RDP and VNC Access to Remote Machines

What you will have at the end#

A retailer's support team looks after machines in its stores. Two of them are the running example:

• pos-0031, a Windows back-office PC, reached over Remote Desktop (RDP) on port 3389.
• sign-0207, a Linux signage player, reached over VNC on port 5900.

From a support laptop, one command makes both desktops available on local ports:

localport access pos-0031-northwind-stores.eu.localport.dev -L 13389:3389

Remote Desktop Connection then opens localhost:13389 and shows the store PC's desktop. Neither store machine accepts a connection from the internet, and the store's router needs no change.

Before you start#

You need:

• A team on the Pro, Business or Enterprise plan. Remote Access is not available on other plans.
• The owner or admin role to create the fleet and write grants. Support staff with the developer role connect once granted.
• Remote Desktop turned on on the Windows PC. Windows Pro, Enterprise and Server accept Remote Desktop connections. Windows Home does not.
• A VNC server running on the Linux machine, with a password set.
• The Localport agent on each remote machine and on each support computer, from Installation. It runs on Windows, macOS and Linux.

Why not put Remote Desktop or VNC on the internet#

A Remote Desktop or VNC port with a public address is reachable by anyone who scans for it, and the desktop's own login becomes the only check. Exposed remote desktop services are one of the most common ways attackers get into a network.

With Remote Access, the remote machine has no public port at all. Its agent connects outward to Localport on port 443. A support computer reaches the desktop only after Localport has checked its certificate and an access grant for that machine. The desktop's own login then applies as well, so two separate checks stand between the internet and the screen.

Prepare the remote machines#

Step 1: Create the fleet and the devices#

In the dashboard, go to Fleets and click Create fleet. Name it Stores, choose a Region, and click Create Fleet. Open the fleet's Settings and enter northwind-stores in Subdomain, then save.

The sheet moves to Create device & Connect. Enter pos-0031, add port 3389 with protocol TCP, and click Create device. On the Devices tab, click Create device again for sign-0207 with port 5900 as TCP.

Each device's address is its name joined to the fleet subdomain, such as pos-0031-northwind-stores.eu.localport.dev. Give each kind of machine its own name prefix, pos- and sign-. Grants can then name a prefix, and a grant reaches every port allowed on the devices it covers. Detailed guide: Fleets.

Step 2: Start the agent on the Windows PC#

On the Windows PC, install the agent in PowerShell:

irm https://localport.io/install.ps1 | iex

Open a new PowerShell window so the agent is on your PATH. The device's Create device & Connect sheet shows its command. Run it:

localport connect --token tok_YOUR_FLEET_TOKEN --region eu --name pos-0031 --allow-ports 3389

• --name pos-0031 is the device this PC connects as. It must match the dashboard.
• --allow-ports 3389 limits the PC to Remote Desktop, whatever the dashboard allows later.
• The fleet token is a password for every device in the fleet. Keep it out of shared screens and scripts.

The device turns online on the Devices tab within seconds.

To keep the PC reachable after a restart, start the agent at boot. Create a task in Task Scheduler with the trigger At startup that runs localport.exe with the same arguments, without --token. Set the token as the LOCALPORT_TOKEN environment variable for the task, or point LOCALPORT_TOKEN_FILE at a file only the task's account can read. A token in the arguments appears in the task definition and in the process list. Detailed guide: Run the agent as a background service.

Step 3: Start the agent on the Linux player#

On sign-0207, install the agent and run the device command with its own name and port:

localport connect --token tok_YOUR_FLEET_TOKEN --region eu --name sign-0207 --allow-ports 5900

For a machine that must stay reachable, run it as a systemd service, which reads the token from a file only the service can read. Follow Run the agent as a background service and use this command, without --token, as the unit's ExecStart=.

If the VNC server can listen on localhost only, set it that way. The agent delivers connections to localhost on the device, so the VNC port then answers nothing on the store's own network either.

Step 4: Grant your support team access#

A fleet reaches nobody until a grant names who may connect. Open the fleet's Access tab and click Give access:

• Type: choose Member for one person, or Role for everyone in a role.
• Who: choose the person or the role.
• Access: leave All devices off, type pos-* in the search field and press Enter to add it as a pattern. Add sign-* the same way if they look after the players too.

Then click the Give access to button, which names who you chose.

A role grant covers that role only. Owners and admins who also connect need a grant of their own. Detailed guide: Grants and Access.

Open a remote desktop#

Step 5: Sign in on your support computer#

localport login

The agent prints a link and a code. Open the link in any browser, sign in, choose the team if asked, check that the code matches and click Sign in. The certificate is created on your computer, lasts 8 hours and does not renew. Run localport login again the next working day. Detailed guide: Member Access.

Step 6: Forward the Remote Desktop port#

On the fleet's Devices tab, click Access on the pos-0031 row. The Connect over mTLS sheet lists the device's ports under Ports to forward. Keep 3389 checked, type 13389 as its local port, and click Copy command:

Run it in a terminal and leave it running:

localport access pos-0031-northwind-stores.eu.localport.dev -L 13389:3389

-L 13389:3389 listens on port 13389 of your computer and carries each connection to port 3389 on the store PC. A local port other than 3389 avoids a clash with a Remote Desktop service on your own Windows computer. The listener accepts connections from your computer only.

The command can stay open all day. If its connection to Localport closes while no desktop is open, the next connection opens a new one.

Step 7: Connect your Remote Desktop client#

Point your client at localhost:13389:

• Windows. Open Remote Desktop Connection (mstsc), enter localhost:13389 as the computer and click Connect.
• macOS. In Windows App, add a PC with the name localhost:13389.
• Linux. In Remmina, create an RDP connection to localhost:13389, or run xfreerdp /v:localhost:13389.

Sign in with a Windows account on the store PC. The client may warn that it cannot verify the PC's certificate, because the name you typed is localhost. Check the certificate details against the PC's own before you accept.

Step 8: Open a VNC screen#

The Linux player works the same way on its own port:

localport access sign-0207-northwind-stores.eu.localport.dev -L 15900:5900

In your VNC viewer, connect to localhost on port 15900 and enter the VNC password. Viewers that read host:number as a display number, such as TigerVNC, take localhost::15900 with two colons.

Step 9: Reach several machines at once#

Each localport access command reaches one device, and -L repeats for each of its ports. To keep several machines open, run one command per device, each with its own local port:

localport access pos-0031-northwind-stores.eu.localport.dev -L 13389:3389
localport access pos-0032-northwind-stores.eu.localport.dev -L 13390:3389

For a fixed set used every day, list them in an access config file:

version: 1

access:
  - device: pos-0031-northwind-stores.eu.localport.dev
    forward: ["13389:3389"]
  - device: sign-0207-northwind-stores.eu.localport.dev
    forward: ["15900:5900"]

Start every forward in it with one command:

localport access --config access.yaml

Each local port must be unique in the file. Add identity: to an entry when your computer holds more than one credential. Detailed guide: CLI.

Keep remote desktops secure#

• Leave the desktop's own login on. Keep Network Level Authentication on for Remote Desktop and a password on VNC. Localport decides who reaches the machine, and the desktop still decides who signs in.
• Keep the forward on your computer. The dashboard's Reachable from the whole network switch makes the local port answer for any machine that can reach your computer, without a certificate of its own. Leave it off on a laptop.
• Limit the device's ports. --allow-ports 3389 keeps the PC to Remote Desktop.
• Grant by prefix. Store PCs and signage players under different prefixes let you grant them to different people.
• Review the access log. Each session records the identity, the device and port, the source address and the duration. Detailed guide: Access Log.

How long a session lasts#

A desktop session stays open while your certificate is valid, the device's agent stays connected and your access stands. A sign-in lasts 8 hours, and the session closes when it expires. Removing your grant closes it at once. An open session is never closed for being idle. The full list: How long a session lasts.

Troubleshooting#

The agent prints these messages in the terminal where localport access runs. A remote desktop client shows only that the connection failed.

Limitations#

• TCP only. Remote Desktop can use UDP for smoother video and falls back to TCP when UDP is not available. Through Localport it runs over TCP.
• No browser viewer. Connect with a Remote Desktop or VNC client on a computer that runs the agent.
• Sign-in sessions end at 8 hours. Use a setup key for a workstation that connects every day.
• A grant covers every port allowed on the device. Machines that different people should reach belong under different prefixes.

Frequently asked questions#

What to read next#

• SSH into Devices Behind NAT, CGNAT or Firewalls. The same setup for a terminal.
• Set Up Remote Access to a Device Fleet. Many devices, auto-join and role grants.
• Setup Keys. Machine identities that renew themselves.
• Grants and Access. Who reaches which devices.
• Access Log. Every session, with the identity behind it.