RDS - Firewall Ports Needed to run online

[kostascoffee]

Hello,

 

I wonder if someone could help me?

 

We are trying to make our RDS Server available online, but we need it to be accessible from our Firewall (We are a school).

Ive been asked to provide the Port Numbers that RDS would need to work successfully. I can't find them anywhere, so any clue as to where to locate them would be great, or if anyone knows 100% that also would be great!

 

Many Thanks,

Stam

[computer_expert]

I had a RD server and just port 443 was open inbound. Make sure you have RD gateway/web access installed and configured.

 

Whatever you do, do not open port 3389 inbound as that is a reasonably fast way to get compromised.

[kmount]

Tcp 443 and udp 3391 (optional but recommended) to the RD Gateway machine.

 

Never 3389.

[Jaymate]

Hi,

Having just been involved in a recent RDP attack i would make sure you have it all setup and secured befoe you open up any ports.

This article may help https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rdp-security-explained/

Also another piece of advise is to change the default ports to disguise it.

[free780]

You can put the gateway behind the Azure App Proxy which means it's protected by Microsoft's DDOS protection etc. However you can't leave Azure AD as the authentication mechanism. You have to pass through so you can't force 2FA unless you use the raidus plug in for NPS. The user won't get an on screen prompt. Also RDP gateway is only avaliable on IE without downloading a rdp file. You can use ericom access now or similar solutions which will work in any browser and safe guarded with AzureAD. Microsoft's own html5 rdp client may work with the NPS plug in but it doesn't SSO with AzureAD.

[ITGURU]

Port 443 is all I have open