Best way of Protecting RDWeb RDS Gateway

[broadld]

Good evening,

 

Just wondering what people's experiences are with protecting RDWeb RDS servers. Only port 443 is port forwarded from the firewall. We have user account lockouts in place, MFA configured, Geo Blocking and have evlwatcher to block IP addresses with failed logins. We are looking to buy RDP guard. Is there anything else we can do?

I have been considering also looking at an azure app proxy.

[3s-gtech]

Putting it behind Azure App Proxy is the right idea. It’s easy enough to do, and it works well. I did the same for our RD browser solution.

[dhicks]

Just wondering what people's experiences are with protecting RDWeb RDS servers.

 

We have our remote desktop server behind a Cloudflare Zero-Trust gateway, with authentication at the gateway level via user's (2FA-protected) Google (or Microsoft, etc) accounts. That tunnels straight to the application server (in our case we're using Guacamole to present the web-based remote desktop) rather than forwarding port 443 from your firewall. Admitedly, probably a bit pricy for more than 50 users - a couple of other similar services are available (ngrok, possibly Tailscale) that might be a bit cheaper.

[broadld]

Do you need any additional licensing in Office 365 to run an app proxy?

[steveg]

Do you need any additional licensing in Office 365 to run an app proxy?

 

We have A3 and run it, not sure if that was a requirement though as it was put in after we already had the A3 licences.

[pete]

You need the ability to use Conditional Access (P1 or better) to turn it on as the admin and then every person using it needs a P1 (or greater, such as A3).

 

Just make sure you've got a couple of AAP Connectors on different servers so scheduled after-hours reboots don't knock out the service.

Edited November 29, 2024 by pete

[broadld]

I presume after it is configured you have to configure your firewall to only accept traffic from Azure? Otherwise someone would still be able to access the RDWeb server directly if they got your external IP address and browsed to it.

[smithson83]

No firewall config required. There is an app proxy client on your internal network that talks to azure, therefore all communications start from inside, so you don't need to configure port forwarding. You point your DNS to the azure app proxy so no public traffic directly traverses your firewall.

[broadld]

That's great so literally we can get rid of the open port and the connector does it all. I suppose the good thing about doing it this way, is the user is authenticated before they even get to your system!

 

No firewall config required.

There is an app proxy client on your internal network that talks to azure, therefore all communications start from inside, so you don't need to configure port forwarding. You point your DNS to the azure app proxy so no public traffic directly traverses your firewall.

[3s-gtech]

Yes, you can close the port.

[jthompson]

You also don't need any extra licensing (or need to be using Conditional Access) for Azure App Proxy.

[smithson83]

Has anyone managed to get RD apps working using the AppProxy?

 

I have it working great with all our internal web sites etc, but I can't seem to get RD Apps working via Work Resources eg SIMs etc.

[pete]

You also don't need any extra licensing (or need to be using Conditional Access) for Azure App Proxy.

 

https://learn.microsoft.com/en-us/entra/identity/domain-services/deploy-azure-app-proxy

 

A Microsoft Entra ID P1 or P2 license is required to use the Microsoft Entra application proxy.

 

And as you have that P1, you may as well turn on Conditional Access, since it's a really good idea.

Edited December 2, 2024 by pete

[jthompson]

https://learn.microsoft.com/en-us/entra/identity/domain-services/deploy-azure-app-proxy

 

 

 

And as you have that P1, you may as well turn on Conditional Access, since it's a really good idea.

 

Hmm. I really don't understand MS licensing. We don't have a Premium license for Entra ID, we have Office 365 A1, but we've been able to use the application proxy since whenever.

[pete]

Hmm. I really don't understand MS licensing. We don't have a Premium license for Entra ID, we have Office 365 A1, but we've been able to use the application proxy since whenever.

 

No-one does, including Microsoft licensing reps, when they're not crying quietly under their desks wondering what terrible thing they did in a previous life to deserve that fate.