categories
Updated on Published on March 9, 2022 in How to, Remote access

How to Securely Access Remote Desktop Over the Internet

Author: Helga York
Helga York Article author

It is easy to connect to another computer on the same network. However, securely connecting to a remote desktop over the internet is not a simple task. It requires more than the default remote desktop functionality to establish a secure connection. This guide discusses multiple methods of using remote desktop via the internet, with a focus on their security and simplicity. We show you how to securely access remote desktop from outside your network and protect your IT environment.

What is a Remote Desktop Connection over the Internet?

A remote desktop over an internet connection enables a user to control a computer from another location, outside of your local network. The remote user gains access to the computer’s screen, keyboard, and mouse with the same level of functionality as if they were physically present at the machine. IT support teams regularly use remote desktop connections to provide end-user support. Individuals can use remote desktop to access a work machine from home or another location, supporting a mobile workforce.

Remote desktop connections over the internet are made possible by three different technologies. The most familiar solution is Microsoft’s Remote Desktop Protocol (RDP), which is built into the Windows operating system. Users can use a VPN to create a private tunnel that allows a remote device to appear to be on a local network. The third option is to use dedicated remote access software that streamlines the process of establishing a connection without manual network configuration.

Windows Remote Desktop Connection has been part of the operating system since Windows XP, and works with Windows 10 and 11. It is a free and powerful connectivity solution, but is meant to be used on a local network. By default, it does not provide a secure remote desktop over the internet.

Before you Start: Enable Remote Desktop

The first step in establishing a native RDP connection is to enable Remote Desktop on the remote computer you want to access.

  1. On the remote computer, open Settings → System → Remote Desktop.
  2. Turn on Enable Remote Desktop and confirm.
Enable Remote Desktop toggle in Windows 11 Settings
Important note:  Windows 10/11 Home cannot host a Remote Desktop session. RDP server is not part of the operating system. Users can connect to other machines from a Windows 10/11 Home computer but cannot accept remote connections. We offer guides on enabling RDP on Windows 10/11 Home and on configuring a Remote Desktop Connection on Windows.

Why doesn’t RDP over the Internet Work by Default?

Remote Desktop is designed to provide connectivity over local networks, where the client can establish a direct link to the host computer. A router and firewall may block Internet connections, and the host doesn’t present a public IP address that clients can access directly.

Two primary issues make it difficult to use Windows Remote Desktop over the internet:

  • • A critical security exposure: If you open a direct path on your router to a machine inside the network, it can be exploited by threat actors. Malicious automated bots are continuously scanning the internet for this type of opening and can quickly make the remote desktop port an attractive target.
  • • Complex configuration: Users must configure the connection. The configuration requires identifying the host computer’s internal IP address, logging into the router, forwarding the correct port, and supplying the network’s public IP address. While these tasks are not difficult, some users may not take the time to configure them correctly, resulting in degraded security.

The following methods solve these problems in two ways. HelpWire offers secure connectivity without any network changes. The other methods require you to configure RDP or to use Chrome’s free solution, which has limited functionality.

Methods for connecting to a remote desktop over the internet

This table compares the main ways to connect to a remote desktop over the internet.

MethodSecuritySetup complexityCostBest use case
HelpWireStrong with AES-256 encryption and no exposed portsSimpleFreeCross-platform support for technical or non-technical users
RDP + port forwardingWeak without hardeningModerateFreeAdvanced users using native RDP in a hardened environment
RDP + VPNStrongHardFree with extra costsTechnical users and organizations with existing VPNs
RD GatewayStrongHardLicensing costsEnterprises running Windows Server
Chrome Remote DesktopGoodEasyFreeBasic personal use
Security note:  Dedicated threat actors can hack all consumer remote access solutions. Teams implementing a hardened VPN or a Zero Trust environment can enhance security through proper configuration. Many users choose a software solution like HelpWire because it provides strong security without configuration complexity.

Method 1: HelpWire - a Simple and Balanced Solution

HelpWire is a remote access solution that supports Windows, macOS, and Linux systems. It is a simple tool that establishes secure connections without firewall changes, network configuration, or port forwarding.

HelpWire addresses the configuration and security issues defined above by establishing connections through its internal infrastructure. The software connects over a direct peer-to-peer link when available. When no direct link is available, the connection is routed through relay servers. No ports are exposed, and no configuration is required.

HelpWire’s Primary Features

  • • The software does not open ports and requires no router configuration. Your firewall and port 3389 are not used for the connection, eliminating an internet-facing vulnerability that can be exploited.
  • • HelpWire is cross-platform and supports diverse environments across Windows, Linux, and macOS. Native RDP does not support hosting a remote session from a Mac or Linux system.
  • • HelpWire provides strong security with AES-256 encryption and protects the connection with WSS, HTTPS, and TLS/SSL. Operators only establish remote connections after receiving a client’s explicit, per-session approval.
  • • Account access is secured through Auth0 and optional two-factor authentication. The application is hosted on secure AWS infrastructure and is digitally signed by DigiCert to ensure authenticity.
  • • HelpWire operates behind a Carrier-Grade NAT, popular with home 5G networks and ISPs, where you don’t get a unique public IP and cannot use port forwarding.

How to use HelpWire for Remote Desktop Over the Internet

HelpWire was developed as a remote support tool for helping clients, coworkers, or family members resolve technical problems. It also provides unattended access to your home or office computer when you are elsewhere.

  1. Download HelpWire on both the local (host) and remote (client) computers. You can also use the Quick Connect option for an ad hoc session without creating an account.

    Download HelpWire

  2. For support, send the client your connection link so you can provide remote support. Set up unattended access to connect to your own computer remotely.

    Send the connection link

  3. Connect to the client computer, approve the session, and take full control of the remote desktop.

    Connect to the client computer

HelpWire’s customers give it high marks for ease of use, feature set, and cross-platform compatibility:

Helpwire has exceeded our expectations in every way. It's design and easy to use feature make it accessible for everyone.Most important feature is the Cross-platform compatibility,which allows to assist users on various operating system without any issue.There are lots of feature to describe briefly but I'll say Helpwire has become an indispensable tool in Remote support toolkit.it's reliable,efficient and incredible.
— Read full review

Method 2: Microsoft RDP - port forwarding & VPN

Microsoft’s Remote Desktop Protocol (RDP) is the most popular way to reach a Windows PC. You can use RDP in two ways: port forwarding or VPN tunneling. The two methods provide a very different level of security.

You can only host an RDP session from Windows Pro, Enterprise, Education, or Server editions. Windows Home computers can only act as clients that connect to a host machine.

RDP via port forwarding (use only if hardened)

Port forwarding maps a port on your router’s public IP address to your PC’s internal IP address so an external client can reach it. It’s free and built-in, but it exposes your computer directly to the internet – so treat it as a last resort, not a default.

Step 1: Set a static internal IP so the forwarding rule doesn’t break when DHCP reassigns addresses.

On the host:

open control panel

Open Control Panel → Network and Internet → Network and Sharing Center → Change adapter settings.

change adapter settings

Right-click the active adapter → Properties → Internet Protocol Version 4 (TCP/IPv4) → Properties.

TCP/IPv4 properties

Choose Use the following IP address, and enter an address outside your router’s DHCP range, with the correct subnet mask, default gateway (your router), and DNS. (Run ipconfig/all to see current values.)

configure static ip address

Step 2: Find your public IP. Search “my IP” in a browser on the host network, or check the router’s status page.

Note that ISPs change public IPs over time – use Dynamic DNS (DDNS) to map a stable hostname to your network so the connection doesn’t break.
what's my ip address

Step 3: Forward the port. In your router’s admin panel, forward TCP port 3389 to the host’s static internal IP.

create port forwarding rules
⚠️ Read before you open port 3389.  An exposed RDP port is one of the most heavily attacked targets on the internet – brute-force login attempts and ransomware crews scan for it constantly. If you must use port forwarding, harden it: restrict the rule to a specific source IP so only your known location can reach it, change the default port, enforce a long unique password on a non-default username, and enable Network Level Authentication. And note: if your ISP puts you behind CGNAT, port forwarding won’t work at all – you’ll need a VPN or a relay-based tool like HelpWire instead.

RDP via VPN (the secure route)

A VPN provides a more secure way to use native RDP over the internet. Remote devices joining the VPN are treated as if they are inside the local home or office network. RDP traffic moves through an encrypted tunnel and is never exposed to the open internet. This approach is more secure than port forwarding, but requires more technical knowledge and setup work.

The type of VPN required for this method of using RDP is not the same as a consumer VPN that protects privacy or enables streaming from restricted sites. You need to deploy a self-hosted VPN server or a built-in VPN on a reliable router.

You need to use a modern and secure protocol when setting up the VPN server, such as WireGuard, OpenVPN, or IKEv2/IPSec. Don’t use PPTP, as it is an outdated and insecure solution.

Once configured, you add the connection in Windows with Settings → Network & Internet → VPN → Add a VPN connection.

add vpn connection

You enter the server address, protocol, and your Windows credentials.

configure vpn connection

RDP via RD Gateway (enterprise)

Remote Desktop Gateway is the method preferred in an enterprise setting. It requires a Windows Server instance, a TLS certificate, Remote Desktop Services licensing, and ongoing maintenance. While this is suitable for larger organizations, it is overkill for small teams.

This method leverages Windows Server to wrap RDP inside an HTTPS connection on port 443. It provides a secure, encrypted path to internal machines without exposing port 3389 or requiring all users to access a VPN. Traffic passes through firewalls on port 443, so administrators can centralize access and authorization policies to enforce security.

Method 3: Chrome Remote Desktop - the free option

Chrome Remote Desktop is a free, browser-based tool connected to your Google account. It is a fast and cost-effective way for non-technical users to access their own computer remotely. You simply install it on both machines using the same Google account and set a PIN to verify access.

Chrome Remote Desktop

While Chrome Remote Desktop is a good choice for simple personal use, its limitations make it unsuitable for more involved tasks such as providing professional support. The tool lacks features such as file transfer, session controls, and multi-client management. It offers less consistent performance than native RDP or dedicated solutions.

Security best practices for remote desktop over the internet

The most important best practice is to avoid exposing remote desktop directly to the internet through an open inbound port. You should opt for a VPN, a Zero Trust approach, or relay-based software. The following steps should be taken to enhance remote desktop security.
  • • Don’t open port 3389 to the internet. When choosing to forward a port, change the default and restrict it to a specific IP.
  • • Enable multi-factor authentication if the tool supports it.
  • • Use Network Level Authentication (NLA) to validate credentials before sessions are established.
  • • Use strong, unique passwords and non-default usernames. Hackers often target the “Administrator” account, which may be protected with a weak password.
  • • Implement strong encryption such as AES-256 for data and TLS to protect connections.
  • • Keep systems patched to address RDP vulnerabilities that attackers can exploit.
These security steps demonstrate why dedicated software like HelpWire has an advantage over other remote desktop solutions. The tool applies encryption, authentication, and consent control, eliminating the need for users to make configuration changes.

Troubleshooting if the connection only works on a LAN

A remote desktop connection that works on a LAN but not the internet is typically caused by one of the following issues.

  • • The public IP has been reassigned by your ISP. Dynamic DNS allows you to connect to a stable hostname.
  • • The host machine is asleep, or RDP is turned off so the computer cannot accept connections.
  • • The port may not be forwarded or may be blocked by a firewall. Verify that TCP 3389 is being forwarded to the host’s internal IP and permitted to pass through all firewalls.
  • • You may be behind a CGNAT, where your ISP shares a public IP address among many customers, which prevents inbound port forwarding from reaching your machines.

The bottom line

Remote desktop over the internet requires a trade-off between ease of use and security. VPNs are secure but take significant work to implement. Port forwarding entails additional hardening steps to ensure security. Reliable, dedicated remote access software provides enhanced security without the technical configuration, making it the right choice for most users. 

HelpWire offers a simple way to establish secure remote desktop connections with cross-platform support for Windows, macOS, and Linux.

FAQ

No, native RDP over the internet exposes port 3389 and creates a vulnerability that brute-force attacks and ransomware can exploit. A safe connection requires tunneling through a VPN or RD Gateway, or encrypted remote access software that does not open a port.

RDP uses TCP port 3389 by default. You can slightly improve security by changing the port number. You should also consider stronger security such as restricted access or a VPN.

Yes, you can expose RDP directly via port forwarding, though it is insecure and not recommended. A safer alternative while avoiding a VPN is to use remote access software like HelpWire, which does not expose ports and enforces traffic encryption.

Search for “my IP” in any browser on the host network or query the router’s status page. Public IPs can change, so consider using Dynamic DNS to provide a stable hostname.

The LAN lets the client reach the host directly. When using the internet, your router and firewall block unsolicited inbound connections, and the host has no public IP address. You are required to use a VPN, forward a port, or use dedicated software to handle the connection.

You can use Microsoft’s “Windows App” for native RDP, or a cross-platform solution such as HelpWire, which supports connections across Windows, macOS, and Linux without RDP configuration.

Windows Home can connect remotely as a client but cannot host incoming RDP sessions. You need to use Windows Pro, Enterprise, Education, or Server editions, or third-party software such as Chrome Remote Desktop or HelpWire.

Tags:
RDP, VPN, Windows