I’ve previously written several articles on remote desktop, including how to enable remote desktop on a remote computer and how to access local files and folders during a remote desktop session. I’ve even written about how to block remote connections to a PC!
Yet I have not talked about how to actually configure a router for remote desktop so that you can connect to your computer from outside of the local network. Once you enable and setup remote desktop, you have to configure your router to forward the remote desktop port (3389 by default) to the correct computer on your network.
This is called port forwarding and the method is slightly different depending on which brand router you are using, i.e. LinkSys, D-Link, Netgear, etc. However, if the instructions below do not help you in determining how to setup port forwarding on your router, then just perform a search for “router port forwarding”, where router is the brand name of the router.
Setup router for Remote Desktop
First, you need to log into your wireless router at home by typing in the local IP address for the router in your Internet browser. If you don’t know the IP address of the router, go to Start, Run, and type in CMD. Then type IPCONFIG and the address for the router is the Default Gateway entry.
Now type that into your browser and log into your router. If you do not know the admin username and password for your router, you can reset the router by pressing the reset button on the back and then go to any one of these default router password list sites:
http://www.phenoelit-us.org/dpl/dpl.html
http://www.routerpasswords.com/
http://www.governmentsecurity.org/articles/DefaultLoginsandPasswordsforNetworkedDevices.php
Once you are into the router, look for anything along the lines of Port Forwarding, Virtual Server, or Applications and Gaming. I tried to find a couple of screenshots of how it would look on LinkSys, D-link and Netgear:
Now you will either be able to choose the service from some kind of drop down that will have a list like FTP, HTTP, TELNET, etc and if they have Remote Desktop or RDP, then choose that. Type in the IP address in the corresponding box and you’re done.
If the service does not show up in the list, then you have to either add a custom service or there will be some blank boxes where you can enter in the information. On my Linksys router, for example, I have a bunch of empty text boxes in a table.
I would enter Remote Desktop for the application name, 3389 for the internal port, 3389 for the external port, choose both TCP and UDP as the protocol, type in the IP address for the computer I want to connect to, and check the enabled box.
On a D-link router, it’s called Private port and Public port instead of internal and external port, but it’s always the same number 3389, so you can’t get confused. On Netgear, it’s called Start port and End Port.
Now everything should be set for you to connect to your computer from outside the local network. In order to connect from outside, you will have to get your external IP address, which is simple. Just go to www.whatismyip.com and it will give you your external IP address.
The only issue that can come up is if your do not have a static IP address with your ISP. Most home users get a dynamic IP address that changes every so often. This makes it extremely hard to connect remotely because it will fail once the IP address changes.
In order to fix this problem, you can read my in-depth article from Online Tech Tips that talks about how to setup Dynamic DNS for remote desktop to your PC. Any questions? Post a comment! Enjoy!
This a well written and technically accurate walk-thru, but I would seriously caution against allowing RDP across the Internet. While the RDP protocol is encrypted, it is susceptible to MITM (Man-in-the-middle) attacks because it has no means to verify the host. Also, if the local administrator account is enabled and has the default name, attackers can guess at the password all day and will never get locked out.
Encapsulating the RDP traffic into a certificate based VPN or SSH tunnel is resolves both of these issues. Personally, I use PuTTY to SSH into my router (Linksys WRT-54G running DD-WRT v24 firmware) and then open. PuTTY is configured to forward local port 3390 to port 3389 on my home computer, so all the traffic goes through the SSH tunnel. When using SSH over the Internet, always make sure to use certificate authentication.