all sorts of setting to improve the security. I still cannot decide on one of the following options:
Setup RDP only to be accessible from the local network, i.e. use 192.168.X.X as my address of RDP host. Together with a router setup with VPN, the machine can still be accessed from home. I am a bit concerned if the VPN gets hacked, the university resources will be open to others.
I enabled the firewall and restrict the IPs that can access the port in question. I am concerned if it is not secure enough.
Which option is better?