I just tried Cloudflare's new browser-based RDP access feature (private beta) built using @devolutions.net IronRDP — and it's impressive! 🚀 If you're using Azure Bastion today, you should consider migrating as soon as it comes out 👇 developers.cloudflare.com/cloudflare-o... - ThreadSky

awakecoding.com • 41 days ago

I just tried Cloudflare's new browser-based RDP access feature (private beta) built using @devolutions.net IronRDP — and it's impressive! 🚀 If you're using Azure Bastion today, you should consider migrating as soon as it comes out 👇

https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/

Comments

cray.codes•41 days ago

I await additional auth support, but this looks amazing!

awakecoding.com•41 days ago

Native RDP authentication, or pre-authentication to access the RDP web client?

cray.codes•41 days ago

Native RDP auth - ideally Cloudflare lets us configure the user on the Cloudflare side with a cert that it can pass to the RD host for seamless auth experience once they’ve logged into the CF app launcher

awakecoding.com•41 days ago

I was afraid you'd say something like this. You can have this today using https://goteleport.com/ - they are also using IronRDP and collaborating with us. They do short-lived X.509 certificates injected into the RDP web client

cray.codes•41 days ago

Interesting, I will have to check this out. Unfortunately, all of our clients are tied into Cloudflare Zero Trust already, so it makes sense for us to move in that direction if Cloudflare plans to support it in the future :(

taylormar.vin•41 days ago

This looks neat, I’ll have to check it out further.

Some questions for you if you have time - How is the auth happening between the cloudflare page and the rdp session? Is it just passing the credentials through? Are there any 2fa options available?

jamielangdon.bsky.social•41 days ago

How is it better than Bastion?

awakecoding.com•41 days ago

Azure Bastion is expensive, slow to deploy, and can't be turned off. You literally have to delete the Azure Bastion resource in Azure to avoid paying for it when it's not used, and then redeploy as needed, which can take over 10 minutes. This is much cheaper, faster, and efficient

jamielangdon.bsky.social•41 days ago

Interesting, but how about from a connection standpoint? Do you get a better framerate or scaling? How about copy and paste to and from the host abilities?

awakecoding.com•41 days ago

This is using IronRDP and the RDCleanPath protocol extension we originally designed in Devolutions Gateway, adding native WebSocket support to RDP. Just like with Devolutions Gateway, Cloudflare acts as a very lightweight WebSocket network bridge, which is much more efficient than Apache Guacamole

awakecoding.com•41 days ago

Simply put, most web-based RDP web clients right now are based on Apache Guacamole, and that includes Azure Bastion. With the Guacamole design, a FreeRDP client in a bastion host does the real RDP connection to send images back to the browser. It's much more resource-intensive

awakecoding.com•41 days ago

The other design is the HTML5 web client that comes with the RD Gateway, called "RD Web Access". Instead of adapting RDP for WebSocket, they wrapped the TCP connection in a WebSocket and implemented TLS *inside* the browser a second time. TLS in WSS, which you can guess comes with overhead

jamielangdon.bsky.social•41 days ago

Wow, thank you for the info. I remember messing with Guacamole back in the day. Didn't realize that was basically the tech behind what MS is using today.

Comments

Posting Rules

Reply