First: It doesn't matter whether you connect a router, or a PC. The real difference is whether any device you connect can obtain an "external" IP address.
If you connect your PC directly and it obtains a global IP address, then "port forwarding" is simply unnecessary. (The computer can already be reached directly!)
On the other hand, if you don't have a global IP address, then connecting an additional router on top wouldn't help at all, as port forwarding is only useful if the router itself can be reached.
So, given that, is the 141.72.236.77 address actually yours (i.e. can you see it in ipconfig
), or is it simply the whole building's external IP address?
Second: You've only posted a screenshot of the "No-IP" dynamic update client. It has nothing at all to do with VNC or RDP. "No-IP" only gives you a domain name for your IP address, but doesn't set up any connection in any direction.
So first you should try to set up the actual RDP connection to your IP address (and it won't use port 80), without such distractions as dynamic DNS.
Finally: Firewalls know which direction packets travel in. It's trivial to block incoming TCP connection attempts, while still allowing outgoing connections, and many LANs actually do that to avoid students from running their own servers without approval.
Likewise, TCP ports only make sense in a specific direction. If you can make outgoing TCP connections to port 80 (yourPC:12345 → webserver:80), that's different from receiving incoming connections to the same port (yourPC:80 ← client:34567).
So you should perhaps contact the IT administrator, and somehow answer the following:
Does the network's policy allow connecting from outside?
Does your computer have a global IP address?
Does the building's firewall allow incoming connections? (Likely not.)
Specifically, are RDP connections to port 3389 allowed? (Historically, RDP was the target of many worm attacks, so it could be that stuff like game servers are allowed, but RDP is blocked anyway.)
thank you for the detailed answer. This helped a lot.. and cleared up some of my doubts. So in order: -no, it is not my IP address. I would never expect them to give each user a public IP. They use DHCP - which is what I see in ipconfig.
I will inquire the administrators asap about all this. – Mike94 – 2015-10-12T07:05:27.593
I've also done a port scan, which shows all ports are blocked. However I am not sure how accurate this information is, as I was able to connect to a VPS via SSH - port 22 (even though this doesn't work all the time ?). I tried to use Google DNS (I foolishly thought I could bypass the network DNS servers), but that didn't help of course. – Mike94 – 2015-10-12T07:30:32.143
Well, some universities do have vast ranges of global IP addresses and can afford it, but I guess it's rare. — As for DHCP, it can assign any type of address equally; most home routers obtain their global address via DHCP as well. — The network policy is the written rules (terms of service that you might have signed, etc.); the firewall rules are written to enforce the policy. – user1686 – 2015-10-12T07:40:25.273
— What have you done the port scan against? Again, ports aren't a "global" thing. If you're trying to set up incoming connections, the scan must also be incoming, i.e. it must be performed from outside against your computer, not from your computer to google.com. — Also, ports aren't strictly "open or closed" either. Some say a port is "open" when it's allowed by firewall. Others say it's "open" when a program is accepting connections. To establish a connection, you need both. Thus you must actually enable Remote Desktop before anything else, otherwise scan results will be misleading. – user1686 – 2015-10-12T07:44:49.347
— Same for the "connecting to a VPS" check. Again, as I've written yesterday, connections have a direction – if you can SSH or RDP out, doesn't automatically mean you can SSH or RDP in. — Finally, as for Google DNS... sure, most of the time you could actually bypass the network's DNS servers, but how would that help you? Changing DNS servers only matters if the current ones are giving you wrong replies, but you haven't determined that they do so. – user1686 – 2015-10-12T07:47:53.153
thank you. For port scanning, I've simply used this..http://www.whatsmyip.org/port-scanner/ About the DNS.. I was assuming that the firewall, potentially blocking some ports/connections would be on the DNS server (as is the case of OpenDNS for example).
– Mike94 – 2015-10-12T08:02:03.907A DNS server is only used for translating names to addresses, but it doesn't carry the actual connection packets. So it can only lie (e.g. point undesired domains to the block page, as OpenDNS does), but cannot outright prevent a connection from happening (especially when connecting directly to an IP address, when DNS is not involved at all). – user1686 – 2015-10-12T08:07:09.747
But anyway, the conclusion is, you only have an "internal" IP address (you're behind a NAT), meaning you will need to use some sort of VPN / proxy (SoftEther, ZeroTier One, etc.) – user1686 – 2015-10-12T13:17:39.133
yes. I managed to create a remote desktop connection with ngrok, which works quite well. I still need to figure out how to do the same with VPN (or SSH). Thanks again for help. – Mike94 – 2015-10-15T09:13:10.897