I am planning to deploy a Remote Desktop Services Gateway on Windows Server 2012 R2 on AWS with the following configuration in the security group (the RDS Gateway should authenticate users against an Active Directory:
- Inbound port open: only 443 (0.0.0.0/0)
- Outbound port open: RDP (for example, 172.30.0.0/16) to local network + ports necessary to authenticate to the Domain Controller but only to AD destination (for example, 172.30.3.5/32)
Is this still a high risk configuration? How unsafe is this configuration compared to having a UTM firewall forward the port 443 requests to a RDS Gateway behind the firewall?
By avoiding the firewall if the security risks are not high I want to avoid occasional interactivity issues with RDP Host Session users, for example if the firewall is swamped parsing other non-interactive stuff such as web filtering.