0

The context is a company network needing to connect to virtual machines in the cloud via RDP but never receiving any RDP connections itself. So the company network only has RDP clients but no RDP servers, and the VMs on the cloud are the opposite: they only have RDP servers running on port 3389.

In this case, should the company firewall allow only for outbound / outgoing RDP connections to port 3389 of external IPs and block all inbound / ingoing connections to port 3389 of local network IPs ? Or (contrarily to my understanding) should the firewall also allow incoming connections on port 3389 of local network IPs for the RDP client to work ?

It would be great to have an explanation justifying the answer. I believe this is basical networking relating to ephemeral ports but clarity on that would be quite useful.

8
  • 1
    There are different methods, and there simply isn't a by-the-book (non opiniated) way, which turns this into an opinion based question. Even Best Practice cases change, so asking for those is not a good way either. Instead, do some research, come up with what you think is a good way and ask if that is indeed correct, and if not, why not.
    – LPChip
    Nov 30, 2020 at 19:06
  • 1
    A few ways, 1. Change RDP port either on the host or on the port forwarding side. 2. use something like RDP Guard. 3. Don't do incoming ports at all, limit to VPN to get inside the network, then RDP to internal ports, 4. other options are available too... do some research...
    – LPChip
    Nov 30, 2020 at 19:07
  • @LPChip I totally agree with you and incidentally i think that's exactly what i have done: I did some research and came up with the fact that the firewall should only allow outgoing connections on port 3889 but i was told that it should also allow incoming connections on that same port which is contrary to my knowledge / research. So i am asking if what i know / found is correct (just like you suggest).
    – michael
    Nov 30, 2020 at 19:08
  • 1
    RDP should always be one way. The client would never need to open the RDP ports.
    – LPChip
    Nov 30, 2020 at 19:15
  • 1
    I gave you an answer to explain it a bit more too. :) Feel free to mark this as answered so others know you no longer need help.
    – LPChip
    Nov 30, 2020 at 19:26

2 Answers 2

2

After a few comment exchanges, your question basically boils down to this:

Do I need to open my RDP port 3389 on the client side for RDP to a cloud server to work, or is that a security risk?

No, you never need to open a client side port at all.

By the usage of the term open a port, I refer to creating a port mapping on the router and specifically allow the port access in the firewall to accept incoming requests.

By default in windows, when a client connects to another machine using the RDP protocol, it will connect TO the other machine through TCP/IP, then switch to a different UDP port for the actual connection. Because of this mechanism, only on the server side, do you need to open ports. Only if a client has very strict and overdone firewall settings, may it be that something needs to be allowed for the outgoing connection to work, but never does a client need to alter router settings to allow incoming traffic over TCP port 3389.

2
  • Thank you. And this is because on the RDP client machine a random (ephemeral) port completely different from 3389 will be open, is that right ? Something like a port between 49152 and 65535 on Windows 10 as indicated by this article, correct ?
    – michael
    Nov 30, 2020 at 19:34
  • 1
    yes, that's right.
    – LPChip
    Dec 1, 2020 at 11:29
0

How many roles have been installed in your RDS deployment or is it simply used to remote from A to B?

For the latter one, per the article of "Change the listening port for Remote Desktop on your computer", it confirmed the port (3389 by default) was changed on the computer that you remote to, which could be considered as server side.

For the former one, here is a blog mentioned the ports requirement of all the RDS roles for a remote connection:

RDS 2012: Which ports are used during deployment? https://social.technet.microsoft.com/wiki/contents/articles/16164.rds-2012-which-ports-are-used-during-deployment.aspx

1
  • Currently it is simply to remote from A (Windows 10 default RDP client) to B (Linux RDP servers running on port 3389). So in this case, which firewall rules should be set for A's network ? Just outgoing's connection to B's IPs on port 3389 while refusing any incoming connection to A's IP on port 3389, is that right ? Please note the question is only about A's network firewall, with only RDP clients on A's network, no RDP servers.
    – michael
    Dec 1, 2020 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .