A secure remote access system includes client software installed on a portable computer that establishes a remote session with a counterpart server software installed on a server in a DMZ of the company's internal network through a secure tunnel. The DMZ server is connected to a router behind an enterprise second level firewall. The router routes the session to the appropriate desktop computer if the desktop is permitted remote access. A bandwidth limiter may be provided to balance the load through the router.