VPN or Remote Access?

Question

In what circumstances would you setup a VPN instead of just allowing Remote Desktop to a machine in a network?

Solution 1

RDP is great if you simply want to have access to a machine on an office (or home) network but the performance can be greatly limited by the connection speed you have to the computer.

Using a VPN would allow you to work on your own computer and access files on the network when you need them although obviously any large transfers would suffer due to network speed limitations as well.

There's a lot of pros and cons to both so it really does depend on what your intentions are. You may even find it handy to setup both methods so you can have the benefits of either!

Solution 2

If all you need to share is a single computer via Remote Desktop, then opening a single port to that computer is probably the easiest solution. It's extremely quick and doesn't require remote users to do anything except run their Remote Desktop Client.

If you need to share multiple computers, printers, and other devices, then allowing VPN access into your local network is probably easier. Once someone is VPN'd in, they can connect to any intranet computer allowed to them without having to poke more holes through your firewall. However, they'll need to VPN before they can do anything.

No one can tell you which one is better for your situation; one is not better than they other, they're just different. You could also just allow Remote Desktop to a single Windows Server terminal server, then users can connect to other internal computers from there. Or, if you have a Windows Server 2008 machine running IIS, you could set up the Remote Desktop Gateway feature and not have to expose any ports to the public Internet other than 443 for the HTTPS server.

Comments

[wag2639]

This really would depend on which type of VPN he implements. Not all of them are truly secure and some are unweildy (ex. openvpn) to setup. For 1 system over RDP, he could always setup a secure tunnel but that would also complicate things.

[CJ7]

@trent: can you elaborate on the MITM risk of Remote Assistance? If the passwords are one-way encrypted and the communication encryption is RC4 128-bit, what are the actual risks?

[gamal]

@wag2639 - excellent point, that's definitely something to be conscious about when choosing a particular setup.

[CJ7]

what do you think of the security risks of RDP compared to VPN?

[CJ7]

@Trent: Does VPN also have this security issue?

[Stephen Jennings]

RDP has various levels of encryption. I'm sure it works well for most purposes, but I prefer VPN or RD Gateway if you're really worried about security.