Smoothwall RDP Gateway setup

[dazza007]

Evening all!

I have read almost every article and blog on remote desktop services, but unable to decide/figure out how to implement an RDS gateway using Smoothwall.

I have never setup remote desktop before so this is totally new territory!

I am inclined to have MFA and port forward 443 through the smoothwall (external>internal fw port) to the core switch onto the RDS gateway server on a DMZ with the Gateway domain joined via the core switch.

How insecure(bad) is this plan? Any pitfalls?

 

Any advice much appreciated!

Darren

[Roberto]

From the firewall perspective, you’re simply publishing a TLS-protected website over port 443. For the RDS gateway, if you’re going to isolate it in a DMZ, consider its needs to communicate with backend services and how that will work.

 

However, you mention MFA. My preference for this is Azure MFA, which makes a lot of sense if you use Office 365. In that case you should use the Azure App Proxy to publish your RD Gateway website. Have a read of this: https://parveensingh.com/publish-rds-environment-with-azure-ad-application-proxy/. This will greatly simplify things imo.

Edited May 2, 2021 by Roberto

[dazza007]

Thank you roberto! That article is superb!

 

Is it paramount to have the RDS Gateway on a DMZ ? Natting to internal servers without a DMZ seems wrong. I am googling vlan hopping as a security vulnerability and it seems that the gold standard is to have a DMZ

As you see I have set myself a big task here!

Edited May 3, 2021 by dazza007

[free780]

If you do use the Azure AD App Proxy you do not have to have inbound TCP 443 avaliable on the Internet. You most likely want to use the webclient. It's one of those services you have to set it up yourself to get your head around how it works.

[Roberto]

As Free780 says, it really is a gamechanger. You're publishing your sites via Azure instead of directly to the internet and this greatly changes the amount of work you have to do and reduces the threat profile, compared to publishing a site to the world traditionally.