RDP-FIDO-GATE
Zero-trust RDP, gated by a hardware key.
A lightweight gateway that puts hardware FIDO2 two-factor authentication in front of Windows Remote Desktop. Users tap a security key before a session opens — there is no password left to steal.
Security by design
Three guarantees that make a stolen password worthless.
A hardware key, not a password
Opening a session requires a physical FIDO2 / WebAuthn key touch. A stolen or phished password is useless on its own, and no password is ever sent over the wire — the key proves possession, cryptographically.
Enforced by Windows itself
The gate is built entirely on native Windows security mechanisms — the Windows Firewall to open and close the port, the Windows WebAuthn API to check the key, and DPAPI to encrypt stored secrets. There is nothing to trust beyond the operating system.
Default-deny, time-boxed access
RDP port 3389 stays firewall-blocked and invisible to the internet. Only after a registered key proves possession does the gate open a narrow, single-IP hole for about 90 seconds — then it re-blocks the port and re-asserts the block every 30 seconds.
How it works
One key touch opens a single-IP firewall hole for about 90 seconds — then the port closes again.
Free vs Pro
Start free. Upgrade once for unlimited sessions and no ads.
| Feature | Free | Pro |
|---|---|---|
| Saved sessions | 10 | Unlimited |
| FIDO2 hardware-key gate | ✓ | ✓ |
| Windows Firewall enforcement | ✓ | ✓ |
| Ad tile | ✓ | ✗ |
| Activation | 14 days for free activation | — |
| Price | Free | $49 one-time |
| Buy Pro — $49 |
After activation you keep using it for free, within the Free plan's limits (up to 10 sessions).
Setup & requirements
No hosting — install the gate on the target PC and the client on yours. Ports: gate 7440/TCP, RDP 3389/TCP.
- Host — unpack RdpFidoGate-Host.zip and run Install-Gate.ps1 as admin. Note the host address, port 7440 and the one-time code.
- Port forwarding (for internet access) — if the host is behind a router/NAT, forward 7440/TCP and 3389/TCP to the host's LAN IP. Reserve a static LAN IP; use DDNS if your public IP is dynamic.
- Client — install RdpFidoClient, activate by e-mail, add a session (host public IP/DDNS, gate port 7440, the one-time code) and register your FIDO2 key.
- Connect — pick the session and touch the key — the gate opens 3389 for your IP for ~90s and mstsc connects.
⚠️ Without forwarding ports 7440 and 3389 on the router, internet access will not work. RDP is closed from outside until you confirm with the key.
Lock down Remote Desktop today
Download the gate and client for free, or unlock everything with Pro.
$49 one-time · unlimited sessions · no ads