Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Firstly my background is more skewed towards programming rather than network maintenance so please bear with me. OK here's the problem..

I have 5 physical servers co-located in a data-center. Each server is utilising two network adapters to connect them to a private LAN and the other is configured with a public IP. For general maintenance I am connecting to these machines over the public IP on port 3389 using Remote Desktop. I am also using IPSec to limit access to a handful of trusted IPs.

My problem is that every new server I add using this setup requires it's own public IP. It's also very tedious manually configuring IPSec each time. I'm sure there's a better way to handle this?

Is there any role/feature within Windows Server 2012 that will allow me to just keep one public IP open and access all machines indirectly via one server? I suppose I can RDP into machine and then RDP from there over the LAN into each of the other servers but this gets a bit messy.

Any recommendations would be much appreciated.


I should add that my servers are connected together over a L2 switch so I have no ability to forward ports. One suggestion I saw was to forward ports 3390, 3391 and so forth to each server in the farm but without a router I don't think this will be an option.

share|improve this question
Is a router an option? – ewwhite Jun 30 '14 at 16:09
Yes it is an option, I'm just trying to limit the number of failure points on the network. Everything I buy I need to buy twice for redundancy. – QFDev Jun 30 '14 at 16:23
up vote 5 down vote accepted

Remote Desktop Gateway would probably do what you're looking for.

RD Gateway encapsulates the RDP protocol in HTTP or HTTPS. RD Gateway decapsulates the RDP protocol from the HTTP(S) and makes an RDP connection on behalf of the remote client to the appropriate RDP server. This allows a number of RDP servers to be present with the RD Gateway brokering access by remote clients to the RDP servers.

You can certainly lock down RD Gateway to trusted source IP addresses. You'll only need one public IP to host the RD Gateway.

share|improve this answer
This looks to be exactly what I need, thank you! – QFDev Jun 30 '14 at 17:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.