When staff first needed to work from home, many small businesses did the quickest thing that worked: a port forwarding rule on the office router that let people connect to their office computer with Remote Desktop. Years later, many of those rules are still in place. It is one of the first things we look for in an assessment, because it is still among the easiest ways for attackers to get into a small business network.
Closing that port does not mean sending everyone back to the office. There are several safer ways to give people the same access, and for a small team most of them cost little or nothing. This post explains why the open port is a problem, how to check whether you have one, and what to replace it with.
Why a port-forwarded Remote Desktop is risky
The first problem is that it is easy to find. Automated scanners check every address on the internet, again and again, for remote desktop and other remote access services. Once one finds yours, the sign-in screen can be bombarded with stolen and guessed passwords at any hour, and nobody in the office will notice.
That is why exposed remote desktop has become a favourite way in for ransomware. The Canadian Centre for Cyber Security's ransomware playbook names exposed services such as Remote Desktop Protocol among the ways attackers get in, often by trying leaked or common passwords against many accounts. The damage rarely stays on one machine, either. A computer reached this way sits inside your network, next to your files, your accounting system and your backups, so one weak password can put all of them within reach.
How to tell if you have one
You do not need special tools to find out. Start by logging in to your router or firewall and looking for port forwarding, virtual server or NAT rules. A rule for port 3389, the standard remote desktop port, or any rule pointing at an office computer, deserves a question.
Next, ask whoever set up remote access how staff connect from home. If the answer is "they just open Remote Desktop and type the office address", the port is probably open. If you are still unsure, ask your IT provider to scan your public address from outside. It takes minutes and shows exactly what the internet can see.
Safer options, and when each one fits
There is no single right answer. The best choice depends on what people actually need to reach from home and what you already have in place. These are the four options we recommend most often.
A VPN protected by multi-factor sign-in
With a VPN, a laptop at home joins the office network through an encrypted connection, and Remote Desktop is only reachable from inside that connection. The VPN can run on the office firewall or on a small dedicated device, and either way it should ask for a multi-factor sign-in before anyone gets through. Many business firewalls can do this with their built-in VPN. WireGuard, a popular choice, only checks a key stored on each device, so on its own it cannot ask for a second factor and needs a sign-in layer added on top.
An outbound tunnel or identity-based access service
Services such as Microsoft Entra Private Access, Cloudflare Access and Tailscale connect people to specific office systems after they sign in with their work account. Because the connection starts from inside the office, the router needs no inbound rule at all. That sign-in is what keeps strangers out, so it should require multi-factor sign-in, and each person should only be allowed into the systems they need. We publish our own websites through the same kind of outbound tunnel, as our case study explains.
A Remote Desktop Gateway server
If your office has a Windows server, its Remote Desktop Gateway role can act as a single, well-guarded front door. People connect to the gateway over HTTPS, it checks their sign-in, including a multi-factor prompt through Microsoft Entra ID, and only then passes them through to a computer that never faces the internet directly.
Remove the need altogether
If people only connect to the office to reach files, moving those files to SharePoint, OneDrive or Google Drive may remove the need for remote desktop entirely. The same goes for software that now has a cloud version.
Shut the old port once the new access works
A new remote access method only helps once the old one is gone. Remove the old port forwarding rule as soon as the replacement is working, and look again a few weeks later to make sure it has not come back. Router replacements and restored settings have a way of reviving old rules.
Some protections belong with every option. Each remote connection should need something beyond a password, and repeated failed sign-ins should lock the account for a while. Administrators should do admin work from accounts they never use for email. Remote access equipment is attacked directly, so install firmware and security updates for it as soon as they are released. Finally, tie remote access to your staff list, so that when someone leaves, their remote access ends on the same day as their email.
How we help
Bitlogix sets up secure remote access for small businesses in Mission, Abbotsford, Chilliwack, Langley and across the Lower Mainland, with remote support anywhere in BC. Our free IT assessment checks what your office exposes to the internet and recommends the simplest safe way for your team to work from anywhere. See our networks and Wi-Fi service for more, or book a free 30-minute consultation to talk through your options.
Useful references
- Ransomware playbook, Canadian Centre for Cyber Security
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security
- Virtual private networks (ITSAP.80.101), Canadian Centre for Cyber Security
- Integrate Remote Desktop Gateway with the Microsoft Entra multifactor authentication NPS extension, Microsoft Learn
Cover photo by Sasun Bughdaryan on Unsplash.