Update: see more detailed post on how to install the RD Gateway Role on Windows Server 2019/2016 here: http://www.riptidehosting.com/blog/installing-the-remote-desktop-gateway-role-rdgw-on-windows-server-2019/
RD Gateway Role in RDS
Using the Remote Desktop Gateway Role (RDGW) provides additional security by forcing RDP traffic over https/port 443 (requires SSL certificate) instead of port 3389.
General steps to install the RDGW role on Windows Server 2016: (we have a more detailed post on this too)
- Install RDGW role which will also install IIS
- In RD Gateway Manager, create CAP and RAP policies for who can login to the gateway and what resources they can access.
- For initial testing/deployment, you can create a self-signed certification and change the certificate name to IP address in the name field. Using a self-signed certificate will require you to install the certificate on each client device. Using a SSL cert issued by a certificate authority is preferred and can only be issued in the domain name, not IP address).
- Confirm that all items in the RD Gateway Manager have green checkmarks.
- From the RD Connection Client on your local PC, go to more options, advanced tab, enter gateway settings before connecting.
- Turn off port 3389 to the outside on the Windows Firewall on the server to force traffic to use port 443.
Test deployment