Use case

RDP access to a single workstation

The problem

A technician needs Remote Desktop access to one Windows workstation or server, often behind NAT or a firewall with no public inbound RDP port.

Why traditional network access is excessive here

Exposing RDP (port 3389) publicly is a well-known attack surface; a private-network/VPN approach avoids public exposure but still grants the technician's machine broader network reachability than an RDP-only task requires.

How TunnelCrib handles it

A TunnelCrib Agent on the Windows Device advertises its rdp Service (port 3389 by default). No inbound port is opened on the Device to the public internet; the Tunnel is established on demand.

Setup example

$ tunnelcrib connect finance-ws-04:rdp

device identity verified
direct Tunnel negotiated
Service Tunnel active
localhost:49318

Authorization example

The technician's Client is authorized for this specific workstation's RDP Service; a different workstation requires its own explicit grant.

User experience

The technician points their RDP client at localhost:<port> and authenticates with their normal Windows credentials, exactly as with a direct RDP connection.

Audit trail

The connect request and session lifecycle are recorded (see audit events); full RDP session recording/replay is not currently part of TunnelCrib.

Security considerations

RDP is never exposed to the public internet; the Device only ever needs to reach the Central Server outbound and run the TunnelCrib Agent locally. See the threat model for what a compromised Agent host would still expose.