sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-10-10 23:59:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add Clientless RDP for Third Parties use case guide (#929)

Browse Source 
* docs: add clientless RDP for third parties use case guide

Covers publishing an internal RDP host as a TCP reverse proxy service
as an RDP gateway replacement for third parties that cannot install
the NetBird client: single-host resource, TCP service with auto-assigned
listen port, mandatory IP allowlist/CrowdSec restrictions, .rdp file
handover, and the L4 security boundaries (no SSO/PIN on TCP, port
re-rolls on service re-create, service publishing bypasses access
policies).

* docs: make CrowdSec conditional on broad allow rules, add UDP transport note

Review feedback: CrowdSec Enforce is redundant behind a strict single-IP
allowlist, so it is now recommended only when allow rules are broader.
Adds a note that RDP's optional UDP transport cannot be used through the
shared proxy cluster (independent auto-assigned listen ports) and that
clients fall back to TCP-only automatically.

* docs: update access control screenshot to match single-IP recommendation

* docs: scope the UDP transport limitation to the shared proxy cluster

Auto-assigned listen ports apply to the NetBird-hosted cluster only; a
BYOP cluster can bind a TCP and a UDP service to the same custom port.

* docs: UDP transport through a BYOP same-port service pair is verified working

Tested with mstsc against a BYOP cluster binding TCP and UDP services on
one custom port: the client negotiates the UDP transport through the
proxy, and removing the UDP service degrades cleanly to TCP-only. Also
notes the macOS client does not support the RDP UDP transport.

* docs: scope the macOS UDP claim to what was observed

* docs: macOS UDP claim holds with the app's UDP setting enabled

* docs: split into shared-proxy and BYOP use cases, drop client-specific UDP note

Adds a comparison of the two proxy deployments (auto-assigned port and
TCP-only vs custom ports and RDP UDP transport), a BYOP walkthrough with
the same-port TCP+UDP service pair, and keeps resource setup, access
restrictions, and verification shared between both paths.

* docs: clarify BYOP TLS requirement and service-domain resolution, grammar fixes
This commit is contained in:
Jack Carter
2026-08-18 08:59:38 +02:00
committed by GitHub
parent 627d18fda0
commit a9b5c3f99b
4 changed files with 247 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/use-cases/index.mdx
+1
View File
@@ -19,6 +19,7 @@ You know what you want to achieve; this page finds the guide that gets you there
| Access services running on the routing peer itself | [Reach Services on the Routing Peer](/use-cases/remote-access/reach-services-on-the-routing-peer) |
| Route all my internet traffic through one peer | [Exit Nodes](/use-cases/remote-access/exit-nodes) |
| Reach Active Directory and Windows file shares remotely | [Active Directory & Windows File Shares](/use-cases/remote-access/active-directory) |
| Give third parties RDP access without installing NetBird | [Clientless RDP for Third Parties](/use-cases/remote-access/clientless-rdp) |
### Deploy NetBird in the cloud