Exposing RDP (port 3389) directly to the internet invites relentless brute-force attempts, and puts the RDP service itself in front of every exploit. Remote Desktop Gateway (RD Gateway) wraps RDP inside HTTPS on port 443. Clients authenticate to the gateway first, and only then reach the server’s RDP, which is never exposed directly. It’s Microsoft’s built-in way to publish remote desktop access more safely.

When RD Gateway fits

  • Several users need RDP access from changing locations.
  • Company policy forbids open 3389, but a VPN isn’t practical for all users.
  • You want central access policies: who may connect to which servers.

For a single admin, a VPN or IP allow-list is simpler. See the alternatives at the end.

Requirements

  • Windows Server (2019, 2022 or 2025), with an administrator account.
  • A DNS name, e.g. rdgw.example.com, pointing to the server.
  • A TLS certificate for that name, trusted by clients (from a public CA).
  • Port 443 TCP (and optionally 3391 UDP for the UDP transport) open in the firewall.

1. Install the role

Install-WindowsFeature RDS-Gateway -IncludeManagementTools

Or use Server Manager: Add Roles and Features → Remote Desktop Services → Remote Desktop Gateway (this also adds Network Policy Server).

2. Install the certificate

Get a certificate for rdgw.example.com. Options include a commercial certificate, or Let’s Encrypt via a Windows ACME client such as win-acme, which can also automate renewal and binding. Import it into Local Computer → Personal (with its private key).

Then, in RD Gateway Manager → server properties → SSL Certificate tab, select that certificate. Make sure it renews automatically and gets rebound, since an expired certificate breaks all connections.

3. Create the policies

RD Gateway uses two policy types (RD Gateway Manager → Policies):

Connection Authorization Policy (CAP): who may use the gateway.

  • User groups: e.g. a dedicated RDGW-Users local or AD group.
  • Optionally require smart cards, and set idle timeouts.

Resource Authorization Policy (RAP): which computers they may reach.

  • Allow only specific servers or groups (not “any computer”).
  • Port: 3389.

Create the group, and add users:

New-LocalGroup -Name "RDGW-Users"
Add-LocalGroupMember -Group "RDGW-Users" -Member "alice"
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "alice"

4. Firewall

Allow 443 inbound, and block 3389 from the internet:

New-NetFirewallRule -DisplayName "RD Gateway HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
# keep RDP reachable only from the gateway itself / internal networks
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress LocalSubnet

If the gateway and the target are the same server, RDP only needs to be reachable locally. See Windows Firewall with PowerShell.

5. Configure clients

In Remote Desktop Connection (mstsc): Show Options → Advanced → Connect from anywhere → Settings:

  • Use these RD Gateway server settings: rdgw.example.com
  • Logon method: Ask for password (NTLM)
  • Tick Use my RD Gateway credentials for the remote computer if they’re the same.

Then enter the target computer name (e.g. localhost or the server’s internal name) on the General tab. Save as a .rdp file, and distribute it to users.

The Microsoft Remote Desktop apps on macOS, iOS and Android support gateways too.

6. Add MFA

RD Gateway itself only checks passwords. Options:

  • NPS extension for Microsoft Entra MFA (requires Entra ID licensing);
  • third-party MFA integrations (Duo and others) for RD Gateway;
  • or require VPN plus RDP, so two layers are needed.

Monitoring

RD Gateway logs connections in Event Viewer → Applications and Services Logs → Microsoft → Windows → TerminalServices-Gateway. Combine them with Security log auditing (event 4624 type 10, 4625). See audit logons.

Simpler alternatives

Option Effort Notes
Firewall: RDP only from your IPs Low Best for a single admin with a static IP. See RDP brute-force protection
VPN (WireGuard, Tailscale) then RDP Low–medium RDP never exposed. Works for small teams. See WireGuard
SSH tunnel to RDP (OpenSSH on Windows) Low ssh -L 3390:localhost:3389 user@server, then RDP to localhost:3390
RD Gateway Medium Native, policy-based, HTTPS only
Changing the RDP port Low Reduces noise, not real security. See change the RDP port

Quick reference

Task Command / place
Install Install-WindowsFeature RDS-Gateway -IncludeManagementTools
Certificate RD Gateway Manager → Properties → SSL Certificate
Who may connect CAP (user groups)
What they may reach RAP (computer groups, port 3389)
Client mstsc → Advanced → RD Gateway settings
Logs TerminalServices-Gateway operational log

Related: Windows VPS and ransomware protection.

  • Windows
  • Windows Server
  • RDP