How to block public IP access for RDP while keeping VPN access
Even when a virtual private network is set up, standard configurations often leave Remote Desktop accessible via a public IP address. This leaves administrators stuck trying to remove public RDP options without blocking legitimate connections through approved networks.
Core Friction Pattern
Analysis of 4 peer accounts across online developer and community forums reveals that “How to block public IP access for RDP while keeping VPN access” repeatedly surfaces due to edge-case mismatches between standard defaults and real-world environments. Standard troubleshooting frequently falls short, compelling practitioners to develop custom workarounds.
+6 alternative community-tested workarounds cataloged below.
What the numbers show
Counted from the threads quoted below. How we count
- People have been saying this in most months since September 2026.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
How to block public IP access for RDP while keeping VPN access
- 1Adding a block rule in the firewall for the public profile to port 3389Did this help you?
- 2Configuring upstream provider firewall rulesDid this help you?
- 3Using alternative mesh VPN solutions like TailscaleDid this help you?
- 4Using a zero-trust mesh VPN like Tailscale on a small PCDid this help you?
- 5Replacing the consumer router with a business-grade router (e.g., MikroTik) running Wireguard or OpenVPNDid this help you?
- 6Setting up a Cloudflare TunnelDid this help you?
- 7Disabling remote access entirely and restricting the system to the local Wi-Fi networkDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“The web console is going to be port-forwarded directly out to the internet, anyone who scans it will find it. It controls access for all the doors and elevators in the building.”source ↗
“So being said, what options do I have to try and protect this on the cheap? Ideally something that could be looked after by a lay-person after me, but that's a future them problem.”source ↗
“It works, but i can't seem to remove the options to RDP via public IP.”source ↗
“I "invested" 6 full hours to no avail, searching, reading, and trying.”source ↗
“This happens a lot, especially with environmental control guys... Suggest to your building VPN or nothing... if they do port forwarding you're no longer going to help.”source ↗
“opening stuff up to the internet is not the best of ideas anymore.”source ↗
“I can see it happening with environment control guys or access control in this instance as its not really their bread and butter to do proper IT controls as they don't understand it and their clients likely won't either.”source ↗
“What are the methods are you all using to allow ScreenConnect to exist but not necessarily connect to non approved sites?”source ↗
Where this came up
People with this problem also raised
- 2How to block desktop apps from accessing local files
- 4Why do B2B clients keep asking to whitelist huge IP ranges?
- 3How to limit project visibility to assigned resources
- 3QNAP NAS shared folder opens but is empty for Apple users
- 6Locked out of new network switches because the consultant left
- 3Why won't senior staff let junior admins do anything?