How to make secure access of RDP?

Hello,

There's two ways, the first is to use either SSLVPN or IPsec Remote access. (Safest)

Or you can use Sophos Firewall Bookmark function for HTML5 RDP with Clientless Access VPN; You can check this KB for more information.

This article should cover the creation of a RDP Bookmark, and the Clientless Access VPN creation.

Thanks!

Hi Prism,

Thank you for your reply.

obviously VPN is most secure way.

but there would be situation when VPN is not viable due to some reason. if this is the case then by using XG IPS rules/Singatures how can i securely  publish RDP. can i implement SOPHOS XG OTP sort of thing for RDP sessoin.

regards,

RDP is the issue, the firewall cannot protect an insecure product in the wild.

ian

Having a DNAT on your RDP server result into brute force attacks. https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophos-rdp-exposed-the-threats-thats-already-at-your-door-wp.pdf

Hi, Madni Malik 

You could try to do Access Publishing with the Microsoft Server RemoteApp. 

You could activate the functionality of Microsoft Virtual Applications which is free, as you have Microsoft CAL licenses for remote users you can publish with the XG SFOS via the WAF WEB access. 

Check this URL: https://newhelptech.wordpress.com/2017/07/23/step-by-step-how-to-deploy-remote-desktop-services-in-windows-server-2016/ 

What you would be exposing to the internet is a web server or mediator that would publish the RDP access or the applications that the user requires. This would function as a mediator to grant access to the remote server without publishing with DNAT rules.

To safeguard access to the web URL even having the WAF protection you could activate the OTP for this protected URL. 

I have not tried it but I am currently doing a lab to test. I have a client who currently has the RDP published with DNAT for some points of sale. They bought some SFOS to make site-to-site connections but others to stay out. So I have to try this scheme. 

Hello Irvin,

thanks or sharing. 

by doing above i can only able to access certain application on server. can i have complete remote desktop session of a server using RDS?

regards,

Hi, Madni Malik 

Yes. You can publish the RDP app with the RDS Microsoft Service. This will help you to protect the web service with the WAF/IPS of SOPHOS FW. And even apply the OTP authentication. 

But like i say this maybe will work or not. I am trying in my lab. 

You can do that as well if you want. So you dont publish your RDP directly to the outside.