Laptop connected to an office building through a secure tunnel

Remote access: Remote Desktop, VPN or zero trust (Twingate)? How it works and how to set it up

Fabrice BlanchetBlog and news

Remote access · Appelez le tech

Working from home on your office computer is convenient. But when it’s poorly configured, remote access is also the favourite way in for ransomware groups. Here is how Remote Desktop, the traditional VPN and the “zero trust” VPN work, and how to set them up properly.

The number to remember: in the attacks handled by Sophos’s incident response team in 2023, Remote Desktop (RDP) had been abused in 90% of cases, and exposed remote access services were the way in for 65% of them.

Remote Desktop (RDP): how it works

Remote Desktop (Remote Desktop Protocol, or RDP) is built into Windows. It lets you sign in to an office computer from another device: you see its screen and use its software and files as if you were sitting in front of it. Only the screen image travels over the network; the data stays at the office.

  • The computer receiving the connection must run Windows Pro or Enterprise (the Home edition can’t be controlled through RDP).
  • By default, the service listens on port 3389.
  • To connect, use Remote Desktop Connection (mstsc), which is still included in Windows. The old “Remote Desktop” app from the Microsoft Store was retired on May 27, 2025 in favour of the Windows App, which is mainly designed for Microsoft’s cloud desktops.

The problem: RDP was never designed to be exposed directly on the Internet. Opening port 3389 on the office router is like advertising a door that bots try day and night with stolen passwords. So RDP must always sit behind a VPN or a zero trust solution.

1. RDP exposed on the Internet: avoid Employee Port 3389open to everyone The entire office network … and bots trying stolen passwords 2. Traditional VPN: a tunnel to the whole network Employee+ VPN client VPN firewallopen port, kept updated The entire office networkincluding the RDP computer encrypted tunnel 3. Zero trust (e.g. Twingate): one resource at a time Employee+ client Cloud relayverified identity Connectoroutbound only Computeronly one authorized outbound No open port at the office: the connector calls out. The employee only sees the resources they’ve been granted, not the rest of the network.
Three remote access architectures, from the riskiest to the most restrictive.

The traditional VPN

A VPN (virtual private network) creates an encrypted tunnel between the employee’s computer and the office firewall. Once connected, the computer behaves as if it were plugged into the office network: it can reach the file server, the printer and the RDP computer.

Pros: proven technology, often already included in the company firewall, no extra subscription.

Limits:

  • The VPN device remains an open door on the Internet. Firewall and VPN vulnerabilities are among those attackers exploit most: updates must be applied right away.
  • Once inside the tunnel, the user (or the attacker who stole their password) often sees the whole network.
  • Without MFA, a stolen password is enough.

Zero trust (ZTNA), for example Twingate

The “zero trust” approach (zero trust network access) starts from a simple principle: nobody is trusted by default, even on the inside. Instead of opening the whole network, a specific person gets access to a specific resource (a computer, a server, a port), after their identity is verified.

With Twingate, four components work together:

  • The client, installed on the employee’s computer or phone, which authenticates them and encrypts the traffic.
  • The connector, installed on a small machine on the office network. It only makes outbound connections: no port needs to be opened on the firewall.
  • The controller, hosted by Twingate, which manages access rules and hands sign-in off to your identity provider (for example Microsoft Entra ID or Google), so your MFA applies.
  • The relays, which connect the client and the connector without storing any data.

Traffic only flows if both the user and the connector are authorized for that resource. An attacker who stole an employee’s computer would not, by default, get access to the whole network.

Which one should you choose?

CriteriaExposed RDPTraditional VPNZero trust (Twingate)
Port open on the InternetYes, 3389Yes, the VPN’sNone
Access grantedOne computer, visible to allOften the whole networkResource by resource
MFADifficultMust be addedYour Microsoft or Google account’s
Maintenance—Critical firewall updatesConnector to keep updated
CostFree, but riskyOften included with the firewallPer-user subscription
VerdictAvoidAcceptable if well maintainedRecommended for SMBs

Setup, step by step

A. Prepare the office computer (in every case)

  1. Check the edition: Windows 11 Pro or Enterprise.
  2. Settings > System > Remote Desktop: turn it on, and leave Network Level Authentication (NLA) checked.
  3. Allow only the accounts that need it (“Remote Desktop users” button), never a shared administrator account.
  4. Protect accounts with a long, unique password, and turn on lockout after several failed attempts.
  5. Set the computer so it doesn’t go to sleep (or use Wake-on-LAN), and keep it updated.
  6. Never create a port forward for 3389 on the router.

B. Traditional VPN option

  1. Use the VPN feature of your existing firewall (IPsec, SSL VPN or WireGuard depending on the model) and update its firmware.
  2. Tie VPN authentication to company accounts and require MFA.
  3. Create a VPN user group and rules that limit access to only the computers and ports needed (for example 3389 to one specific computer), rather than the whole network.
  4. Install the VPN client on managed, protected devices only.
  5. Turn on alerts for unusual connections and watch the manufacturer’s security advisories.

C. Zero trust option with Twingate

  1. Create the company’s Twingate network and link it to your identity provider (Microsoft Entra ID or Google) to take advantage of your existing MFA.
  2. Deploy the connector on a small, always-on machine at the office; ideally two connectors for redundancy.
  3. Define the resources: for example the internal address of the RDP computer, limited to port 3389.
  4. Create groups (Accounting, Management…) and assign them only the resources they need.
  5. Install the Twingate client on employees’ devices and sign them in with their work account.
  6. Launch Remote Desktop Connection (mstsc) to the computer’s internal address: the traffic automatically goes through Twingate.
  7. Close the old access paths (VPN, port forwards) once the transition is confirmed.

What about IT support? For your support calls, our technicians need neither a VPN nor an open port: access goes through the remote management agent installed on each of your devices, with every session logged.

Want to secure your team’s remote access?

Appelez le tech · 1 833 444-1041

Sources