The context is a company network needing to connect to virtual machines in the cloud via RDP but never receiving any RDP connections itself. So the company network only has RDP clients but no RDP servers, and the VMs on the cloud are the opposite: they only have RDP servers running on port 3389.
In this case, should the company firewall allow only for outbound / outgoing RDP connections to port 3389 of external IPs and block all inbound / ingoing connections to port 3389 of local network IPs ? Or (contrarily to my understanding) should the firewall also allow incoming connections on port 3389 of local network IPs for the RDP client to work ?
It would be great to have an explanation justifying the answer. I believe this is basical networking relating to ephemeral ports but clarity on that would be quite useful.