Are you using TS Gateway?

There has to be a better way. Something better than trying to remember the different port assignments; better than opening up all those ports to the world and allowing anyone to RDP to the server for the casual brute force password attack. Better than something so complex that I couldn’t really explain it to co-workers that needed to connect into my lab. It turns out there is a better way. It’s called Microsoft Windows 2008 Terminal Services Gateway.