Limit RDP Client Access to only a single external server.

[chazzy2501]

ok, We now have Yeovil College students attending our school. They're required to access their work remotely via RDP using a proper RDP gateway. I'm not a big fan of this idea and I actively block the RDP client from even running for pupils.

 

As I understand it the RDP client can use SSL to connect as well as a dynamic port for RDP. How can I create a firewall rule that would allow the client to only connect to a single ip address?

 

(incoming I could do as I'd know the port and the range to limit) What I need is a block all, except... can windows firewall do that? can I do it by DNS instead of ip? the gateway is "workspace.yeovil.ac.uk" is that all I'd need to unblock? not the final computer "studentdesktop.yeovil.ac.uk"

 

 

cheers

[ataylor]

Our students do their homework through our Gateway - the gateway is the only external facing device open on port 443 which then redirects to one of our two RDP session host servers (which are not public facing), not sure if that helps? We have recently started using the HTML 5 RDP session which also seems to work very well.

[chazzy2501]

Yes, my issue is the other end. How would I limit my clients (for example) to only connect to your gateway and no other rdp provider.?

[chazzy2501]

the answer was a blocking rule with a defined scope. (I didn't consider the scope working with the blocking rule)

 

I blocked the outbound range (for the mstsc.exe) 1.1.1.1 to 212.219.242.145 and 212.219.242.147 to 255.255.255.255 this worked a treat.

 

this was unfortunately a machine rule not a user rule so I can't use pupil PCs to hop on to a server now. (before I had a user rule stopping mstsc.exe)

[MatthewL]

If I am right in thinking all it is is a webpage served on workspace.yeovil.ac.uk:443 i.e. /rdweb and you login and it launches the remote session from there with no need to mess with the MSTSC port 3389.

 

If if it using MSTSC in my firewall I would always have a deny all then allow 80/443 and I would just create an entry to allow 3389 to workspace.yeovil.ac.uk.

[bwestlake]

Nslookup the url add ip rule into your firewall /32 to allow 443/3389 then create them a saved mstsc file to the url