Deploying Remote Desktop Gateway

Remote Desktop Gateway (RDGW) is a Windows Server service for accessing resources that have no internet access via a secure HTTPS communication channel.

In this use case, users from the Administrators group are granted access to a test VM using a self-signed certificate.

To deploy the Remote Desktop Gateway infrastructure:

1. Before you start.
2. Create a cloud network and subnets.
3. Create a security group.
4. Create a VM for the gateway.
5. Configure the RDGW role.
6. Test the RDGW.

If you no longer need these resources, delete them.

Before you start

Before working, you need to register in Yandex Cloud and create a billing account:

1. Go to the management console. Then log in to Yandex Cloud or sign up if don't already have an account.
2. On the billing page, make sure you linked a billing account, and it has the ACTIVE or TRIAL_ACTIVE status. If you don't have a billing account, create one.

If you have an active billing account, you can create or select a folder to run your VM in from the Yandex Cloud page.

Learn more about clouds and folders.

Required paid resources

The cost of installing RDGW includes:

• A fee for continuously running virtual machines (see Yandex Compute Cloud pricing).

• A fee for using dynamic or static public IP addresses (see Yandex Virtual Private Cloud pricing).

• The cost of outgoing traffic from Yandex Cloud to the internet (see Yandex Compute Cloud pricing).

Create a cloud network and subnets

Create a cloud network named rdgw-network with a subnet in the availability zone where your VMs will be located.

1. Create a cloud network.

   Management console

   CLI

   To create a cloud network:

   1. Open the Virtual Private Cloud section of the folder where you want to create a cloud network.

   2. Click Create network.

   3. Enter the network name: rdgw-network.

   4. Click Create network.

   If you don't have the Yandex Cloud command line interface yet, install and initialize it.

   The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

   To create a cloud network, run the command:

   yc vpc network create --name rdgw-network
   

   where rdgw-network is the network name.

   Result:

   id: qqppl6fduhct76qkjh6s
   folder_id: big67u7m5flplkc6vvpc
   created_at: "2021-06-09T10:49:07Z"
   name: rdgw-network
   default_security_group_id: enpa139ji55jti00u5sg
   

2. Create a subnet in the network rdgw-network.

   Management console

   CLI

   To create a subnet:

   1. Select Virtual Private Cloud in the folder to create a subnet in.

   2. Click on the name of the cloud network.

   3. Click Add subnet.

   4. Fill out the form: enter rdgw-subnet as a subnet name and select the desired availability zone from the drop-down list (for example, ru-central1-a).

   5. Enter the subnet CIDR, which is its IP address and mask: 10.1.0.0/16. For more information about subnet IP address ranges, see Cloud networks and subnets.

   6. Click Create subnet.

   To create a subnet, run the following command:

   yc vpc subnet create `
     --name rdgw-subnet `
     --zone ru-central1-a `
     --network-name rdgw-network `
     --range 10.1.0.0/16
   

   where rdgw-subnet is the subnet name.

   Result:

   id: e9b95m6al33r62n5vkab
   folder_id: big67u7m5flplkc6vvpc
   created_at: "2021-06-09T10:49:21Z"
   name: rdgw-subnet
   network_id: qqppl6fduhct76qkjh6s
   zone_id: ru-central1-a
   v4_cidr_blocks:
   - 10.1.0.0/16
   

Create a security group

Create and set up a security group.

yc vpc security-group create --name=my-rdgw-sg `
  --network-name rdgw-network `
  --rule direction=ingress,protocol=icmp,v4-cidrs=[0.0.0.0/0],description=icmp `
  --rule direction=ingress,port=any,protocol=any,predefined=self_security_group,description=self `
  --rule direction=ingress,port=3389,protocol=tcp,v4-cidrs=[0.0.0.0/0],description=rdp `
  --rule direction=ingress,port=443,protocol=tcp,v4-cidrs=[0.0.0.0/0],description=rdgw `
  --rule direction=egress,port=any,protocol=any,v4-cidrs=[0.0.0.0/0],description=default 

id: enp136p8s2ael7ob6klg
folder_id: big67u7m5flplkc6vvpc
created_at: "2021-06-09T10:50:29Z"
name: my-rdgw-sg
network_id: qqppl6fduhct76qkjh6s
status: ACTIVE
rules:
- id: env98jerk9b3tcp68k61
  description: icmp
  direction: INGRESS
  protocol_name: ICMP
  protocol_number: "1"
  cidr_blocks:
  v4_cidr_blocks:
   - 0.0.0.0/0

Create a VM for the gateway

Create a VM with a public address:

Configure the RDGW role

1. Connect to the created VM via RDP.

2. Set the required roles and snap-ins:

   Install-WindowsFeature RDS-Gateway -IncludeManagementTools
   

   Result:

   Success Restart Needed Exit Code      Feature Result
   ------- -------------- ---------      --------------
   True    No             Success        {Network Policy and Access Services, Remot...
   

3. Import the RDS module:

   Import-Module -Name RemoteDesktopServices
   

4. Create a client access policy to allow all Administrators local group accounts to connect to the RDGW. You can do this using a Windows PowerShell drive that is created automatically when importing the role:

   New-Item -Path 'RDS:\GatewayServer\CAP' -Name 'Default-CAP' -UserGroups Administrators@Builtin -AuthMethod '1'
   

   Result:

       Directory: RDS:\GatewayServer\CAP
   
   Name                   Type      CurrentValue         GP   PermissibleValues PermissibleOperations
   ----                   ----      ------------         --   ----------------- ---------------------
   Default-CAP                                           -                      Get-Item, Get-ChildItem, Remove-Item,...
   

5. Create a resource access policy to allow all Administrators local group accounts to connect to any internal resource through the created RDGW.

   New-Item -Path 'RDS:\GatewayServer\RAP' -Name 'Default-RAP' -UserGroups Administrators@Builtin -ComputerGroupType '2'
   

   Result:

       Directory: RDS:\GatewayServer\RAP
   
   Name                   Type      CurrentValue         GP   PermissibleValues PermissibleOperations
   ----                   ----      ------------         --   ----------------- ---------------------
   Default-RAP                                           -                      Get-Item, Get-ChildItem, Remove-Item,...
   

6. Create a certificate with the name of the server to be used for connecting to the gateway and encrypting traffic:

   $Certificate = New-SelfSignedCertificate -CertStoreLocation 'Cert:\LocalMachine\My' -DnsName $ENV:COMPUTERNAME
   

7. Export the created certificate to later upload it to the Trusted Roots Certificate Authorities certificate store on the computer connecting to the VM. This is necessary for the client to trust the self-signed RDGW certificate:

   $Certificate | Export-Certificate -FilePath "C:\REGW.cer"
   

   Result:

       Directory: C:\
   
   Mode                LastWriteTime         Length Name
   ----                -------------         ------ ----
   -a----         6/9/2021  11:51 AM            796 REGW.cer
   

8. Specify which certificate the RDGW should use. Restart the Remote Desktop Gateway service to apply the settings:

   Set-Item -Path 'RDS:\GatewayServer\SSLCertificate\Thumbprint' -Value $Certificate.Thumbprint
   Get-Service TSGateway | Restart-Service
   

The gateway VM with the RDGW role configured allows BUILTIN\Administrators local group accounts to connect to VMs that do not have direct internet access.

Test the RDGW

1. Create a VM with no internet access and connect to it during the test.

   Management console

   CLI

   1. On the folder page in the management console, click Create resource and select Virtual machine.

   2. In the Name field, enter the VM name: test-vm.

   3. Select the availability zone: ru-central1-a.

   4. Under Image/boot disk selection, select the 2019 Datacenter image.

   5. Under Disks, enter 60 GB for the size of the boot disk:

   6. Under Computing resources:

      • Select the platform: Intel Ice Lake.
      • Specify the number of vCPUs and amount of RAM:
        • vCPU: 2.
        • Guaranteed vCPU share: 100%
        • RAM: 4 GB.

   7. Under Network settings, click Add network and select rdgw-network. Select rdgw-subnet. Under Public address, select No address.

   8. Under Access, specify the data required to access the VM: enter your password in the Password field.

   9. Click Create VM.

   Create a VM:

   yc compute instance create `
     --name test-vm `
     --hostname test-vm `
     --memory 4 `
     --cores 2 `
     --zone ru-central1-a `
     --network-interface subnet-name=rdgw-subnet,ipv4-address=10.1.0.4 `
     --create-boot-disk image-folder-id=standard-images,image-family=windows-2019-dc-gvlk `
     --metadata-from-file user-data=setpass
   

   Result:

   done (19s)
   id: fhm5pflreh2jellq97r0
   folder_id: big67u7m5flplkc6vvpc
   created_at: "2021-06-09T11:53:03Z"
   name: test-vm
   zone_id: ru-central1-a
   platform_id: standard-v2
   resources:
   memory: "4294967296"
   cores: "2"
   core_fraction: "100"
   status: RUNNING
   boot_disk:
   mode: READ_WRITE
   device_name: fhmmf65nlbt131b3e36l
   auto_delete: true
   disk_id: fhmmf65nlbt131b3e36l
   network_interfaces:
   - index: "0"
     mac_address: d0:0d:5d:ef:bb:74
     subnet_id: e9b95m6al33r62n5vkab
     primary_v4_address:
     address: 10.1.0.4
     fqdn: test-vm.ru-central1.internal
     scheduling_policy: {}
     network_settings:
     type: STANDARD
     placement_policy: {}
   

2. Import the created certificate to the Trusted Roots Certificate Authorities directory on the computer that you'll use to connect to the test VM.

   To connect to the gateway using the VM name, specify the name and external IP address of the created RDGW in the C:\Windows\system32\drivers\etc\hosts file. For example:

   87.250.250.242 my-rds-gw
   

3. Run the mstsc utility that creates remote desktop connections. In the settings on the Advanced tab, specify the my-rds-gw VM name as the gateway, the test-vm name as the destination node, and Administrator as the username.

How to delete created resources

If you no longer need the created resources, delete the VM instances and networks.

If you reserved a static public IP address, delete it.