Member Avatar for patkim

Hi to all,
I have a question about port forwarding & VPN.

Just recently attempted to setup a VPN connection to my home PC over internet and what I notice is that port forwarding on router is not needed for other services to be accessed on a LAN PC that's behind router, say RDP to a home PC, once you are inside VPN

Say I want to RDP to my home PC on its WAN IP on port say 3389 without VPN (ignore for now that it could be a security issue) then I need to forward 3389 in router to the destination home PC on LAN.

However once I establish a VPN connection to the home PC, it works without port forwarding. All I needed to do was only forward the ports to establish VPN in the first place.

Is this how it’s supposed to be?

Thanks.

Edited by patkim
  • 3 Contributors
  • 2 Replies
  • 269 Views
  • 5 Hours Discussion Span
  • Latest Post Latest Post by rch1231

Dani AI

Generated

Short answer: this is expected in typical remote-access VPN setups. observed the effect, and and gave the correct high-level reasoning. The tunnel makes the client routable into the private network so separate WAN->LAN forwards for services like RDP are normally unnecessary — but there are several real-world caveats that commonly confuse people.

  • VPN mode: routed (layer 3) vs bridged (layer 2) changes how addresses and broadcasts behave. Routed clients may need explicit routes on the server or router.
  • Split tunneling: if the VPN only sends some subnets through the tunnel, traffic to the RDP host might not go via the VPN unless a route or "use remote gateway" is added.
  • Firewall and interface bindings: host firewalls often apply rules by network profile or interface. RDP can be blocked on the VPN interface even though it is allowed on the LAN. Also check whether RDP is listening on the IP assigned to the VPN.
  • NAT loopback (hairpin): connecting to the home public IP while on the VPN can behave oddly; prefer the internal IP or internal DNS name when connected to the VPN.
  • Upstream NAT/CGNAT: if the ISP prevents inbound connections, the VPN server might be unreachable unless a public forwarding or relay is used.

Quick troubleshooting checklist (use the variant for the client/server OS):

  • Verify the VPN-assigned IP: ipconfig /all or ip addr.
  • Check routes: route print (Windows) or ip route (Linux).
  • Ping/traceroute the target internal IP: ping 192.168.x.x / tracert 192.168.x.x.
  • Test the port: PowerShell Test-NetConnection -ComputerName 192.168.x.x -Port 3389 or telnet 192.168.x.x 3389.
  • Confirm the server is listening: netstat -an | findstr 3389 (Windows) or ss -ltn | grep 3389 (Linux).

Security note: avoid exposing RDP to the Internet. Forward only the VPN ports to the VPN endpoint and keep remote desktop access inside the tunnel; adjust firewall rules so the VPN interface is allowed but public exposure is minimized.

Recommended Answers

All 2 Replies

Member Avatar for JorgeM

That's because the VPN session is encapsulating all of the packets to and from the client and VPN server. If you take a packet trace you will see that there will not be any RDP related packets. All of the packets will be VPN related.

Think of VPN was a wrapper. Once the packets reach the VPN sever they are unwrapped and then delivered as normal traffic. That's why VPN is called a "tunnel". While the packets are encrypted, you cant see inside this "tunnel". When the wrapper is removed, you have the unencrypted data. This data is encrypted between vpn client and vpn server. ON either side of the vpn tunnel, the traffic is not encrypted.

Edited by JorgeM
Member Avatar for rch1231

Hello,

A VPN connection effectively connects you to the local area network so port forwarding is not necessary because you are already inside the routers firewall and part of the LAN.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.