# RDP-FIDO-GATE — setup & configuration (step by step)

Secure Remote Desktop (RDP) with a **mandatory FIDO2/WebAuthn hardware-key gate**. The RDP port
stays firewalled at all times and opens **only for your IP, for about 90 seconds**, after you touch
the key. Requires Windows 10 1903+ (WebAuthn + Windows Firewall). There is no hosted service — you
download and install it yourself.

Two components and their ports:

| Component | Where it runs | Ports |
|-----------|---------------|-------|
| **Gate** | target machine (the PC you connect to) | **7440/TCP** — control + FIDO confirmation; **3389/TCP** — RDP (opened on demand) |
| **Client** | your machine | outbound connections to the host's 7440 and 3389 |

---

## Step 1. Host — install the gate

1. Download **[RdpFidoGate-Setup.msi](https://accounts.new-imobile.com/updates/RdpFidoGate-Setup.msi)** on the target machine and run it (Windows will ask for administrator confirmation).
2. The installer enables Remote Desktop (with NLA), binds a TLS certificate to gate port **7440**, and registers and starts the gate service. The RDP port keeps working as before — it closes only when the first key is enrolled.
3. The last page of the installer shows a **one-time key enrollment code** (valid for 15 minutes, with a "Copy code" button), plus the machine's addresses and the gate port.
4. **Write down:** the host address (name / public IP), port **7440**, and the **code**. If the code expires, run `RdpFidoGate.exe code` as administrator.

Silent install (e.g. from a management system): `msiexec /i RdpFidoGate-Setup.msi /qn`

---

## Step 2. Router port forwarding (if the host is behind NAT/a router) — REQUIRED for internet access

If you connect **from the internet** and the target machine sits behind a home/office router, you
must **forward two ports** on the router to the host's LAN address. Without this the client reaches
neither the gate nor RDP.

Forward (Port Forwarding / Virtual Servers / NAT in the router admin):

| External port | Protocol | → Internal IP (host LAN) | Internal port |
|---------------|----------|--------------------------|---------------|
| **7440** | TCP | `192.168.x.x` (host LAN IP) | **7440** |
| **3389** | TCP | same host LAN IP | **3389** |

Procedure:
1. Find the host's LAN IP: `ipconfig` → "IPv4 Address" (e.g. `192.168.1.50`).
2. **Reserve that address** for the host (DHCP reservation by MAC in the router) — otherwise it may change.
3. In the router: **Port Forwarding / Virtual Servers** → add the two rules from the table
   (external port = internal port, protocol TCP, internal IP = host LAN).
4. Find your **public IP** (on the host open `https://api.ipify.org`, or the router's "WAN IP"). If your
   IP is **dynamic**, set up **DDNS** (in the router or via no-ip/DuckDNS) and use the DDNS name instead of the IP.

> Security: only the gate (7440) listens externally. RDP (3389) is **closed** from outside until you
> confirm with the key — then it opens narrowly, for your IP only, for ~90s. Forwarding 3389 does not
> grant access by itself; it only lets the temporary "window" pass through the router.

---

## Step 3. Client — install and register

1. Install the client: `RdpFidoClient.exe` (the matching `RdpFidoGate.exe` is included).
2. **Activation** via AccountServer: enter your e-mail → a code is mailed to you → enter it.
   14-day activation grace period; free tier = up to 10 saved sessions, paid = no limit.
3. **Add a session:**
   - Address: the host's public IP or DDNS name (from Step 2), or the LAN address if you're on the same network.
   - Gate port: **7440**.
   - Enter the **one-time code** from Step 1 and **register your FIDO2 key** (touch).

---

## Step 4. Connect

Pick the session → **touch the key** → the gate verifies it and **opens 3389 for your current IP for
~90s** → the client launches `mstsc` and connects you automatically. Every 30s the gate re-asserts the
block, so the window stays narrow and IP-scoped.

---

## Check & troubleshooting

- From the client: `Test-NetConnection <public-ip-or-DDNS> -Port 7440` → should be
  `TcpTestSucceeded : True`. If `False` — port 7440 isn't forwarded, or the host firewall blocks it.
- Port **3389 is closed from outside until you confirm with the key** — that's expected (don't test it before the touch).
- "Session won't open": check that 1) the gate service is running on the host, 2) **both** ports are
  forwarded on the router to the host's current LAN IP, 3) the public IP hasn't changed (use DDNS if dynamic).
- Several hosts behind one router: use distinct external ports (e.g. host-2 → external 7441→7440,
  3390→3389) and enter those external ports in the client session.

---

## Uninstall

On the host, as administrator: `powershell -ExecutionPolicy Bypass -File Uninstall-Gate.ps1`
(removes the service, restores firewall rules). Then optionally remove the port-forwarding rules on the router.