- invisible to my neighbors
Turn off SSID broadcasts. Won't see it in network lists but a sniffer will still see traffic and know that it's there. Whether they'll know it's your network depends on what else is around. If it's transmitted, someone can receive it if they're in range.
Brings up another point. AP in a basement helps limit its range to mostly just your house. Put it on the second floor of a house and it'll easily cover a city block in most environments. Control where the RF goes, less risk... someone would have to be parked in my driveway or aiming a high gain antenna at my property to receive my AP's packets for example.
- locked down to only accept connections from a particular wireless card.
Many wireless access points can filter traffic by MAC address. It's possible for an attacker to spoof a valid address but that assumes they have gotten past the other layers of defense. Never a bad idea to lock a wireless network down to only known computers. Takes a little effort to round up all the MAC addresses though. I don't bother...
- has some fancypants encoding for the network traffic beyond the standard WPA type stuff
Not really.
That way I could use the laptop within the network without having to go through the VPN client.
Hmm. I kinda liked your VPN client setup. But they can be a bit of a pain I suppose.
I mostly use RDT onto a workstation. How secure is that from someone simply peeking onto my desktop ?
Not sure what you mean here. You mean versus someone shoulder-surfing while you're at the desktop or watching the RDP session over the air?
RDP is encrypted by default but will fall back to lower encryption or none at all on really old versions of RDP. Group Policy can be used to disable the auto-fallback is my understanding.
I'm a Unix geek by trade so I'm usually SSH tunneling VNC and or X itself and not using much Microsoft RDP. I have the Microsoft RDP client loaded on my Mac for occasional use is about all.
You could port forward only RDP in through the firewall. More convenient than having to VPN first but makes the machine running RDP service a bigger target if other people can get to it from outside.
The beauty of the VPN setup is that you're a complete insider when it's up and you don't have to expose any services to the external network.
Moving things to odd-ball port numbers won't stop a motivated hacker targeting you but it will typically kill any chances of an automated script (often poorly written) finding a particular service. Security by obscurity as they say. Not the best but it does work for a lot of things.
