Why opening RDP directly to the Internet is a bad idea

Security24 June 20263 min readBy Digbijay Paul

This is the most common risky configuration we find in small offices, and it is always well intentioned. Someone needed to work from home, the quickest route was to forward port 3389 to the server, and it worked.

What actually happens next

• Automated scanners find the open port, usually the same day.
• Login attempts begin and continue indefinitely, at a rate no person could keep up with.
• Any account with a weak, reused or leaked password becomes a realistic entry point.
• Once inside, an attacker has the same view of your network that your staff have — including the file shares and, often, the backups.

Changing the external port number reduces noise but does not solve the problem; scanners check every port. Account lockouts help against some attacks and create a denial-of-service opportunity in others.

The pattern we see is rarely dramatic at first. Someone gets in with valid credentials, so nothing looks unusual in the logs. They look around, find the file shares and the backup location, and act at a time when nobody is watching — a weekend, or a festival holiday. By the time the business notices, the backups on the network have often been dealt with too. That is why the copy an attacker cannot reach matters so much.

What to do instead

A private access network — such as JUSTPING Secure Connect, the managed service we run for clients — gives each user or device an identity and a set of rules. The user connects to the private network, and from there reaches only the systems their policy allows. Nothing on your server is reachable from the public Internet.

A sensible sequence

1. Set up the new accessDeploy the access network and enrol a few users.
2. Test properlyConfirm the applications people actually use work over it, including printing and scanners where relevant.
3. Move everyone acrossSet up each user's device and make sure they can work before anything is removed.
4. Remove the port forwardClose the published RDP port on the firewall.
5. Tighten the accountsReview passwords, disable dormant accounts, and enable multi-factor authentication where the application supports it.

What about a VPN on the firewall?

A VPN on your firewall is a legitimate answer and far better than a published RDP port. It is a good fit when everyone connects to one office and the firewall is a model you are happy to keep updated. A managed private access network tends to suit businesses with several sites, users who move between them, or a wish to grant access per system rather than per network. Either way, the principle is the same: authenticate first, then reach internal systems.

While you are in there

• Check whether any other service is published — a NAS interface, a camera recorder, a database port
• Confirm the firewall's own management interface is not reachable from outside
• Make sure backups cannot be reached with ordinary user credentials
• Check that endpoint protection is installed and reporting on every machine

None of this requires an enterprise budget. It requires an evening and a plan.