Remote Desktop Gateway vs Direct RDP: When to Use Each for Remote Access

One Port Difference Changes Everything

Direct RDP exposes TCP port 3389 to the internet; Remote Desktop Gateway tunnels RDP inside HTTPS on port 443. That single difference drives everything else — security posture, NAT traversal, licensing, and setup complexity. This comparison explains how both paths work, what each one costs in licensing and effort, and the decision rule for choosing between them on a Windows Server VM.

How Direct RDP Works

With direct RDP, the client connects straight to the server’s public IP on TCP 3389. The server must have a public address or a port forward, Network Level Authentication (NLA) should be enforced, and the port is visible to every scanner on the internet — which is why brute-force attempts are the default background noise on any exposed 3389. Direct RDP is a single moving part: configure the firewall, set a lockout policy, and it works. It is the right tool for a handful of administrators who control their own clients, provided the host gives you a public IPv4 and firewall control — both listed per provider in our Windows VPS comparison table.

How RD Gateway Works

Remote Desktop Gateway is a Windows Server role that sits between clients and the RDP targets. Clients connect to the gateway over HTTPS (443), the gateway authenticates them and forwards the session to an internal server over 3389. The RDP port never touches the internet; the gateway can live in a DMZ or on the same VPS, and it enables features direct RDP cannot: RD Web Access (browser-based launch), per-user authorization policies, and MFA integration through NPS with RADIUS. It also solves NAT traversal — clients behind restrictive networks can usually reach 443 even when 3389 is blocked.

Side-by-Side Comparison

Criterion	Direct RDP	RD Gateway
Port exposed to internet	3389 (TCP)	443 (HTTPS)
NAT traversal	Needs public IP or port forward	Works through most restrictive networks
Authentication	Windows account + NLA	Windows account + gateway policies
MFA	Manual (third-party tools)	Native via NPS/RADIUS
Licensing	No CALs for admin sessions (max 2)	RDS CAL required per user/device
Setup complexity	Minimal	Role install, certificate, NPS, CALs
Best for	1–3 admins, own clients	Many users, BYOD, compliance

Licensing Is the Deal-Breaker

Direct RDP to a Windows Server needs no Remote Desktop Services CALs when you use the built-in administrative connections: up to two concurrent admin sessions are covered by the server license itself. RD Gateway changes that — every user or device connecting through the gateway requires an RDS CAL, on top of the gateway server’s own license. On a small VPS with one to three administrators, the CAL cost quickly exceeds the server cost, which is why RD Gateway is usually not worth it for a single-admin setup. Once you have a dozen users, or compliance rules that forbid exposing 3389, the CAL bill becomes the price of doing business properly.

When Direct RDP Is the Right Choice

• One to three administrators who control their own devices.
• A server with a public IP and a firewall you manage — combined with an account lockout policy, as covered in our RDP hardening guide.
• No compliance requirement that forbids exposing 3389.
• Minimal budget: zero extra licensing, zero extra infrastructure.

When RD Gateway Is Worth the Setup

• Many users connecting from personal devices (BYOD) you cannot lock down.
• Compliance or security policy that forbids exposing 3389 to the internet.
• MFA required for remote access — the gateway’s NPS integration makes this native.
• Users behind networks that block non-standard ports; 443 is almost never blocked.

Alternatives That Sit In Between

If RD Gateway’s CAL cost is too high but direct RDP feels too exposed, two middle paths exist. A VPN (WireGuard or OpenVPN) tunnels RDP without exposing 3389 and needs no CALs — our RDP vs VPN comparison details the trade-offs. For PowerShell-only administration, SSH tunneling or WinRM over HTTPS achieves the same “no exposed RDP” outcome with less infrastructure. RD Gateway is the answer specifically when you want browser-based access, MFA, and per-user policies without maintaining a VPN fleet.

Where to Run Either Setup

Both approaches start from the same foundation: a Windows Server VM with console access you can reach even if remote access breaks, and a firewall you control. Our Windows VPS comparison table lists providers with out-of-band console and IPv4 firewall control on every plan. If you decide to try RD Gateway, our step-by-step RD Gateway setup guide walks through the role installation — and if you only need secure access for a small team, start with direct RDP plus a VPN, then upgrade to a gateway when the user count justifies the CALs.

Testing RD Gateway without committing to CALs first? Deploy a Windows Server instance on Vultr with hourly billing, stand up the gateway in a test environment, and measure whether the extra security justifies the licensing before you roll it out.