1

It was recommended to us by an IT consultant that we have to switch our remote workers / work from home workers over to using a RD Gateway to secure the connection rather than the VPN we have currently been using.

The reason for this is that the VPN gets a lot of complaints regarding connections dropping intermittently. 90% of the time it works fine, but for some reason at certain clients it drops the RD connection quite frequently. (according to user reports)

So I guess the way it works is that the RD connections connect to the broker / gateway first, and that in turn connects them to the Terminal Server.

My question is about the security of this setup. I have been looking for information about it and don’t seem to be able to find what I am looking for. So… if anyone can answer or link information regarding the following it would be greatly appreciated.

  1. Is it secure to use RDP across public internet without a VPN, using a RD Gateway / broker setup? If not why isn’t it or vice versa if it is.

That is the most important question but these others I’m also interested in:

  1. Is it secure to use RDP across public internet period? Without the broker / gateway. If it’s not, why isn’t it?

  2. What does the broker / RD gateway do to secure the connection further than just regular RDP setup?

  3. What type of encryption does RDP use?

  4. Is there a better way to do this? Have users work from home by accessing a terminal server.

Thanks in advance

3 Spice ups
2

RD Gateway is over HTTPS and is much more secure than just RDP over Public Internet because of the encryption obviously, but also because once they connect to they gateway, they have to know where to go from there instead of port 3389 mapped directly to the server you are RDPing to, unless youre using a VPN then RDP which is not working for you either.

Anyone can attempt to brute force the common 3389 port thats mapped directly to your server, which is not exposed with RD Gateway.

RD Gateway is highly preferred over RDP mapped directly to the server. I prefer it as well over RDP over a VPN because of the inherent slowness of the VPN and the same issues that you are seeing with it.

1 Spice up
3

Excellent, that’s what I wanted to know! Thank you so much for the answer. I’ll give it a little time before I mark best answers just so others have a chance to reply.

One thing that leaves me wondering is… which is more secure, a WANGroup VPN setup with

AES-128/HMAC SHA1 (IKE) or the RD Gateway setup?

4

Considering SHA1 is generally regarded as not secure anymore, I would think the RD Gateway Setup with a SHA2 or higher SSL certificate would be better.

1 Spice up
5

Okay awesome. So it looks like we made the right move then. Thanks again.

6

I would recommend @jhart on this topic. I would highly recommend RD Gateway over any RDP connections. VPN also is a good option but VPN can also be exploited (Like the majority of technology). I would add Duo Authentication (2MFA) to the mix for added security. You can integrate it on-site and through Comptuers and Terminal Servers and even Exchange OWA

Having an open RDP without RD Gateway is highly insecure and exploitable.

There some RD Gateway levels of Security as shown below

2 Spice ups
7

SHA1 Certificates are not being issued anymore so yeah SHA2 will be what you need as far as SSL Certificate type, you can set the encryption bits to 4096 or even higher.

1 Spice up
8

Okay, awesome. More great information. So I think we re-used an old certificate (I didn’t do the setup the consultant did) so it may be SHA1. So, I think I may ask about upgrading that to an SHA2 certificate for increased security if that is in fact what it is.

I’m looking into duo now at your recommendation.

Thank you for the great answer.

1 Spice up
9

@dbeato is right on here.

Using an RDGateway is as secure as you want to make it.

Here is a good blog post of the where and how of using an RDG. You can put it in a DMZ or you can pinhole it through the firewall.

https://blogs.technet.microsoft.com/enterprisemobility/2009/07/31/rd-gateway-deployment-in-a-perimeter-network-firewall-rules/

Using a VPN is a viable option as well.

Keep in mind that some VPN’s are going to be more resilient to network issues than RDP over HTTPS.

The users that are having the issue with the VPN may still have the issues using the RDG. RDP is a very latency sensitive protocol.

The only benefit you may see is it will take the user less time to reconnect directly using the RDG vs reconnecting their VPN.

  1. Straight RDP over the Internet is extremely insecure. While the traffic isn’t the issue, it’s having the RDP protocol exposed to the wild web that is the issue. Google search TSGrinder. It’s a program that will sit there and brute force your login creds.

  2. The RDG is what secures it. The Broker role is mainly just a load balancer/central config manager. The Gateway secures the RDP protocol by tunneling it over SSL.

  3. The RDP protocol uses 128-bit encryption, using the RC4 encryption algorithm. Version 6 or later.

  4. Both are viable options. VPNs work so does an RDG. It is whatever is most convenient for your users. If it’s easy for them, it usually makes life easy for the helpdesk. However, it isn’t going to help the users that have poor quality internet at home. Which sounds like there are a couple users that do. However, the RDG should have a little less overhead than the VPN so it may perform just a bit better.

I use both. Most of my users use the VPN. The reason I use the VPN over the RDG is that my firewall has MFA built in and it is easy to manage. The RDG is used for vendor access to certain servers as I can control when and where they login from using policies.

3 Spice ups
10

I see, all great info. Excellent answer Justin & also much appreciated. So far the users seem to be saying the RD Gateway setup is more reliable. From what several of them told me it hasn’t dropped connection once. I quite honestly think there is a misconfiguration with our VPN that nobody has ever been able to identify, but that’s just me. I’m not authorized to troubleshoot or make changes to it and I wasn’t the one who set it up. I made recommendations of troubleshooting steps but nobody ever listens to me.

I thank you all for the great answers, and now I’m torn as to who I should mark as best answer as all of them answer the main question. So… I’m going to roll a 1d20 and see who comes out the victor. The winner is Korey with a roll of 20. Critical hit x3 you win.

Thanks again everyone

2 Spice ups
11

RDP is secure with just a few tweaks.

Force encryption and NLA with gpedit.msc
NAT a different port than default 3389.
Avoid brute forcing with secpol.msc limits.

This mangles pretty much all your arguments. As well as being the optimal path for best performance. Using a gateway for just a few computers is OTT when you can EASILY (with some basic knowledge) secure the RDP protocol entirely. RD gateway is overkill for just a few computers, it also becomes a SPOF.

1 Spice up