My manager wants me to set up an RDP-accessible server using TSplus Remote Access. We have a static public IP and a FortiGate 50E, but I'm not comfortable exposing RDP directly to the internet. The options I'm considering are a FortiGate SSL VPN, remote-access IPsec VPN, or possibly a mesh VPN such as Tailscale. I'm hesitant about SSL VPN because of recent vulnerabilities and our firewall is running older firmware. Most users will connect from networks behind CGNAT. Would that cause problems with remote IPsec, and what approach would be the safest and most practical?
4 Answers
For a new deployment, I wouldn’t choose an older SSL VPN implementation if the platform is moving away from it. IPsec is a reasonable option, but make sure the FortiGate firmware is supported and properly patched. Your 50E is also approaching end of life, so replacing it should be part of the plan rather than building a long-term solution around it.
A managed cloud access proxy could also work, such as a zero-trust application gateway from a major cloud provider. Regardless of the product, do not publish RDP directly to the internet. If a VPN is used, require MFA, limit geographic access where appropriate, keep the management interface off the WAN, and restrict access to only the required hosts and ports.
I previously found a large number of failed login attempts because the firewall administration interface had been exposed to the WAN. That convinced me that putting RDP directly online would be reckless.
For this use case, Tailscale or another mesh VPN is probably simpler and safer than configuring inbound access on the firewall. You can define ACLs so each person can reach only their assigned machine or service, and you avoid exposing RDP or a VPN portal publicly. Lock down device enrollment so only managed company laptops can join the network, and enforce identity-based MFA.
CGNAT generally isn’t a problem for users connecting to a VPN. IPsec with NAT traversal is designed to work through typical home and mobile NAT setups. Whichever VPN you choose, enforce MFA, use conditional-access policies where possible, and restrict users to only the systems they need.
The firewall is on FortiOS 6.x, so SSL VPN is still available, but I’m already pushing management to fund a replacement unit.