What Is a Remote Desktop Gateway Server

Gateway server


In computing, a server is a piece of computer hardware or software that provides functionality for other programs or devices, called “clients”. This architecture is called the client–server model

What is Remote Desktop Gateway?

Remote Desktop Gateway (RD Gateway) is a role service that enables authorized remote users to connect to resources on an internal corporate or private network, from any Internet-connected device that can run the Remote Desktop Connection (RDC) client. The network resources can be Remote Desktop Session Host (RD Session Host) servers, RD Session Host servers running RemoteApp programs, or computers with Remote Desktop enabled.

RD Gateway uses the Remote Desktop Protocol (RDP) over HTTPS to establish a secure, encrypted connection between remote users on the Internet and the internal network resources on which their productivity applications run.


Gateway Server

A server designed to transform data streams to better match device capabilities. For example, Wireless Application Protocol (WAP) gateway servers convert HTML to Wireless Markup Language (WML) for wireless devices, and a number of products can reformat HTML for devices such as mobile phones and personal digital assistants (PDAs). Today, HTML-based servers predominate. While HTML can be made aware of a unique device requesting content, more often “shadow” Web server applications are created to draw off and reformat the native content.

A ‘gateway server’ acts as a middleman, brokering transactions between a client computer and another server. This configuration is typically used to serve content to clients that would otherwise be unable to access the remote server, but it can be used to impose additional security restrictions on the client. The gateway hides the remote server; to the end user, the content appears to come directly from the gateway server.

This architecture makes the portal the single point of access for content, and allows remote servers to reside on a private network or behind a firewall. As long as the portal can connect to the remote server, users can view the content, even if they cannot access it directly. To the browser, the portal appears to be the source of content on the remote server.

When a user interacts with a portal service, any request made to a URL in the gateway is automatically rerouted through the portal. To the user, the content appears to come from the portal; the remote server is an unknown back-end system.


There are many benefits to this configuration. The most useful to portal services are:

  • Dynamic functionality and personalization: The portal intercepts requests from portlets, which allows it to include information stored in the portal database in HTTP requests and responses. Most of this information is accessible through Oracle WebCenter Interaction Development Kit (IDK) methods. In many situations, an adaptive tag provides the functionality you need, including navigation and login elements. Custom tags can be created for additional functionality.
  • Security: Services can allow users to access content that is not publicly available. Files stored on a secure server can be made available by including specific URLs in the configuration of the gateway. Note: The gateway is a powerful feature, and can compromise security if incorrectly configured. Allowing direct access to a remote server that hosts unprotected private content could create a dangerous security hole.
  • Performance: The portal caches gatewayed content, decreasing response time for end users and improving performance on the remote server. While gatewaying works efficiently for content like HTML, it is generally not appropriate for binary data like static images. Images do not need to be transformed, and gatewaying large images can adversely affect the performance of the portal. This is one reason the Image Service should be used to prevent routing static images through the gateway.

The collection of URLs that should be gatewayed for a service is configured in the Web Service editor on the HTTP Configuration page. In the Gateway URL Prefixes list, you must enter the base URLs for any directories that should be gatewayed.

Keep the following warnings and best practices in mind when implementing services that use the gateway:

  • URL transformation: The portal must transform code so that gatewayed URLs open correctly. Before the portal sends a response, it parses the HTML and looks for any URLs included in the Gateway URL Prefixes list for the associated Web Service object. The portal transforms any URLs that should be gatewayed before returning the response to the client. Relative URLs are transformed to point to the correct location.
  • Scripting limitations: JavaScript constructs that dynamically create URLs can cause problems, because they are run after content is already transformed. VBScript is not transformed by the gateway; you can continue to use dynamic scripts and VBScript as long as your code is gateway-aware. To manually mark a URL for transformation, use the pt:url tag. To disable transformation, use pt:transformer with a pt:fixurl attribute of ‘off.’ For details, see Transforming URLs Using Adaptive Tags.
  • URL encoding: It is a best practice to encode all headers that are URLs to prevent unexpected transformation. In JSP, encode all URLs that are written. If the code writes URLs in the body of a page (for example, a link to a preferences page) it should be encoded. The standard Java servlet command response.encodeURL() is the preferred method, but you can also use URLEncoder.encode(url). In the .NET Framework, the HttpUtility.URLEncode class provides the necessary functionality. Note: In .NET, there is no need to encode the redirect URL; this is handled automatically on the back end.

Why use Remote Desktop Gateway?

RD Gateway provides many benefits, including:

  • RD Gateway enables remote users to connect to internal network resources over the Internet, by using an encrypted connection, without needing to configure virtual private network (VPN) connections.
  • RD Gateway provides a comprehensive security configuration model that enables you to control access to specific internal network resources. RD Gateway provides a point-to-point RDP connection, rather than allowing remote users access to all internal network resources.
  • RD Gateway enables most remote users to connect to internal network resources that are hosted behind firewalls in private networks and across network address translators (NATs). With RD Gateway, you do not need to perform additional configuration for the RD Gateway server or clients for this scenario.

    Prior to this release of Windows Server, security measures prevented remote users from connecting to internal network resources across firewalls and NATs. This is because port 3389, the port used for RDP connections, is typically blocked for network security purposes. RD Gateway transmits RDP traffic to port 443 instead, by using an HTTP Secure Sockets Layer/Transport Layer Security (SSL/TLS) tunnel. Because most corporations open port 443 to enable Internet connectivity, RD Gateway takes advantage of this network design to provide remote access connectivity across multiple firewalls.
  • The Remote Desktop Gateway Manager enables you to configure authorization policies to define conditions that must be met for remote users to connect to internal network resources. For example, you can specify:
    • Who can connect to internal network resources (in other words, the user groups who can connect).
    • What network resources (computer groups) users can connect to.
    • Whether client computers must be members of Active Directory security groups.
    • Whether device redirection is allowed.
    • Whether clients need to use smart card authentication or password authentication, or whether they can use either method.
  • You can configure RD Gateway servers and Remote Desktop Services clients to use Network Access Protection (NAP) to further enhance security. NAP is a health policy creation, enforcement, and remediation technology that is included in Windows Server® 2008 R2, Windows Server® 2008, Windows® 7, Windows Vista®, and Windows® XP Service Pack 3. With NAP, system administrators can enforce health requirements, which can include software requirements, security update requirements, required computer configurations, and other settings.

    noteNoteComputers running Windows Server 2008 R2 or Windows Server 2008 cannot be used as NAP clients when RD Gateway enforces NAP. Only computers running Windows 7, Windows Vista, or Windows XP SP3 can be used as NAP clients when RD Gateway enforces NAP.For information about how to configure RD Gateway to use NAP for health policy enforcement for Remote Desktop Services clients that connect to RD Gateway servers, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?linkid=140433).
  • You can use RD Gateway server with Microsoft Internet Security and Acceleration (ISA) Server to enhance security. In this scenario, you can host RD Gateway servers in a private network rather than a perimeter network, and host ISA Server in the perimeter network. The Secure Sockets Layer (SSL) connection between the Remote Desktop Services client and ISA Server can be terminated at the ISA Server, which is Internet-facing.

    For information about how to configure ISA Server as an SSL termination device for RD Gateway server scenarios, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?linkid=140433).
  • Remote Desktop Gateway Manager provides tools to help you monitor RD Gateway server status and events. By using Remote Desktop Gateway Manager, you can specify events (such as unsuccessful connection attempts to the RD Gateway server) that you want to monitor for auditing purposes.

How to Setup a Remote Desktop Gateway

Accomplished systems and network administrator with 10+ years of experience managing server infrastructures and data-center operations.

What Is a Remote Desktop Gateway Server?

A Remote Desktop Gateway server is a Windows 2008R2 server which is typically located in a corporate or private network. It acts as the gateway into which RDP connections from an external network connects through to access a Remote Desktop server (Terminal Server) located on the corporate or private network. The external network is usually the internet. (In Windows 2008, it is known as TS Gateway or Terminal Services Gateway.)

Why Not Just Connect to the Remote Desktop Server or Terminal Servers Directly From the Internet?

Remote Desktop Servers typically use port 3389. To enable Remote Desktop Servers to be accessed over the internet, you must enable/forward TCP Port 3389 to the Remote Desktop Server. If you have more RD servers than you have internet IP addresses, you will have to start port forwarding other ports to the other RD Servers, i.e. forward TCP Port 3390 on your firewall to Port 3389 on your second RD Server, forward TCP Port 3391 to Port 3389 on your third RD server and so on.

This can be quite confusing for clients because they have to remember what port to connect to.

With Remote Desktop Gateway installed, you can give your clients the address or DNS name of the gateway server. Give them the name or private IP address of the Remote Desktop server that you want your client to connect to. It doesn’t matter that the name of the RD Server is not resolvable on the internet or the IP address is from a private range. As long as the RD Gateway can resolve the name, and the appropriate rights are given to the user credentials which your clients are using, they can connect to the Remote Desktop Server.https://2931044a17aa5fc51924452cd43215d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

You can create groupings of servers and allow only certain Windows users or groups access to particular servers.

However, to use RDGateway, you will need to install a valid SSL certificate. I find buying an SSL certificate is best instead of using a self-signed one i.e. you can get an SSL certificate from Comodo, InstantSSL, Verisign, etc. You can hook up RD Gateway and RD Web Access together and even let users use Internet Explorer to connect to your Published Remote Apps on your Remote Desktop servers via a Web Proxy.

How to install the Remote Desktop Gateway Role Service?

  1. Install the Remote Desktop Gateway role service via Server Manager. You will need to install the Remote Desktop Services role first.
  2. Once Remote Desktop Gateway Role service is installed, run Remote Desktop Gateway Manager
  3. Go into the Policies section and create the Connection Authorization Policy. This is where you setup who’s allowed to log into the RDGateway.
  4. Go into the Policies section and create the Resource Authorization Policy. This is where you setup what resources can be accessed via RD Gateway and by whom. NOTE: The name and IP addresses that you enter here will be used to match with what the client will type in as the computer name in the RD Client. For example, if you put the server name in the Resource Authorization Policy as MYSERVER, and the RD client is trying to connect to MYSERVER.domain.local, the RD Client will be refused connection DESPITE the two names resolving to the same IP address. You can’t even specify a valid IP address unless it is listed as an allowed resource.
  5. Right click on the RD Gateway server name and select Properties. A window will come up where you can fine tune the properties. You can use the default settings. However, you need to go into the SSL Certificate tab and install a certificate.
  6. Enable/Forward TCP Port 443 (SSL port) on your firewall to the RDGateway server.


Setting the role.

Open the server manager.

Select “Add roles and components”.

At the stage “Installation type”, select “Installing roles and components”.

The next step is to select the current server.

Server role –Remote desktop service.

Go to the role service. Select “Remote desktop gateway”.

We proceed to the confirmation step, click the “Install” button.

Configuring the connection and resource authorization policy.

In the window that opens, the remote desktop gateway manager, in the left part of the window, open the branch with the server name → Policies → Connection authorization policies.
In the right part of the same window, select Create a new policy → Wizard.

In the window that opens, “Wizard for creating new authorization policies”, select the recommended option “Create a policy for authorization of remote desktop connections and authorization of remote desktop resources.” Press the button “Next”.

In the next step, enter a convenient name for the connection authorization policy. We recommend giving names in English.

The next step will be to choose a convenient authentication method – password or smart card. In our case, we leave only “Password” checked. We add groups that can connect to this RD-gateway, for this, click the “Add Group …” button.

In the group selection window, click on the button “Additionally”.

The window will resize. Click the “Search” button. In the search results, we find “Administrators of the domain” and click on the button “OK”.

In the group selection window, check the selected object names and click “OK”.

The group is added. To go to the next step, click the “Next” button.

In the next step, select “Enable device redirection for all client devices” and click “Next”.

Set timeouts – downtime and session time, values are indicated in hours. Click “Next”.

Check the settings. Everything is correct – click “Next”.

In the next step, configure the resource authorization policy. Specify the desired policy name. Click “Next”.

The next step is to establish group membership. Usually, the group is already installed, but if this is not done, you should follow the steps above. Click “Next”.

We select available network resources. To do this, select the group that contains the servers on which the required user groups could work with remote desktop. Press the button “Overview”.

In the group selection window, click the “Additionally” button.

In the changed window, click the “Search” button. In the result window, we find “Domain controllers”. 

Click “OK”.

We check the selected objects and click “OK”.

Once again we check which network group is added and click “Next”.

If the RDP port number has not changed, set the switch value to “Allow the connection only to port 3389”. If the port has been changed, specify a new value.

Click “Done

At the stage of confirming the creation of the policy, click the “Close” button.

At the end of the setup, the window will look similar.

Install the SSL certificate.

In the same window “Manager of the remote desktop gateway”, in the left window, click on the server icon, in the main part of the window – “View and change properties of the certificate”. 

In the opened window “Properties <server name>”, go to the tab “SSL Certificate”. Set the switch “Create a self-signed certificate” and click on the button “Create and import certificate …”.

Although 2 more options are possible:

  • import of a previously uploaded certificate (self-signed earlier or third-party);
  • Download a third-party certificate (for example, Comodo) and import it;

In the window “Creating a self-signed certificate” we check the settings and click the button “OK”.

The system will notify that the certificate was created successfully, there is also information where you can find the certificate file itself. Press the button “OK”.

In the server properties window, click the “Apply” button.

The self-signed certificate is installed on TCP port 443 (SSL port by default).

For security reasons, we recommend that you change the default SSL port. To do this, in the main menu of the window, select “Actions” → “Properties”.

Go to the tab “Transport settings” and set the desired value for the field “HTTPS port”. Save the settings by clicking the “Apply” button.

The system will ask for confirmation – answer “Yes”.

Connecting via the gateway.

Open the RDP client, go to the tab “Additionally” and press the button “Settings”.

In the window that opens, select “Use the following Remote desktop gateway server settings”. We indicate the domain name of the server and through the colon (:) indicate the SSL port. The login method is “Request Password”. Click “OK”.

Go to the tab “General”. Specify the address of the computer and the user under which the connection will be made. Push the button “Connect

The program will ask for the password from the account.

The results of the gateway can be checked by tracing – the tracert command.

Drop your comment

Related Post

Leave a Reply

Your email address will not be published.