How can I expose port 3389 using a secure approach

Question

Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this).

We currently restrict the IP range that can access this port. Is this enough for security? This article mentions never globally exposing this port: https://www.grc.com/port_3389.htm

Answer 1

You can add, if it's not already the case, a frontal, rev proxy, to prevent direct access to the TS. This could also add an authentication layer... I am not a lot in Microsoft stuff so this is really a basic advice. If TS allow the use of pubkey instead of passwd this would be a good addition too.