My boss wants me to provide remote desktop access to a server using TSPlus Remote Access. We have a static public IP and a FortiGate 50E, but I'm not comfortable exposing RDP directly to the internet. I'm considering either FortiGate SSL VPN or remote-access IPsec VPN.
I'm hesitant about SSL VPN because of recent vulnerabilities and because the firewall is running an older FortiOS version. Most users will connect from networks behind CGNAT, so I'm also wondering whether that creates problems for IPsec. Would a mesh VPN such as Tailscale be a better option? I'm looking for something secure, manageable, and appropriate for a business environment.
4 Answers
For this use case, Tailscale or another mesh VPN is probably the simplest and safest choice. You can avoid inbound RDP exposure, define ACLs so users can reach only the systems they need, and it generally works well even when clients are behind CGNAT. Make sure you restrict who can join the network and allow only managed company devices where possible.
The FortiGate 50E is reaching the end of its useful life, so upgrading it should be part of the plan. A newer firewall with current firmware, MFA integration, and a supported VPN implementation would be more defensible than building a new remote-access service around an outdated appliance. A cloud access proxy is another option if replacing the firewall will take time.
If you use the FortiGate, IPsec with NAT traversal should work for clients behind CGNAT in most cases. Require MFA, use strong authentication, restrict access by user or group, and apply geographic or source restrictions where practical. SSL VPN can also work, but I wouldn’t deploy it on an old firewall without first confirming the FortiOS version, supported patches, and current security advisories.
The main concern is not that CGNAT automatically breaks IPsec. Modern IPsec commonly uses NAT traversal, although unusual carrier NAT or restrictive networks can still cause compatibility issues.
Do not expose RDP directly to the public internet. Put it behind a VPN, a properly secured remote-access gateway, or a zero-trust access service. If you use TSPlus, make sure its web portal and gateway are fully patched and protected with MFA rather than treating it as a replacement for network security.
The firewall is expected to be replaced, but funding may take a while. In the meantime, I’m leaning toward a tightly controlled mesh VPN instead of exposing any management or RDP ports.