Connecting to Remote Desktop using proxy and Remote Desktop Gateway

rdpremote desktopremote-desktop-serviceswindows 7windows-server-2012-r2

I have setup a Remote Desktop Gateway server using Windows Server 2012 R2. I am using the Remote Desktop Gateway as an intermediary between to provide the remote desktop session over 443 since 3389 is blocked at many client locations.

However, I ran into a problem with a client who's network seems to be using an web proxy.

Is is possible to configure Remote Desktop to connect via web proxy? If so, how? If not does any one have any suggestions on how to provide a Remote Desktop session via 443 over proxy for situations where you don't control the client's PC or network? Does RemoteApps allow for access via web proxy when using RD Gateway?

The error message is below:

Your computer can't connect to the remote computer because the web proxy server requires authentication. To allow unauthenticated traffic to an RD Gateway server through your web proxy server, contact your network administrator.

Thanks for any help!

Best Answer

As of 2008 a Microsoft employee indicated there was "no official way" to accomplish this. Given the six intervening years you'd like to think there has been progress, but I'm not seeing that there has been.

If I were in your situation I'd try to find a small Win32 HTTP/HTTPS proxy that can be "pointed" at an upstream proxy and configured to provide authentication. I don't have an immediate recommendation for such a thing. (I'd probably just throw something together with Perl or Python, personally.)

Related Solutions

Iis – Remote Desktop Gateway and HTTPS website on same server – possible

What I did eventually is encrypt and tunnel the RDP connections on both servers according to this guide (using Putty and Copssh). We log in to the internal machines by RDPing into them from within the Webserver itself (We understand the risk here).

I also wrote a batch file to automate the login procedure. The script will terminate automatically upon logging off from the internal machine. (note: the ping command delays the remote desktop menu, thus giving the user enough time to enter the SSH password):

start /b putty <user-account>@<ip-address> -L <local-ssh-port>:<ip-address>:3389
ping 123.45.67.89 -n 1 -w 12500 > nul
mstsc /v:localhost:<local-ssh-port> /f
taskkill /f /im putty.exe

Windows – Using CA certificate for Remote Desktop Connection

The question you found that mentions using wmic to set the certificate thumbprint value should work without any additional feature installation. I asked and answered a similar question here with a little more detail. It also has a PowerShell equivalent for the wmic command. But I'll add some more explanation here as well.

Since you're already using this certificate for MSSQL SSL, I assume it's already installed into one of the certificate stores on the system. If you installed it in the context of a service account that MSSQL is running as, you might also need to install it into the Personal or Remote Desktop store for the "Local Computer" as well.
enter image description here

Once it's in there, you just need to update the SSLCertificateSHA1Hash value in Win32_TSGeneralSetting to point to it using one of the commands in my previous question.

If you want to check what the value is currently set to and compare it to the self-signed certificate, you can change the wmic command to the following. You can also use this to validate that the new thumbprint value you tried to set is correct.

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Get SSLCertificateSHA1Hash

The output should look something like this:
enter image description here

Best Answer

Related Solutions

Iis – Remote Desktop Gateway and HTTPS website on same server – possible

Windows – Using CA certificate for Remote Desktop Connection

Related Topic