Exposing Remote Desktop (TCP 3389) to the internet invites constant password guessing and every future RDP vulnerability. RDP Gate keeps the port closed in Windows Firewall. When you sign in, it opens it for your current IP address only (over IPv6, your network's /64, since a Mac or PC rotates several addresses there), keeps it open while you're connected, and closes it again when you leave.
- Signing in takes this computer's private key plus a 6-digit code from any authenticator app. You can optionally also sign in from a browser with a passkey (needs your own domain). Or tick Keep me signed in: that computer signs in once, then opens access by itself whenever the app starts, until its hardware changes, and its access follows its IP within seconds.
- No static IP, no DNS, no DuckDNS. The server publishes its address as an encrypted, signed beacon in a secret GitHub gist. The gist only ever holds ciphertext, though GitHub (like any website) sees the IP address each update comes from.
- Spoof-resistant end to end. Your computers pin the server's identity key, so a fake server, a hijacked address or a man-in-the-middle on the RDP port is detected before anything is sent or Remote Desktop opens. See Spoofing.
- One thing on the server:
rdpgate-server.exe, installed by a normal Setup wizard that also hardens RDP and the firewall and runs it as a Windows service.
- Easy install, signed auto-updates: Setup wizards for Windows, a drag-to-Applications disk image for Mac. Every program updates itself, but only to releases signed with the project's release key.
- Written in Rust, built on rustls, RustCrypto and webauthn-rs. No OpenSSL, no runtime dependencies.
Website: https://parthh37.github.io/rdpgate/ · Step-by-step guide: Operation guide
How it works
secret GitHub gist
┌────── "v1.<ciphertext>" ◀────── publishes {ip, port, time}
│ (signed by the server key, when the IP changes
▼ encrypted with the beacon key) │
Your Mac / PC Windows PC at home
┌───────────────────────────┐ TLS 1.3 :47443 ┌────────────────────────────────────┐
│ RDP Gate app │ ───────────────▶ │ rdpgate-server (Windows service) │
│ 1. read + decrypt beacon │ ◀── server proves│ proves identity key first │
│ 2. check server identity │ its key │ checks device signature + code │
│ 3. device key + code │ ───────────────▶ │ adds ONE firewall rule: │
│ 4. check RDP certificate │ │ allow TCP 3389 from YOUR IP │
│ 5. open Remote Desktop │ ───── RDP ─────▶ │ Remote Desktop (NLA + password) │
└───────────────────────────┘ :3389 └────────────────────────────────────┘
What an attacker on the internet has to get past, from the outside in:
| Layer | What it does |
|---|
| Hidden | Port 3389 is closed by default. The sign-in port answers only clients that speak the RDP Gate protocol (or browsers asking for your exact domain), limits each source to a few connections, and goes silent for sources that keep failing. |
| Enrolled device | Every desktop request is signed with an Ed25519 key you enrolled on the server. The signature covers the TLS 1.3 session's exported keying material, so a captured request can't be replayed or relayed. The key is stored encrypted under your passphrase (Argon2id with 64 MiB, then XChaCha20-Poly1305). |
| Second factor | A one-time 6-digit code (each code works once; 10 wrong codes lock that computer until you unlock it), or a passkey with fingerprint, face or PIN. |
| One public address, for a while | The allow rule names a single public IP. Private and carrier-NAT addresses are refused, because they can stand for many machines. The rule lasts 10 minutes if you don't connect, stays while you're connected, and is capped at 12 hours. Leftover rules are swept at every start and every few minutes. |
| Windows itself | Network Level Authentication, TLS-only RDP, your Windows password and an account lockout policy, all set by the installer. |
Spoofing
| If someone… | What happens |
|---|
| …fakes your IP address to use your opening | The grant uses the address from a completed TCP + TLS handshake, never headers or anything the client sends. Blind TCP spoofing can't finish a handshake. UDP (no handshake) is off unless you enable it. |
| …runs a fake server (hijacks DNS, gets a certificate, or takes over your old IP) | Before the app sends anything, the server must sign this TLS connection's keying material with the identity key your app pinned from the server card. A fake server fails, even with a valid certificate. The app reports it and sends nothing: not even its device name or your code. |
| …forges or replays the beacon | Beacons are signed with the server key (a stolen GitHub token can't forge one) and time-stamped (the app refuses any beacon older than one it has seen). An attacker can at most delete it; the app then falls back to the last address that worked. |
| …intercepts the RDP connection after the firewall opens | The server reads its own Remote Desktop certificate and sends its fingerprint over the authenticated channel. The app checks the RDP port presents that same certificate and refuses to launch Remote Desktop if it doesn't. |
| …replays a sign-in | Every request is bound to one TLS connection. Each code works once. Each passkey challenge works once. |
| …phishes a passkey | Passkeys only work on your exact domain. The one remaining gap is a hijacked domain combined with a live relay, so browser sign-in is off unless you configure a domain, and the desktop app doesn't depend on DNS at all. |
This is the beginning of the README. Read the rest at the original. Read the full README ↗
