Put remote access behind a VPN, not open ports

By the end of this guide, nothing on your network will accept remote-access connections straight from the internet, and the people who need to work remotely will reach only what they need, through a VPN with their own sign-in.

Who it's for

IT staff, or the provider who manages your network, at a small or mid-size organization where people or vendors connect in from outside. You'll need admin access to the firewall or router and a change window. Plan on half a day, plus time to move each remote user over.

Why bother: automated scanners find an open remote-desktop, SSH or admin port within hours of it appearing, and then try passwords around the clock. A VPN puts a single, well-protected door in front of everything, and the services behind it can no longer be reached by strangers at all.

Steps

1. Find what's exposed today

   List every port forward and inbound rule on your firewall or router, including any created automatically by UPnP. Then scan your own public addresses from outside your network (for example with nmap), and check the firewall settings of any cloud servers. Look especially for remote desktop (3389), SSH (22), VNC (5900), file sharing (445), databases (1433, 3306), and the admin pages of NAS boxes, cameras and the firewall itself. Scan only addresses you own.

2. List who needs remote access, to what

   For each exposed service, write down who uses it from outside and what they actually need: "Ana: her office PC", "accounting vendor: the accounting server, Tuesdays". This list becomes the VPN's access rules.

3. Set up the VPN

   Use the VPN built into your firewall (WireGuard, IPsec or an SSL VPN) or a dedicated VPN service. Give every person and every device their own account or key, never a shared one, and add two-step sign-in where your VPN supports it. Turn on automatic updates or put the VPN device on a patch schedule: VPN gateways are a favourite target, and their security updates are urgent.

4. Limit what VPN users can reach

   A VPN connection shouldn't mean access to the whole network. Using the list from step 2, add firewall rules so each user or group reaches only their own hosts and ports. Vendors in particular should see only the system they support.

5. Move people over, then close the ports

   Set up and test the VPN with each remote user while the old access still works. Once everyone is moved, close the port forwards in a change window, and turn off UPnP on the router so devices can't quietly open new ones. Keep a note of what you removed in case something was missed.

6. Watch and maintain it

   Keep VPN logs, and look at them now and then for sign-ins at odd hours or from unexpected countries. Remove accounts the day someone leaves or a vendor contract ends, and review the access list every six months.

Common mistakes

• Moving remote desktop to an unusual port. Scanners check every port. It hides nothing and still exposes the service.
• One shared VPN account. You can't tell who connected, and you can't remove one person without changing everyone's access.
• Forgetting devices that opened their own ports. NAS boxes, cameras and printers often create port forwards through UPnP. Check the router's list, not just the rules you remember adding.
• Not patching the VPN itself. An unpatched VPN gateway can be worse than the ports it replaced. Treat its updates as urgent.
• Giving VPN users the whole network. If one remote laptop is compromised, the attacker gets everything it can reach.