We have a client who insists on having 6-7 lan PCs open to the internet for RDP. The RDP listening ports on each PC has been changed from default. These ports are forwarded in their Sonicwall TZ200 FW. I'm going to implement either or both of these security measures: require a vpn and allow RDP connections from lan addresses only, and/or create users in the Sonicwall and require the RDP users to authenticate to the SW before establishing the RDP session. But my question is still pertinent: Can the listening ports be determined by port scans against the firewall and public IP address, and, if so, how best to prevent?