Connecting to a Windows VM via RDP through a Linux bastion host port forwarding on 3Engines Cloud[🔗](#connecting-to-a-windows-vm-via-rdp-through-a-linux-bastion-host-port-forwarding-on-brand-name "Permalink to this headline")
===================================================================================================================================================================================================================================

If you want to increase the security of your Windows VMs while connecting to them via RDP, you might want to use the method described in this article. It involves connecting to your Windows VM not directly through RDP, but through another virtual machine running Linux known as the “bastion host”. In this case, the RDP connection gets tunneled through SSH and is not directly visible to others.

This method is especially useful if you fear that your RDP connection might be compromised or if using RDP without additional security measures is illegal. It also allows you to use a single floating IP address to connect to multiple Windows VMs.

**Requirements:**[🔗](#requirements "Permalink to this headline")
----------------------------------------------------------------

* Linux virtual machine with SSH access - bastion host
* Windows virtual machine located in the same network as the bastion host

* The private key downloaded from OpenStack dashboard converted from .pem to .ppk format (using “PuTTYgen”) - for information on how to do this please see [How to access a VM from Windows PuTTY on 3Engines Cloud](How-to-access-a-VM-from-Windows-PuTTY-on-3Engines-Cloud.html.md)

* The password for the Administrator account has been changed via the OpenStack dashboard console
* Your VMs are assigned the following security group: allow\_ping\_ssh\_icmp\_rdp

![conn01.png](../_images/conn01.png)

Step 1. Information required to establish connection with the bastion host.[🔗](#step-1-information-required-to-establish-connection-with-the-bastion-host "Permalink to this headline")
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Launch PuTTY and change the settings according to the instructions:

**Session** tab: Provide the host (bastion) floating IP address and the SSH port (default 22).

![conn11b.png](../_images/conn11b.png)

**Connection > Data** tab: Set auto-login username as “eouser”.

![conn02b.png](../_images/conn02b.png)

**Connection > SSH > Auth** tab: Select the private key in the .ppk format.

![conn03b.png](../_images/conn03b.png)

**Connection > SSH > Tunnels:** Provide the source port for the localhost RDP connection and destination (in the following format: *private IP address of Windows VM:RDP port* - as seen on the screenshot below).

![conn04b.png](../_images/conn04b.png)

Click the “Add” button to confirm the changes.

Your forwarded port should now be visible in the upper tab.

![conn05b.png](../_images/conn05b.png)

Provide the name of the session and save your config to avoid repeating the whole process every time you would like to connect to your instance again.

![conn10b.png](../_images/conn10b.png)

Step 2. Open connection in PuTTy[🔗](#step-2-open-connection-in-putty "Permalink to this headline")
--------------------------------------------------------------------------------------------------

Click “Open” to establish the connection.

![conn06b.png](../_images/conn06b.png)

Step 3. Start an RDP session to localhost to reach the destination server[🔗](#step-3-start-an-rdp-session-to-localhost-to-reach-the-destination-server "Permalink to this headline")
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Set *localhost address:port* selected in step 2 (in this case it is either 127.0.0.1:8888 or localhost:8888 - you can choose whatever you prefer).

Set the username as “Administrator”.

![conn07b.png](../_images/conn07b.png)

Click “Connect” and enter your VM’s administrator password (the one you’ve set in the OpenStack console).

![conn08b.png](../_images/conn08b.png)

Confirm the connection in the certificate prompt.

![conn09b.png](../_images/conn09b.png)

That’s it, you’re now successfully connected to your Windows VM!

![conn11.png](../_images/conn11.png)