Remote Network Access

CompTIA Network+ • Chapter 13

Remote Network Access

Learn how organizations extend secure access beyond the local network, select the right VPN and remote-control model, and protect administrative pathways with encryption, hardened intermediaries, and resilient management channels.

VPNSplit vs Full TunnelRDP & VNCSSH & APIJump HostsOut-of-Band
REMOTE USERPRIVATE NETWORKENCRYPTED TUNNEL
13.1 • Introduction

Extending Access Beyond the Local Network

Remote network access enables employees, administrators, branch offices, and service providers to reach private systems from homes, hotels, public networks, and other external locations. It supports telework, distributed operations, cloud administration, troubleshooting, and business continuity.

The same connection that improves flexibility can also become an entry point for attackers. Secure remote access therefore combines controlled exposure, strong authentication, authorization, encryption, monitoring, and reliable recovery paths.

Remote endpoint

A managed client, browser, branch gateway, or administrator workstation initiates access.

Gateway or server

A VPN concentrator, firewall, RD Gateway, jump host, or service accepts and controls the connection.

Trust controls

Authentication proves identity; authorization limits privileges; encryption protects data in transit.

Security principle: Remote access is not simply connectivity. It is connectivity through a deliberately controlled and auditable trust boundary.
13.2 • VPN Architectures

Encrypted Tunnels Across Untrusted Networks

A Virtual Private Network (VPN) creates a logical encrypted tunnel over an untrusted network such as the Internet. Encryption protects confidentiality, integrity checks reveal modification, and authentication identifies users, devices, or peer gateways.

BRANCH NETWORKHEADQUARTERSREMOTE USERVPN GATEWAYPRIVATE NETWORKSITE-TO-SITECLIENT-TO-SITE

Gateways connect whole networks; VPN clients connect individual devices.

VPN modelConnectsClient needed?Typical use
Site-to-siteNetwork to networkNo endpoint client; gateways establish the tunnelPermanent branch-to-headquarters connectivity
Client-to-siteIndividual device to private networkUsually dedicated VPN clientEmployees and mobile administrators
ClientlessBrowser to selected applicationsNo; standard web browserContractors or temporary, limited access

A site-to-site tunnel is commonly always on and transparent to users. A client-to-site tunnel is user- or device-initiated and normally requires credentials, certificates, and preferably MFA. A clientless VPN uses TLS through a browser and is convenient, but normally exposes fewer applications than a full network-layer client.

13.3 • Traffic Routing

Split Tunneling and Full Tunneling

Split tunnel

Only traffic for corporate destinations enters the VPN. Ordinary Internet traffic exits through the user's local gateway.

  • Reduces corporate bandwidth use.
  • Can improve Internet performance.
  • Creates simultaneous trusted and untrusted paths.
  • Requires careful endpoint and policy controls.

Full tunnel

All endpoint traffic enters the VPN before reaching either corporate resources or the Internet.

  • Central security controls inspect all traffic.
  • Provides consistent filtering and logging.
  • Consumes more VPN and corporate bandwidth.
  • Can increase latency for Internet-bound traffic.
REMOTE USERINTERNETCORPORATE

Split tunnel permits a direct Internet path; full tunnel sends all traffic through corporate controls.

Risk decision: Split tunneling is not inherently “wrong,” but it transfers more security responsibility to endpoint controls and precise routing policy.
13.4.1–13.4.2 • Remote Desktop

RDP and Remote Desktop Gateway

Remote Desktop Protocol (RDP) provides graphical control of a remote computer, including applications, files, printers, clipboard functions, and desktop interaction. It is Microsoft-developed, uses TCP 3389, and is supported by clients on several operating systems.

Directly exposing TCP 3389 to the Internet creates an attractive target for password attacks and exploitation. A Remote Desktop Gateway brokers RDP through HTTPS on TCP 443, using TLS and centralized access controls so the internal RDP service does not need direct Internet exposure.

1

The remote client creates an HTTPS/TLS session to the RD Gateway on TCP 443.

2

The gateway authenticates the user and applies authorization policy, often through Active Directory integration.

3

The gateway creates the controlled internal RDP connection to the approved destination.

Remember: RDP = 3389/TCP. RD Gateway = HTTPS over 443/TCP and avoids directly publishing 3389.
13.4.3–13.4.4 • VNC and VDI

Cross-Platform Control and Centralized Desktops

Virtual Network Computing (VNC)

VNC is a cross-platform remote-control technology, commonly associated with TCP 5900. It transmits screen changes as pixel data. Basic VNC deployments are not encrypted by default, so administrators should protect them with a VPN, SSH tunnel, or a secured implementation.

Virtual Desktop Infrastructure (VDI)

VDI delivers a centrally hosted operating-system desktop to a user's endpoint. Central administration standardizes environments, can reduce endpoint requirements, and helps control applications and data.

TechnologyPort / protocolDefault protectionMain distinction
RDP3389/TCPSupports TLSFeature-rich graphical remote access
RD Gateway443/TCPTLS via HTTPSSecure broker for internal RDP sessions
VNC5900/TCPNot encrypted in basic formCross-platform pixel-based screen sharing
VDIPlatform dependentDepends on delivery platformCentralized desktop image rather than one specific protocol
13.5.1–13.5.3 • Management Methods

SSH, Graphical Interfaces, and APIs

>_

SSH

TCP 22; encrypted command-line access, file transfer, tunneling, and public-key authentication. It securely replaces Telnet.

GUI

Remote desktop tools and web dashboards provide visual administration. They are approachable but normally use more bandwidth than text interfaces.

{ }

API

Programmatic interfaces enable repeatable automation and orchestration. REST APIs commonly use HTTP methods with JSON payloads.

Telnet sends credentials and session data in plain text, allowing interception on an untrusted or shared network. SSH encrypts the session and should be preferred for command-line device management.

REST methodGeneral purposeExample action
GETRetrieve a resourceRead device or interface status
POSTCreate or submit dataCreate a configuration object
PUT / PATCHReplace or partially updateChange an existing policy
DELETERemove a resourceDelete an obsolete object
Safe practice: Test API calls against a lab or public test API before production. Protect tokens, validate responses, use TLS, and apply least-privilege authorization.
13.5.4 • Console Access

Direct Access When the Network Is Unavailable

Console access connects directly to a network device through a serial or dedicated console interface. Because this path does not depend on IP addressing, routing, switching, DNS, or the device's production interface, it remains useful for initial configuration, password recovery, outage troubleshooting, and disaster recovery.

Typical physical method

Rolled console cable, USB console, serial adapter, or terminal server connection.

Common serial settings

9600 baud, 8 data bits, no parity, 1 stop bit—often written as 9600 8-N-1.

Key distinction: Console access is local or out-of-band management. It can work when the normal network path cannot.
13.6 • Secure Management Zones

Jump Hosts and Bastion Hosts

A jump host or jump box is a hardened intermediary used to reach systems in a restricted network. Instead of allowing administrators to connect directly from many endpoints, the organization funnels SSH or RDP through one monitored control point.

A bastion host is specifically hardened to withstand attack, often because it is positioned at or near a security boundary. The terms overlap in practice, but the emphasis differs: a jump host controls onward administrative access; a bastion host emphasizes exposure resistance and a minimal service footprint.

ADMINJUMP HOSThardened • logged • MFASERVERSWITCHFIREWALL

A single monitored entry point reduces direct exposure of restricted systems.

  • Harden the operating system and remove unnecessary software and services.
  • Require MFA and least-privilege administrative accounts.
  • Restrict source and destination access with firewall rules.
  • Record sessions, centralize logs, patch promptly, and monitor continuously.
13.7 • Management Paths

In-Band and Out-of-Band Management

Management typePathExamplesOperational consequence
In-bandUses the production network and normal device interfacesSSH, RDP, HTTPS dashboards, APIsConvenient, but may become unreachable during a network failure
Out-of-bandUses a separate management interface or independent networkConsole port, terminal server, dedicated management NIC/networkCan remain available when production forwarding fails

Out-of-band management is particularly valuable during failed routing, VLAN mistakes, ACL lockouts, control-plane problems, or widespread outages. A separate path also improves security by keeping management traffic away from ordinary user traffic.

Operational reality: You cannot repair a failed production network through an in-band path that depends on that same failed network.
13.8 • Interactive Practice

Choose an Access Method

Select a scenario to reveal the most appropriate starting technology and the reasoning behind it.

Select a scenario.
The recommendation will appear here.
13.9 • Knowledge Check

Test Your Understanding

1. Which VPN model best connects a permanent branch office to headquarters?
2. Which method sends both corporate and Internet-bound traffic through the VPN?
3. What safely brokers Internet-originated RDP connections over HTTPS?
4. Which protocol is the secure replacement for Telnet?
5. Which approach is most resilient during a production network outage?
13.10 • Chapter Summary

Essential Takeaways

Remote access requires a client, an accepting gateway or service, and protected authentication and data transport.
A VPN creates an encrypted tunnel across an untrusted network.
Site-to-site connects networks; client-to-site connects a device; clientless gives browser-based application access.
Split tunneling conserves corporate bandwidth; full tunneling centralizes inspection.
RDP uses TCP 3389; RD Gateway brokers it through HTTPS on TCP 443.
VNC uses TCP 5900 and basic deployments are not encrypted by default.
VDI centrally hosts and delivers standardized desktop environments.
SSH uses TCP 22 and securely replaces Telnet.
REST APIs enable automated management using methods such as GET, POST, PATCH, and DELETE.
Console access remains useful when normal IP connectivity is unavailable.
Jump and bastion hosts reduce exposure through hardened, monitored entry points.
Out-of-band management uses an independent path and supports outage recovery.