How to Connect a Remote Desktop Through a Proxy Server to a Terminal Server
This article is aimed at those who host Terminal Servers ( or Remote Desktop servers in 2008R2 terminology ) and who would like the ability for their clients or themselves to be able to connect via a Web Proxy server to their Terminal Servers from the internet. I will explain concepts and will not include detailed "how to steps" to add server roles because I will assume that the reader will be quite an experienced system administrator. Perhaps I may create other hubs that will detail step by step instructions to add the different server roles.
Normally clients can just connect directly across the internet on Port 3389 to the Terminal Servers using the Microsoft Remote Desktop Client (or other variations of Remote Desktop). However due to tighter security in many big organisations, those client workstations are usually not allowed to access the internet directly. By internet, I mean any applications (TCP and UDP ports) on the internet, and not just Web Browsing (Port 80, and/or SSL Port 443).
These organisations usually install a type of web proxy server where they will allow clients to browse the web, but the web browser software must be configured to send web requests to the web proxy server. The web proxy server connects to the web sites on behalf of the web browser and sends the pages through to the browser. In this configuration, the web browser does not talk directly to the internet to retrieve the web pages. If it was not configured to go through a web proxy server, it will not be able to reach any web sites.
This is all well and good because most browser software have an option for you to put in the web proxy server address. However, the standard Microsoft Remote Desktop Client software does not have this option.
Remote Desktop Client and the Gateway Server Settings
Remote Desktop Gateway Server
The later versions of Remote Desktop Client have an option for putting in a Remote Desktop gateway server address. Windows Server 2008 and Windows Server 2008R2 have the new Terminal Services Gateway and Remote Desktop Services Gateway server role respectively.
What this server role does is to allow the Remote Desktop Client to connect to the RD Gateway first. The RD Gateway then creates a remote desktop session on behalf of the client to the server that the client needs to connect to.
The Remote Desktop Gateway server can be placed either at the clients premises, and firewall rules can then be set up to allow this server only access to your terminal servers in your hosted environment, or the Remote Desktop Gateway server can be placed at the same network location as your terminal servers, and firewall rules on the clients network can be configured to allow client workstations access to this Gateway server only.
To implement our solution of connecting Remote Desktop via the web proxy server, we must put the gateway server in the same network as the terminal servers. However, we DO NOT need to touch the existing firewall rules at all because we want to use the web proxy server to connect us to our Remote Desktop Gateway server and connect to the terminal servers on behalf of the local Remote Desktop client.
Remote Desktop Web Access Server
The Remote Desktop Web Access Server role is the last piece of the puzzle and it will allow us to use Internet Explorer to be able to connect via the Remote Desktop Web Connection Active X program.
A server needs to be configured with the Remote Desktop Web Access Server role so that clients can access this Web server's portal over the internet using Internet Explorer via the web proxy server. This Web Access server is configured with the source that provides the RemoteApp programs.
The source of the Remote App programs is the server that has the applications you want to serve. This is the server that has the Remote Desktop Session Host server role (terminal server). Having this role means the RemoteApp Manager program is also installed automatically. You need to run the RemoteApp manager on the source server to publish the application you want users to run. You can also publish a Remote Desktop client so they can run it from the portal. In the RemoteApp Manager settings, you will also need to specifiy the Remote Desktop Gateway settings. This way, when clients try to run the program from the portal (or run Remote Desktop from the portal) it is forced to use the Remote Desktop gateway via the web proxy server. If you don't specify the Remote Desktop gateway, it will try to access the terminal servers directly from the client, meaning it tries to bypass the web proxy server.
You also need to install a certified SSL Certificate on the RD Gateway to ensure that the connection to the RD Gateway is via the secure SSL port 443.
Hopefully the information above have helped you or pointed you in the right direction. If you have a question, please ask via the comments section below.