# RDP-FIDO-GATE — setup & configuration (step by step) Secure Remote Desktop (RDP) with a **mandatory FIDO2/WebAuthn hardware-key gate**. The RDP port stays firewalled at all times and opens **only for your IP, for about 90 seconds**, after you touch the key. Requires Windows 10 1903+ (WebAuthn + Windows Firewall). There is no hosted service — you download and install it yourself. Two components and their ports: | Component | Where it runs | Ports | |-----------|---------------|-------| | **Gate** | target machine (the PC you connect to) | **7440/TCP** — control + FIDO confirmation; **3389/TCP** — RDP (opened on demand) | | **Client** | your machine | outbound connections to the host's 7440 and 3389 | | **FIDO Stream** (optional) | host | **7441/UDP** — video, audio and input of the low-latency mode; opened per session, only for your IP | --- ## Step 1. Host — install the gate 1. Download **[RdpFido-Setup.exe](https://accounts.new-imobile.com/updates/RdpFido-Setup.exe)** on the target machine, run it and choose **Host** (Windows will ask for administrator confirmation). It installs the gate; you can also download **[RdpFidoGate-Setup.msi](https://accounts.new-imobile.com/updates/RdpFidoGate-Setup.msi)** directly. 2. The installer enables Remote Desktop (with NLA), binds a TLS certificate to gate port **7440**, and registers and starts the gate service. The RDP port keeps working as before — it closes only when the first key is enrolled. 3. The last page of the installer shows a **one-time key enrollment code** (valid for 15 minutes, with a "Copy code" button), plus the machine's addresses and the gate port. 4. **Write down:** the host address (name / public IP), port **7440**, and the **code**. If the code expires, run `RdpFidoGate.exe code` as administrator. Silent install (e.g. from a management system): `msiexec /i RdpFidoGate-Setup.msi /qn` Unattended with the combined installer: `RdpFido-Setup.exe host` --- ## Step 2. Router port forwarding (if the host is behind NAT/a router) — REQUIRED for internet access If you connect **from the internet** and the target machine sits behind a home/office router, you must **forward two ports** on the router to the host's LAN address. Without this the client reaches neither the gate nor RDP. Forward (Port Forwarding / Virtual Servers / NAT in the router admin): | External port | Protocol | → Internal IP (host LAN) | Internal port | |---------------|----------|--------------------------|---------------| | **7440** | TCP | `192.168.x.x` (host LAN IP) | **7440** | | **3389** | TCP | same host LAN IP | **3389** | | **7441** | UDP | same host LAN IP | **7441** — only if you use FIDO Stream from the internet | Procedure: 1. Find the host's LAN IP: `ipconfig` → "IPv4 Address" (e.g. `192.168.1.50`). 2. **Reserve that address** for the host (DHCP reservation by MAC in the router) — otherwise it may change. 3. In the router: **Port Forwarding / Virtual Servers** → add the two rules from the table (external port = internal port, protocol TCP, internal IP = host LAN). 4. Find your **public IP** (on the host open `https://api.ipify.org`, or the router's "WAN IP"). If your IP is **dynamic**, set up **DDNS** (in the router or via no-ip/DuckDNS) and use the DDNS name instead of the IP. > Security: only the gate (7440) listens externally. RDP (3389) is **closed** from outside until you > confirm with the key — then it opens narrowly, for your IP only, for ~90s. Forwarding 3389 does not > grant access by itself; it only lets the temporary "window" pass through the router. --- ## Step 3. Client — install and register 1. Install the client: run **[RdpFido-Setup.exe](https://accounts.new-imobile.com/updates/RdpFido-Setup.exe)** and choose **Client** (per-user, no admin rights), or **[RdpFidoClient-Setup.msi](https://accounts.new-imobile.com/updates/RdpFidoClient-Setup.msi)** directly. 2. **Activation** via AccountServer: enter your e-mail → a code is mailed to you → enter it. 14-day activation grace period; free tier = up to 10 saved sessions, paid = no limit. 3. **Add a session:** - Address: the host's public IP or DDNS name (from Step 2), or the LAN address if you're on the same network. - Gate port: **7440**. - Protocol: **RDP (mstsc)** or **FIDO Stream** — see Step 5. - Enter the **one-time code** from Step 1 and **register your FIDO2 key** (touch). --- ## Step 4. Connect Pick the session → **touch the key** → the gate verifies it and **opens 3389 for your current IP for ~90s** → the client launches `mstsc` and connects you automatically. Every 30s the gate re-asserts the block, so the window stays narrow and IP-scoped. --- ## Step 5 (optional). FIDO Stream — low-latency mode for games and video FIDO Stream is a second connection mode next to RDP: the host's screen, audio and your input go over UDP with hardware encoding, so "click-to-photon" latency on a LAN is about 25–45 ms. The same key touch opens it; the gate opens UDP 7441 only for your IP and only for the session. Nothing extra is installed: the host agent is inside the gate, the viewer inside the client (gate version 1.15 or newer on the host). 1. In the session settings choose **Protocol: FIDO Stream (gaming, low latency)**. 2. Leave the settings on **Automatic** for the first try. What they mean: - **Balance** — a slider from **Poor link** (lower resolution, HEVC, more error correction) to **Weak PCs** (hardware encoder only, fastest preset, native resolution); **Adjust the balance automatically** moves it toward the current bottleneck. - **Host audio** and **Send my microphone to the host** — sound in both directions. - **Capture the mouse on start (for games)** — relative mouse motion for shooters. - **Connection** — **Automatic (punch through NAT)**, **This computer dials the host** (needs 7441/UDP forwarded to the host) or **The host dials this computer** (when your PC has a public address). - **Encoder (host)** — Automatic / NVIDIA NVENC (direct) / Hardware (any GPU) / Software (CPU); **Decoder** — Automatic / Hardware (GPU) / Software (CPU). 3. Connect as usual: pick the session → touch the key → the stream window opens. Hotkeys in the stream window: **Ctrl+Alt+Home** captures/releases the mouse, **Ctrl+Alt+Enter** toggles full screen, **Ctrl+Alt+End** disconnects. Requirements: Windows 10 1903+ on both sides; for the lowest latency a GPU with a hardware encoder on the host (NVIDIA, Intel or AMD). HEVC is used only when the client has a GPU decoder; otherwise the stream falls back to H.264 automatically. Diagnostics on the host (as administrator): `RdpFidoGate.exe stream encoders` lists the available encoders, `RdpFidoGate.exe stream encoders --bench` measures each one, `RdpFidoGate.exe stream selftest` runs capture → encode → decode without a network. Details are written to `gate.log` on the host and `client.log` on the client. --- ## Check & troubleshooting - From the client: `Test-NetConnection -Port 7440` → should be `TcpTestSucceeded : True`. If `False` — port 7440 isn't forwarded, or the host firewall blocks it. - Port **3389 is closed from outside until you confirm with the key** — that's expected (don't test it before the touch). - "Session won't open": check that 1) the gate service is running on the host, 2) **both** ports are forwarded on the router to the host's current LAN IP, 3) the public IP hasn't changed (use DDNS if dynamic). - Several hosts behind one router: use distinct external ports (e.g. host-2 → external 7441→7440, 3390→3389) and enter those external ports in the client session. - FIDO Stream does not start: the gate on the host must be version 1.15 or newer (the client says so), and for internet access either 7441/UDP is forwarded to the host or the session uses **The host dials this computer**. --- ## Uninstall On the host, as administrator: `powershell -ExecutionPolicy Bypass -File Uninstall-Gate.ps1` (removes the service, restores firewall rules). Then optionally remove the port-forwarding rules on the router.