RDP as an alternative to Teamviewer

Jump to latest Follow Reply
S

schnackenpfefferhausen

Ars Centurion
2,065
  • #1
    Just wanted to follow up on my previous thread (I presume closed because it's too old?)

    I've switched to using RDP. This meets my most common use cases, which is for convenience on my home network. I haven't taken any explicit steps to make my machine accessible/inaccessible over the Internet (port forwarding, firewall rules or the like..), and I'm not actually sure if it's accessible that way.

    It strikes me as curious why no one suggested this in the earlier thread. Is there any particular reason why using RDP is a bad idea (security?)?
     
    Ardax

    Ardax

    Ars Legatus Legionis
    19,076
    Subscriptor
  • #2
    There's two main reasons that RDP might not have been suggested. First, while it can be secure, it really hinges on your user passwords. Since they're likely to be MS account passwords these days, that might be less of an issue than before. I'm not sure what its attack surface looks like online, since many will use it in conjunction with VPNs professionally.

    Note that if you haven't taken any steps to expose RDP to the rest of the internet, this should only work on your LAN.

    The more pressing reason is that it only works with Pro SKUs of Windows, so most users don't have access to it since they're running Home SKUs.
     
    O

    Oddabe19

    Ars Praefectus
    4,861
  • #3
    I'm not entirely sure what you're asking, but exposing 3389 to the internet is bad. Very, very bad. Outside of SSH and Telnet, I believe it's one of the most attacked protocols. Keeping it internal is fine.

    Exposing RDP should only really be done if:
    1. You're using VPN to your network (OpenVPN; Wireguard; Unifi; Cisco; etc...), which effectively makes it local
    2. A remote desktop gateway, with MFA and still locked down to only allow certain IPs. Should be in combination with #1.
     
    • Like
    Reactions: continuum
    L

    Lord Evermore

    Ars Scholae Palatinae
    1,490
    Subscriptor++
  • #4
    It (probably) wasn't closed because it's old. Years-old threads get replies out of the blue, usually from spammers.

    RDP probably wasn't suggested because you started out saying it needed to to work between Mac, PC and iOS. RDP isn't available as the host on anything except Windows Pro and you wanted something like TeamViewer. It wasn't said specifically that you only needed to log into a single Windows Pro machine from those devices, all of which do have RDP clients, including non-Pro Windows. Since you've been using TeamViewer for years, one would also presume you wanted many of the same features, and RDP doesn't support many of those, such as being able to access it from outside your house (using built-in and automatic functionality) or having it work as if you were sitting in front of the computer itself (RDP has limitations due to the protocol NOT being "console" access). And you never replied to any of the suggestions or provided any further information.
     
    S

    schnackenpfefferhausen

    Ars Centurion
    2,065
  • #6
    Ardax said:
    There's two main reasons that RDP might not have been suggested. First, while it can be secure, it really hinges on your user passwords. Since they're likely to be MS account passwords these days, that might be less of an issue than before.
    Click to expand...
    Thankfully I have one machine that I managed to setup with a local account :)
    I think if I ever have the need to expose it to the broader Internet, I'll set up a 127 character password (longest Windows supports) before I depart..
     
    S

    schnackenpfefferhausen

    Ars Centurion
    2,065
  • #7
    Oddabe19 said:
    I'm not entirely sure what you're asking, but exposing 3389 to the internet is bad. Very, very bad. Outside of SSH and Telnet, I believe it's one of the most attacked protocols. Keeping it internal is fine.

    Exposing RDP should only really be done if:
    1. You're using VPN to your network (OpenVPN; Wireguard; Unifi; Cisco; etc...), which effectively makes it local
    2. A remote desktop gateway, with MFA and still locked down to only allow certain IPs. Should be in combination with #1.
    Click to expand...
    I tried enabling the VPN built into my router (Netgear R7000) a while ago to test this.. but I found it unbearably slow. I don't know why..
     
    continuum

    continuum

    Ars Legatus Legionis
    94,897
    Moderator
  • #8
    R7000 is pretty old and its VPN performance is not good compared to more modern, higher-end routers.


    View: https://www.reddit.com/r/DDWRT/comments/i3nk2h/r7000_speeds_compared_to_no_vpn/


    Netgear R7000 and OpenVPN speed?

    I’ve been using Tomato, Advanced Tomato, and now Fresh Tomato for a long time, but my old Linksys e4200v1 just can’t provide the speed I need as a VPN client. I’ve noticed the most popular Tomato router is the Netgear R7000. Can anyone on the forum tell me about using this router as a VPN...
    www.linksysinfo.org

    community.netgear.com

    R7000 VPN

    I have been searching for for a few weeks. I am frustrated so hopefully someone can answer this for me once and for all. If I am running a VPN (OpenVpn) with the R7000 - what kind of speeds should I be getting? Does 25Mbps down max sound normal? Thank you.
    community.netgear.com community.netgear.com

    Try Wireguard on it instead of OpenVPN if you want to see if you can get better performance, but it's still going to be best described as not very fast.
     
    Andrewcw

    Andrewcw

    Ars Legatus Legionis
    18,129
    Subscriptor
  • #9
    schnackenpfefferhausen said:
    Thankfully I have one machine that I managed to setup with a local account :)
    I think if I ever have the need to expose it to the broader Internet, I'll set up a 127 character password (longest Windows supports) before I depart..
    Click to expand...
    It doesn't matter how long your password is. The problem is someone finds a major exploit. You're always way better off creating a VPN on your router if you use Microsoft RDP.

    Or use one of the many Semi-replacements of TeamViewer when you're out and about.
     
    S

    schnackenpfefferhausen

    Ars Centurion
    2,065
  • #10
    continuum said:
    R7000 is pretty old and its VPN performance is not good compared to more modern, higher-end routers.


    View: https://www.reddit.com/r/DDWRT/comments/i3nk2h/r7000_speeds_compared_to_no_vpn/


    Netgear R7000 and OpenVPN speed?

    I’ve been using Tomato, Advanced Tomato, and now Fresh Tomato for a long time, but my old Linksys e4200v1 just can’t provide the speed I need as a VPN client. I’ve noticed the most popular Tomato router is the Netgear R7000. Can anyone on the forum tell me about using this router as a VPN...
    www.linksysinfo.org

    community.netgear.com

    R7000 VPN

    I have been searching for for a few weeks. I am frustrated so hopefully someone can answer this for me once and for all. If I am running a VPN (OpenVpn) with the R7000 - what kind of speeds should I be getting? Does 25Mbps down max sound normal? Thank you.
    community.netgear.com community.netgear.com

    Try Wireguard on it instead of OpenVPN if you want to see if you can get better performance, but it's still going to be best described as not very fast.
    Click to expand...

    I’ll have to try tinkering with it later, but I’m not sure I was even getting the speeds noted in the links you provided. Running the stock firmware.
     
    S

    schnackenpfefferhausen

    Ars Centurion
    2,065
  • #11
    Andrewcw said:
    It doesn't matter how long your password is. The problem is someone finds a major exploit. You're always way better off creating a VPN on your router if you use Microsoft RDP.

    Or use one of the many Semi-replacements of TeamViewer when you're out and about.
    Click to expand...
    There could just as easily be an exploit in any of the other remote software out there.

    Post I was replying to specifically mentioned passwords.. so that’s why I focused on that portion.
     
    pasorrijer

    pasorrijer

    Ars Scholae Palatinae
    1,149
    Subscriptor++
  • #13
    Oddabe19 said:
    I'm not entirely sure what you're asking, but exposing 3389 to the internet is bad. Very, very bad. Outside of SSH and Telnet, I believe it's one of the most attacked protocols. Keeping it internal is fine.

    Exposing RDP should only really be done if:
    1. You're using VPN to your network (OpenVPN; Wireguard; Unifi; Cisco; etc...), which effectively makes it local
    2. A remote desktop gateway, with MFA and still locked down to only allow certain IPs. Should be in combination with #1.
    Click to expand...
    Yeah, even if you do expose it to the internet, choose a different external port. But agree with the others... VPN.
     
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply