2

I have a vendor who needs to connect remotely to one of our servers. What I thought I would do is setup a NAT rule in our firewall. I have a public IP address that I will have translated to the local server address so that then the vendor just needs to RDP to the public IP address. Is this a secure way to have the vendor connect? I can restrict the service to port 3389 and set the source IP address to only accept the vendor's public IP address.enter image description here

2
  • 1
    Setting IP restrictions on the incoming traffic would be helpful but I'd also go another step further and change the port to a non-standard port to avoid extra traffic from port scans. Since 3389 is a known service port for RDP it is more likely to be in port scan lists than something like 48399. You should be able to translate the port from the non-standard to 3389 on inbound traffic and the reverse of that going out to avoid having to reconfigure your server for all RDP traffic.
    – Mike Naylor
    Feb 18, 2014 at 20:54
  • 3
    And if you're very concerned about security create a limited user account in AD that only had rights on that server... but that's not a Network Engineering question. Just my 2 cents.
    – Mike Naylor
    Feb 18, 2014 at 20:56

1 Answer 1

1

Source address restriction is a good idea if your vendor use static IP addresses.
Btw, as Mike Naylor mentioned, you should translate to non-standard port instead of 3389 to prevent insider threats from your vendor.
The last point is you can limit connection rate to prevent brute-force or flood attacks even when attacker know the service's port.

2
  • 1
    Can you please elaborate in 'insider threats from your vendor' as his question is specifically asking how to give vendor access, they will need the port number regardless. Nov 26, 2014 at 16:36
  • Sorry for the late reply, regarding "insider threats from your vendor" I mean one of their machines could be compromised and infected malware that automate scanning or looking for other machine on standard ports (e.g 22 for *nix, 3389 for Windows) to detect it was Linux/Windows machine and making their way to attack then.
    – incous
    Oct 22, 2015 at 3:05

You must log in to answer this question.