> Can't anyone who knows the server IP and has company VPN; tunnel and get access to that server? I'm not sure I've understood quite how your chain of VPN, RDP

> Can't anyone who knows the server IP and has company VPN; tunnel and get access to that server? I'm not sure I've understood quite how your chain of VPN, RDP and Tunnels is set up so I'm making some assumptions (Hopefully it'll still be helpful). I'm going to assume that you create a tunnel from the RDP machine to a port on the target machine's localhost interface. First of all the process of creating the tunnel will involve authentication, which makes it easier to lock down access to individuals. Also the authentication process will leave entries in logs that a specific user connected to the tunnel which is generally more useful that someone with an IP of x.x.x.x connected (especially if multiple users could be connecting from the RDP machine). Secondly making an application only listen on the localhost interface reduces the chance that in the future a miss-configuration of the firewall will open up access to the world. Thirdly the tunnel will be encrypted which can add an extra layer of security if the underlying protocol being used transmits in the clear.