Forefront TMG 2010 RDP Connections without non-standard ports

Question

From my reading, it looks like the Forefront TMG will not allow the passing of RDP connections through the firewall without configuring a non-standard port for each IP address of the internal servers and clients. The firewall will only listen for RDP traffic to a certain IP address on a certain port. Is this correct?

If this is the case, does anyone have a suggestion as to how to easily allow external connections over RDP to clients without using VPN? I work in an academic environment and almost everyone in the domain (admins, professors, and researchers) need access to their boxes remotely. All of our IPs are static and routable.

Solution 1

From my reading, it looks like the Forefront TMG will not allow the passing of RDP connections through the firewall without configuring a non-standard port for each IP address of the internal servers and clients.

Well, from my reading of your question it looks like you dont know how to use RDP, at least the current iteration ;) I happily connect to whatever server I want behind my TMG without configuring a port per server.

TMG supports what has been standard in windows - a gateway server.

That pretty much means that your remote desktop client connects to the gateway server (using HTTP, btw.), then the calls get forwarded from there to the final server internally.

This is a standard setting in the remote desktop client where you can enter the gateway host address (url) which most administrators do not know because of not bothering to read the documentation.

http://technet.microsoft.com/en-us/library/cc731264%28v=ws.10%29.aspx

explains what a Terminal Services Gateway is and how it works in general.

http://www.isaserver.org/tutorials/Microsoft-Forefront-TMG-Publishing-RD-Web-Access-RD-Gateway-Part1.html

has some explanations how to set things up for TMG. This one creates a web site for connecting.

it reaslly is quite easy to set up. And using HTTP as carrier protocol for RDP has the serios advantage of being able to work quite often when normal TCP forwarding is disabled or limited by firewall rules ;)

http://www.windowsecurity.com/articles/Configuring-Windows-Server-2008-Terminal-Services-Gateway-Part2.html

talks of publishing TS Gateways directly ;)

Solution 2

That is not correct, no.

Well, that's how it's set up by default, but it's not carved in stone or anything.

The default Protocol definition for RDP does only listen on port 3389, but can be changed. See screenshot. Simply navigate to your Firewall Policy, then Toolbox (on the right hand frame), then Protocols. You can create a new Protocol for your custom RDP port(s), and assign whatever port range you want to it.

The easier solution, (which I see TomTom just posted) is to set up a TS/RDP gateway, so you don't have to worry about messing around with ports, or NATing an external address for all the machines that need to be connected to over RDP.

Default:

Custom port range I set up through the new protocol wizard:

Comments

[emhohensee]

Assigning ports to IP addresses one to one is how it is presented in the MS Forefront TMG Administrator's Companion. It doesn't make any mention of a TS Gateway but this looks perfect. Thank you.