INTEGRITY Cloudflare Docs

← Cloudflare One / cloudflare-one / networks / connectors / cloudflare-tunnel / use-cases / rdp

Connect to RDP in a browser

Users can connect to an RDP server without installing an RDP client or the Cloudflare One Client on their device. Browser-based RDP leverages Cloudflare Tunnel, which creates a secure, outbound-only connection from your RDP server to Cloudflare's global network. Setup involves running the cloudflared daemon on the RDP server (or any other host machine within the private network) and routing RDP traffic over a public hostname.

There are two ways for users to reach the RDP server in their browser:

Browser-based RDP can be used in conjunction with the Cloudflare One Client so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method.

Prerequisites

1. Connect the server to Cloudflare

  1. In the Cloudflare dashboard, go to Networking > Tunnels.

    Go to Tunnels ↗

  2. Create a new tunnel or edit an existing cloudflared tunnel.

  1. In the Cloudflare dashboard, go to Networking > Routes.

    Go to Routes ↗

  2. Select Create route > Tunnel CIDR. Select the tunnel you just created, enter the IP or CIDR address of your server (typically a private IP, but public IPs are also allowed), and select Create route.

2. Add a target

A target represents a single resource in your infrastructure (such as a server, Kubernetes cluster, database, or container) that users will connect to through Cloudflare.

Create a target for each Windows machine that requires RDP access. To create a new target:

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Access controls > Targets.
  2. Select Add a target.
  3. In Target hostname, enter a user-friendly name for the target. We recommend using the server hostname, for example production-server. The target hostname does not need to be unique and can be reused for multiple targets. Hostnames are used to define the targets secured by an Access application; they are not used for DNS address resolution.

    Hostname format restrictions

    • Case insensitive
    • Contain no more than 253 characters
    • Contain only alphanumeric characters, -, or . (no spaces allowed)
    • Start and end with an alphanumeric character
  4. In IP addresses, enter the IPv4 and/or IPv6 address of the target resource. The dropdown menu will not populate until you type in the full IP address.
  1. In the dropdown menu, select the IP address and virtual network where the resource is located. This IP address and virtual network pairing is now assigned to this target and cannot be reused in another target by design.
  2. Select Add target.

Make a POST request to the Infrastructure Access Targets endpoint:

Create new target
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/infrastructure/targets" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"hostname": "infra-access-target",
		"ip": {
				"ipv4": {
						"ip_addr": "187.26.29.249",
						"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
				},
				"ipv6": {
						"ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
						"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
				}
		}
	}'

  1. Add the following permission to your cloudflare_api_token ↗:

    • Zero Trust Write

  2. Configure the cloudflare_zero_trust_infrastructure_access_target ↗ resource:

    resource "cloudflare_zero_trust_infrastructure_access_target" "infra-ssh-target" {
	account_id = var.cloudflare_account_id
		hostname   = "infra-access-target"
		ip = {
			ipv4 = {
				ip_addr = "187.26.29.249"
				virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
			}
			ipv6 = {
				ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
				virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
			}
		}
}

Next, create an Access application to secure the target.

3. Create a DNS record

To make your RDP targets (that is, your Windows machines) available through the browser, you will need a Cloudflare DNS record for the domain and subdomain that users will connect to. This domain will be used to access any targets that are available to users through your Access application (see Step 4).

For example, if want users to connect to targets on rdp.example.com, create a DNS record for rdp.example.com. You can create either an A, AAAA, or CNAME record:

A record

The following DNS record points your public subdomain (rdp) to an IPv4 address in the Class E address space ↗.

AAAA record

The following DNS record points your public subdomain (rdp) to the IPv6 discard address range ↗:

CNAME record

The following CNAME record points your public subdomain (rdp) to a fully qualified domain name.

The CNAME Target field is unrelated to the RDP targets configured in Step 2.

The DNS record does not need to point to an active destination IP address or hostname; the DNS record just needs to be valid. Cloudflare's RDP proxy will handle the routing to the correct RDP target.

4. Create an Access application

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Access controls > Applications.

  2. Select Create new application.

  3. Select Self-hosted and private.

  4. Select Add public hostname.

  5. In the Domain dropdown, select the domain that will represent the application. Domains must belong to an active zone in your Cloudflare account. You can use wildcards to protect multiple parts of an application that share a root path.

    Alternatively, to use a Cloudflare for SaaS custom hostname, select Switch to custom input and enter your custom hostname.

  6. Turn on Allow access through browser-based RDP, SSH, or VNC sessions, then select RDP from the dropdown menu.

  7. In Target criteria, select the target hostname(s) that define your RDP servers. The application definition will apply to all targets that share the selected target hostname, including any targets added in the future.

  8. In Port, enter the RDP listening port ↗ of your server. It will likely be port 3389.

  9. (Optional) If you run RDP on more than one port, select Add new target criteria and reconfigure the same target hostname(s) with the different port number.

  10. Under Access policies, add an existing policy or create a new policy to control who can connect to your application. All Access applications are deny by default -- a user must match an Allow policy before they are granted access.

  11. (Optional) In your Access policy, configure connection settings to restrict clipboard and file transfer actions between the user's local machine and the browser-based RDP session.

  12. Configure how users will authenticate:

    1. Select the identity providers you want to enable for your application.

    2. (Recommended) If you plan to only allow access via a single IdP, turn on Apply instant authentication. End users will not be shown the Cloudflare Access login page. Instead, Cloudflare will redirect users directly to your SSO login event.

    3. Authenticate with Cloudflare One Client is not supported for browser-based RDP and should remain turned off.

  13. In Session Duration, choose how often the user's application token should expire.

    Cloudflare checks every HTTP request to your application for a valid application token. If the user's application token (and global token) has expired, they will be prompted to reauthenticate with the IdP. For more information, refer to Session management.

  14. (Optional) Go to the Additional settings tab to customize the application experience:

    • App Launcher customization: The App Launcher allows users to view the Windows servers that they can access using browser-based RDP. Cloudflare recommends keeping Show application in App Launcher turned on. Without the App Launcher, users will need to know each target's direct URL.

    • Custom block pages: Choose what users will see when they are denied access to the application.

      • Cloudflare default: Reload the login page and display a block message below the Cloudflare Access logo. The default message is That account does not have access, or you can enter a custom message.
      • Redirect URL: Redirect to the specified website.
      • Custom page template: Display a custom block page hosted in Cloudflare One.

  15. Select Create.

By default, Cloudflare will evaluate Access application policies after evaluating all Gateway network policies. To evaluate Access applications before or after specific Gateway policies:

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Traffic policies > Firewall policies. In Network, create a Network policy with the following configuration:

    Selector Operator Value Action
    Access Infrastructure Target is Present Allow
  2. Ensure that Enforce Cloudflare One Client session duration is turned off, otherwise users will be blocked from accessing RDP targets.

  3. Update the policy's order of precedence using the dashboard or API.

This Gateway policy will apply to all Access for Infrastructure targets, including RDP and SSH.

6. Connect as a user

To connect to a Windows machine over RDP:

  1. Open a browser and go to your App Launcher URL:

    https://<your-team-name>.cloudflareaccess.com

    Replace <your-team-name> with your Zero Trust team name.

  2. Follow the prompts to log in to your identity provider.

    Once you have authenticated, the App Launcher will display tiles showing the applications that you are authorized to use. Windows servers (targets) available through browser-based RDP will also appear as tiles. If a target is reachable through multiple Access applications, the target will have a tile per Access application.

  3. Select the target you want to connect to.

    The App Launcher tile will launch a URL of the form https://<app-domain>/rdp/<vnet-id>/<target-ip>/<port>. You may also navigate directly to this URL.

  4. Select the port that you want to connect to. The port selection screen only appears if the Access application allows RDP traffic on multiple ports (for example, port 3389 and port 65321).

  5. (Optional) In your browser settings, allow the Access application to access the clipboard. Clipboard access is subject to policy restrictions configured by your administrator.

  6. Enter your Windows username and password. For more information on how to format your username, refer to User identifier formats.

You now have access to the remote Windows desktop.

Connection settings

Connection settings restrict data transfer between the user's local machine and the browser-based RDP session. You can control text (copy and paste) and file transfers. Text controls manage clipboard content. File controls Beta manage file uploads and downloads. These controls are configured per policy, so you can grant different permissions to different groups of users.

Default behavior

For new policies, both text controls and file controls are denied by default. You must explicitly allow each action. Existing applications retain full text clipboard access for backward compatibility. File controls are denied unless explicitly enabled.

Available settings

Text controls and file controls use the same directional options:

Setting Description
Client to remote RDP session allowed Users can transfer data from their local client into the browser-based RDP session.
Remote RDP session to client allowed Users can transfer data from the browser-based RDP session to their local client.
Both directions allowed Users can transfer data in both directions.
Disable copying/pasting Users are not allowed to transfer data between the browser-based RDP session and their local client.

For example, you can allow text copy and paste in both directions while restricting file transfers to uploads only.

When a user attempts a restricted clipboard action, the clipboard content is replaced with a message informing them that the action is not allowed. When file transfer is restricted, upload methods are disabled and download buttons do not appear in the control panel.

Configure connection settings

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Access controls > Applications.
  2. Locate your browser-based RDP application and select Configure.
  3. Select the Policies tab.
  4. Create a new policy or select an existing policy to edit.
  5. Expand Connection context.
  6. Under Connection settings, configure the following settings:
    • Text controls — Select a directional setting for text copy and paste.
    • File controls — Select a directional setting for file uploads and downloads.
  7. Select Save policy.

When creating or updating an Access policy for an RDP application, configure the allowed formats in each direction. Use text for text clipboard and file for file transfer. For example, the following policy allows text clipboard in both directions but only allows file uploads (local to remote).

Required API token permissions

At least one of the following token permissions is required:
  • Access: Apps and Policies Write
Create an Access reusable policy
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/policies" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Allow engineers with clipboard and upload",
		"decision": "allow",
		"include": [
				{
						"email_domain": {
								"domain": "example.com"
						}
				}
		],
		"connection_rules": {
				"rdp": {
						"allowed_clipboard_local_to_remote_formats": [
								"text",
								"file"
						],
						"allowed_clipboard_remote_to_local_formats": [
								"text"
						]
				}
		}
	}'

Using the connection_rules attribute within a cloudflare_zero_trust_access_policy ↗ resource, configure the allowed formats in each direction. Use text for text clipboard and file for file transfer. For example, the following policy allows text clipboard in both directions but only allows file uploads (local to remote).

resource "cloudflare_zero_trust_access_policy" "rdp-policy" {
	account_id = var.cloudflare_account_id
	name       = "Allow engineers with clipboard and upload"
	decision   = "allow"

	include = [
		{
			email_domain = {
				domain = "example.com"
			}
		}
	]

	connection_rules = {
		rdp = {
			allowed_clipboard_local_to_remote_formats = ["text", "file"]
			allowed_clipboard_remote_to_local_formats = ["text"]
		}
	}
}

Transfer files Beta

To manage transfers, select the settings gear icon on the left side of the RDP session. You can drag this icon along the left edge to reposition it.

File transfer has the following limits:

Upload files (local to remote)

To transfer files from your local machine to the remote Windows session, drag files onto the browser window or use the control panel. Drag and drop supports individual files and folders (including subfolders, up to 1,000 total entries). The control panel file picker selects individual files only. Files land on the active element of the remote desktop. For example, if you have a folder open in File Explorer, the file lands in that folder.

Download files (remote to local)

To transfer files from the remote Windows session to your local machine:

  1. In the remote Windows session, copy the file you want to download. Right-click the file and select Copy, or select the file and press Ctrl+C.
  2. The control panel icon does a small hop to indicate that a file is available. Open the control panel to view the file.
  3. Select one of the following options:
    • Download: Download the file to your local machine.
    • Download zip: Download multiple files at once as a zipped folder to your local machine.
    • Print: Print PDF files to a local printer on your network.

You can print PDF files from the clipboard panel to a local printer. To print a single file, select the print icon next to the PDF. To print multiple files at once, copy the files together into the clipboard on the remote machine, then select Print all PDFs in the clipboard panel. The files are combined into a single PDF and sent to your browser as one print job.

Limitations

Compatibility

RDP server operating systems

Browser-based RDP supports connecting to Windows machines that run the following operating systems:

Browsers

Browser Compatibility
Google Chrome ✅
Mozilla Firefox ✅
Safari ✅
Microsoft Edge (Chromium-based) ✅
Other Chromium-based browsers (Opera, Brave) ✅
Internet Explorer 11 and below ❌

Powershell

Run Powershell 7 or higher to mitigate a prior Microsoft issue where keystrokes are not recorded.

User identifier formats

Browser-based RDP supports connecting to Windows machines using the following login credentials:

Security Account Manager (SAM)

SAM-formatted user identifiers are supported with and without spaces.

Examples:

Character limits

Identifiers which specify a domain, such as DOMAIN\username, can have a maximum of 20 characters for the domain and 15 characters for the username.

Identifiers without a domain, such as .\username, will use the default domain. The username can have a maximum of 20 characters.

User Principal Name (UPN)

UPN-formatted user identifiers are supported with spaces, with and without quotes.

Examples:

Microsoft Entra ID

User identifiers that are bound to Microsoft Entra ID domains must enter their username as AzureAD\[email protected] or AzureAD\user. The AzureAD\ prefix is case-insensitive. The login flow differs slightly when using an Microsoft Entra ID-bound username:

  1. Enter your username in one of the formats outlined above.
  2. Once the username is entered, the password box will disappear and the RDP connection will initiate.
  3. The RDP server will then prompt for the password before granting access to the RDP server.

Cloudflare products

When using Access self-hosted applications, the majority of Cloudflare products will be compatible with your application.

However, the following products are not supported:

You can disable Zaraz for a specific application - instead of across your entire zone - using a Configuration Rule scoped to the application domain.

Google tag gateway is configured at the zone level and cannot be scoped to specific hostnames. To use Access binding cookie on a hostname, disable Google tag gateway for the entire zone.

Known limitations