Windows Remote Desktop: Configuring Your Firewall and Router Letting Remote Desktop Traffic Past Your Firewall Eric Geier
In Part 1 of our Windows Remote Desktop tutorial series, we configured Windows to accept remote desktop connections so that we could log into and use a PC anywhere in the world using Microsoft's Remote Desktop Connection client application. In Part 2, we configured Windows to accept remote connections via a Web browser, so the client application doesn't have to be installed on the computer from which you are connecting.
However, neither of these methods will work until your firewall is configured to allow remote connections. Plus, to connect to your PC via the Internet, your router must be properly configured as well. This tutorial addresses how to configure both your firewall and router for Windows Remote Desktop.
We'll tell the firewall on the PC that's hosting the remote connection that it is okay to allow incoming connections on the appropriate port, and we'll also tell your router where to forward remote desktop connections. Let's get started.
Letting the Traffic Past Your Firewall
Since you will be trying to connect to your PC from the local network or Internet, your firewall software must be configured to let the traffic through. Enabling the Remote Desktop feature on Windows automatically configures Windows Firewall with the appropriate settings; however, you must manually configure any other third-party firewall software you have installed on your computer.
To do this, add UDP port 3389 (which Remote Desktop uses) to your firewall's authorized list. If needed, refer to the help and documentation of the firewall program for assistance.
It's possible to change your Windows Firewall settings and accidentally mess up the setting automatically made when you enabled Remote Desktop. Therefore, to be on the safe side we'll verify Remote Desktop connections can pass through.
If you are also setting up Web access to the Remote Desktop Connection, you must add TCP port 80 (or the port you choose for IIS if you changed from the default) to your Windows Firewall and any other third-party firewall. Windows doesn't automatically add this port to the authorized list, so you will have to do it yourself.
Follow these steps in Windows Vista to verify the Windows Firewall settings or add the Web access port:
Click the Start button and choose Control Panel.
On the Control Panel window, under the Security category, click the Allow a program through Windows Firewall link.
If User Account Control is enabled, select an account and enter a password, if required, and click Continue on the prompt.
On the Windows Firewall Settings window that opened, click the General tab.
Make sure the Block all incoming connections check box is NOT checked; as Figure 1 shows.
Click the Exceptions tab and scroll down to make sure the Remote Desktop item is checked; as Figure 2 shows. This verifies Windows Firewall is set to allow the traditional Remote Desktop Connections.
If you are setting up Web access with IIS as well, click the Add Port button. Then, on the Add a Port dialog box, type in a Name (such as Remote Desktop Web Connection) and enter the default port 80 or the port you manually changed IIS to into the Port Number field, select TCP for the Protocol, and click OK.
When you're done, click OK.
Even if all incoming connections
are blocked, exceptions can be made
If you're using Windows XP, here's how to verify the Windows Firewall settings and/or add the Web access port:
Click the Start button and choose Control Panel.
On the Control Panel window, click the Security Center category.
On the Windows Security Center window that opened, near the bottom of the window, click the Windows Firewall icon.
Make sure the Don't allow exceptions check box is NOT checked.
Click the Exceptions tab and scroll down to make sure the Remote Desktop item is checked.
If you are setting up Web access with IIS as well, click the Add Port button. Then on the Add a Port dialog box, type in a Name (such as Remote Desktop Web Connection) and enter the default port 80 or the port you manually changed IIS to into the Port Number field, select TCP for the Protocol, and click OK.
When you're done, click OK.
If you are using other third-party firewall utilities, make sure you add these ports to them as well. If you find you're having problems later when connecting, consider disabling all firewall software except Windows Firewall.
