RDS - How to Set Up the Firewall and its settings

[kostascoffee]

Hi,

 

I wonder if someone could help.

I haven't been able to find any information on setting up the firewall for RDS (How to set up and anything else needed for it).

We are a school, and we would like staff to login from home and access the apps that we have made available for them.

 

Any help would be appreciated!

 

Thanks!

[supportman]

First thing I would do is change the port of the RDS server from 3389 to something else, you can do that with a simple registry edit.

 

Ideally it should be behind all kinds of security because there are well known vulnerabilities to brute force hack passwords that ransomware distributors use.

 

EDIT: I think you can limit login attempts also.

[kostascoffee]

Wonderful, thank you for the heads up, any idea about how to set it up?

[supportman]

Sure just add the terminal services role to windows 2019 server, install your licensing and don't forget to link the licensing server to the host.

 

Then just change the listening port

 

https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/change-listening-port

 

And also the login attempts

 

https://social.technet.microsoft.com/Forums/Lync/en-US/d5338638-0c7f-426a-866d-e9183da83bb9/how-to-limit-denied-rdp-login-attempts-before-disconnecting-not-disabling-account?forum=winserversecurity

[kostascoffee]

Any recommended ports to use? Not entirely sure how they behave etc.

Login attempts link seems great.

 

I have most of the things run off of 1 server at the moment, we have got a licensing server, so I will link that in.

[chazzy2501]

I'd not recommend you put RDS on the internet. M$ have had numerous recent security issues with the product and the gateway. it's an old product with a broken security model that gets little development.

 

if you really must have it don't put it on the internet, set up a VPN and then have your clients RDS to the services.

 

You could also use direct access or its replacement always on VPN without RDS.

[CHiLL]

To access RDS from the outside world, you really should be using RDS Gateway. The Gateway server sites on your DMZ/Internet side and processes authentications/access and passes successful authentications through to your RDS server, which is on your internal network.

 

We currently have two methods of remote access - RDS and Always-On VPN. RDS is extremely slow when multiple users access it due to server resources. Always-On VPN is a much cleaner way to manage it.

 

There was recently a vulnerability in RDS and RDS Gateway that could allow attackers through, bypassing authentication completely.

[kostascoffee]

We have a VPN set up, but need to get RDS to talk to our VPN, what ports do we need open for that? ... Or what do we need to do to make it work?