Accessing Remote Desktop Protocol through a VPN

[devavictrix]

I have a cryptocoin mining rig whirring away at a remote location and want to access it over the internet using Remote Desktop built into Windows. I have managed to do this by logging into the mining rigs router and forwarding the Remote Desktop Protocol port (3389) to the private IP. In effect, any traffic to my public ip through port 3389 will be directed to the mining rig's private IP, and being on port 3389 it will be accessible by the Remote Desktop client. When I start Remote Desktop on my desktop all I have to do is type in my public ip followed by "3389".... xx.xxx.xxx.xxx:3389. It asks for the mining rigs user credentials and I'm in.

I have read that the downside to doing this is that my mining rig is open to the internet through port 3389. If you know my public IP (its "public" afterall!) and the default RDP port number (everyone can learn that its 3389) then you just need my users name and password. I have of course made the password strong but I don't know if this is enough to make my mining rig secure. Well, it isnt!

I have also read that if I setup my mining rig as a VPN server it can improve security. I have read enough so that I can set this up but I'm not convinced it will be any more secure. Please can somebody explain to me how it may be more secure?

My understanding of setting up the mining rig as a VPN server is this... Instead of opening up my mining rig to the internet through the RDP port I will be creating a VPN and opening this up to the internet. Windows uses the point-to-point tunnelling protocol (PPTP) for a VPN and this uses port 1723. Now I would connect to the remote router/VPN/mining rig using my public IP and port 1723. Once I have connected to the VPN I am effectively hardwired to the VPN so that I can then access the mining rig. I now don't have to forward traffic from port 3389 to my mining rig's private IP.

I'm confused about the "increased security" because although the mining rig isn't open to the internet the VPN is. Once you have connected to the VPN (do you just need the public IP and port number to do this??) you then only need the users username and password to access the mining rig. It seems to me the process of accessing the mining rig is pretty well the same. You just need the public IP and username and password, albeit through a different port and protocol. I could change the port number for the VPN to something different to the default but that's just moving the goalpost (slightly).

I am aware of third-party software such as Teamviewer but for the time being I'd like to persevere with Remote Desktop. I don't like installing software (!, I keep it to a minimum) and I already have something that does the job. I just want to use it more securely.

Any help/advice would be very much appreciated.

Thanks

 

[Tom Tancredi]

VPN tunneling makes the connection between where you are (sitting in Starbucks having a Latte using the Starbucks Wifi) to where the Miner is (sitting in the apartment in Los Angeles) secure from anyone ever snooping on the 'connection' between your computer and the Miner. That makes the connection secure, because even if you were 'man in the middle' faking the Starbuck$ Wifi name (spoofing) and you were on it, they couldn't "see" what your doing no matter what.

That said, otherwise I see your issue, where the 'connecting end' (Miner point) is where your worried about someone breaking the simple name and password authentication. Well there is several ways around this and all depends on how far you want to do and invest things.

First I would NOT suggest the MINER be EVER directly attached to the Internet, in anyway. Your first layer of protection is being behind the Router and it's Firewall. This first step prevents the 'passing by' or drive by attacks (think locks on the door or house). Secondly by the Internal Network IP setup (192.168.x.x) ensures that even if the router is attack from the Internet (39.127.43.230) it can't "see" nor access the internal IPs, like that of the Miner. Now if you wish to enable or configure the ROUTER to use VPN (smart and most common method) then from there you connect (now your Virtually part of the Network like you were sitting next to the Router and Miner) via RDP (smart and most common method) you would then have a TWO STEP methodology which is incredibly hard to break (given both use different user names in and passwords).
In addition, most 'servers' with a Web Interface, have basic SECURITY setups, normally inclusive of a monitoring element, i.e. SEND a EMAIL each time someone logs in, or record the IP of the connections, etc. You would need to look into the details on both the Miner and the Router for these functions. Technically everytime someone 'logs into' either one, you could send it to your cell phone (telephonenumber@yourserviceprovider) so you automatically know when someone is 'logging in' as telephone numbers are able to receive emails.
Now you COULD invest is a TOKEN KEY System. This is the ultimate way most HIGH SECURE access runs. You get a randomizing 'TOKEN' device you carry with you, you have to have it IN your hand to see the CODE it generates randomly like every 3-5 minutes which is synched via GPS to the main 'authentication servers'. With your login ID you would include the token number and that would ONLY grant you access from the 'external' connection point (for VPN, or access to your Miner's Webpage).

Those are some ideas to consider.