Remote Desktop 2012 R2 - Can't get RD Gateway with RD Web Access working through just 443

Question

I have one server (2012 r2 fully updated) running all remote desktop roles (RD Web Access, RD Gateway, RD Licensing, RD Connection Broker, RD Session Host) and a separate domain controller.
I have RD Web Access published to cloud.mydomain.co.uk and accessing cloud.mydomain.co.uk/RDWeb works fine.
I want to setup the environment so only port 443 is open from the outside (thus the RD Gateway is installed) and the user can login through RDWeb and click on an app to launch it.
If I leave port 3389 open along with 443 and log on to RDWeb and click the remote app, this works fine.
If I close 3389 on the external firewall and only leave open 443, I can connect AND login to RDWeb but I cannot open the connection
This is expected:
http://i.imgur.com/9j2HRqm.png
Error:
http://i.imgur.com/2LH2c7T.png
Digging in the event viewer yielded: http://i.imgur.com/M9uHm0o.png
Which led me to test change the following setting in the resource access policy, as a test:
http://i.imgur.com/FlGObFr.png
This still didn't work but yielded a different error in event viewer:
http://i.imgur.com/LkaCfU4.png
Now I suspect I have misconfigured something somewhere in terms of the last event where it suggests it can't connect to resource "cloud.mydomain.co.uk" I would have expected this to be the internal FQDN of my session host. Or, I am hitting some sort
of odd problem because I have all the roles on the same box.
Any assistance greatly appreciated. I'm keen to find the root cause behind this as I need to document this solution so don't want to invalidate by messing around too much with settings.

Answer 1

Hi Gavin,
If you use RD Gateway then you only need to open TCP port 443 and UDP port 3391 and forward them to your RD Gateway server.  You may have RD Web Access (uses TCP port 443) and RDG running on the same server.
When an external client launches a RemoteApp they will connect to your RD Gateway via TCP port 443 and UDP port 3391, then the RDG will connect to your internal RDSH servers using TCP port 3389 and UDP port 3389 on behalf of the external client.  In
this way the RDG will act as a middleman between your external users and your internal RDSH servers.
In Server Manager - Remote Desktop Services - Overview - Tasks - Deployment Properties you need to specify the external FQDN of your RD Gateway server.  If you have RDWeb and RDG on the same server this would be the same FQDN that your users will use
for RDWeb.  For example, if your users use https://rds1.yourdomain.com/rdweb to connect to your RD Web Access site, then you would enter rds1.yourdomain.com for the RD Gateway name in deployment properties.
(Above one Quoted from this thread answered by TP).
In addition please see that you have properly configured RD Rap & RD Rap policy under RD Gateway manager and also properly configured certificates to match server name.
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]