Remote Desktop Protocol is how Windows machines are administered remotely. It provides full graphical access — mouse, keyboard, clipboard, drive mapping, audio. It is also one of the most commonly attacked protocols on the internet, which is why exposing RDP port 3389 to the public internet is strongly discouraged.
RDP Without Exposing the Port
ProxyPass gives you RDP access without exposing the port. The CONNECT proxy tunnels the RDP connection through the encrypted tunnel to a node on the same network as the target machine. Your RDP client connects through the proxy, and the session runs inside the tunnel.
Setup
The setup is simple:
- Configure your RDP client — or your operating system's proxy settings — to use the ProxyPass endpoint as an HTTP CONNECT proxy
- Connect to the remote machine's local IP and port 3389 as you normally would
- The traffic goes through ProxyPass, through the tunnel, arrives at the target machine's RDP port on the local network
Because RDP runs inside the CONNECT tunnel, ProxyPass sees only encrypted bytes. Your session content, your credentials, your clipboard data — none of it is visible to the tunnel infrastructure.
Scenario: Supporting 15 Branch Office PCs
An IT department supports 15 Windows PCs across 5 branch offices. The traditional setup: one VPN per office, each with its own configuration, certificates, and maintenance schedule. When a user in the Munich office cannot print, the IT team needs to connect to the Munich VPN, then RDP to the user's machine.
With ProxyPass, each office has a node. The IT team configures their RDP client to use ProxyPass as a proxy. To reach any PC at any office, they just enter the local IP of the target machine. No VPN switching. No certificate management. Same proxy, different target, instant connection.
If a branch office closes, the IT team blocks the node — one click, immediate effect. No VPN credentials to rotate. No firewall rules to update.
Security
This is particularly valuable for organizations that manage Windows machines at remote sites. Instead of maintaining VPN connections to every site, a ProxyPass node provides persistent access to all Windows machines on that network. One node, full RDP access to every machine on the LAN.
Combined with node blocking, you can instantly revoke access if a site is decommissioned or a device is compromised. Block the node, and RDP access through that tunnel stops immediately.