I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.

I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in the firewall for our local office's IP and RDP directly w/o VPN?

It's just way, way more convenient to be able to just double click an RDP icon and not have to turn off another VPN I already have to use for another hosting environment so that I can turn on the Azure VPN every time I want to log on to an Azure VM. But I also don't want to be doing something that's stupidly insecure.


VPN with 2FA authentication is the way to go.

First of all you can't do 2FA with RDP, meaning you increase security risk significantly.

RDP has had several vulnerabilities, a few of the most recent 'BlueKeep' CVE-2019-1181, CVE-2019-1182, CVE-2019-0708.

This is the scenario where convenience shouldn't win.

|improve this answer|||||
  • There's not really a question of whether I will be using RDP. Any suggestion that I don't use RDP is a nonstarter. It's just a question of whether doing it without a VPN over a hole in the firewall that is restricted to incoming requests from the IP of my local office is unreasonably unsafe as compared to doing it over VPN. – BVernon Aug 28 '19 at 22:37
  • Though maybe you are simply implying that because of RDP's insecurities, I should use a VPN. If that's the case, I would be more interested in knowing why access to public IP that will only listen to requests from my IP is particularly unsafe if you have anything to say about that. – BVernon Aug 28 '19 at 22:39
  • Or if you were suggesting to not use RDP at all, then that's literally like saying I should quit doing my job because there is no feasible way I complete the tasks I need to do without it. That is, there may exist ways to do each individual task I do without RDP, but I would literally be spending all my time learning how to do that rather than actually doing my job. – BVernon Aug 28 '19 at 22:46
  • @BVernon having the rdp as less publicly exposed creates less risk. Why not just setup site to site VPN with your Azure infrastructure? It will essentially be the same from a usability perspective, but you will avoid potential configuration mistakes. – Raimonds Liepiņš Aug 29 '19 at 7:29
  • @BVernon no pun intended here, but RDP was actually never intended for system management in the first place :). That being said I use it as well for most non-automated tasks. – Raimonds Liepiņš Aug 29 '19 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.