freerdp-proxy(1) FreeRDP freerdp-proxy(1)

# [NAME](#NAME)

freerdp-proxy - A server binary allowing MITM proxying of RDP connections

# [SYNOPSIS](#SYNOPSIS)

**freerdp-proxy** \[**-h**] \[**--help**] \[**--buildconfig**] \[**--dump-config** **<config file>**] \[**-v**] \[**--version**] \[**<config file>**]

# [DESCRIPTION](#DESCRIPTION)

**freerdp-proxy** can be used to proxy a RDP connection between a target server and connecting clients. Possible usage scenarios are:

[Proxying](#Proxying)

Connect outdated/insecure RDP servers from behind a (more secure) proxy

[Analysis](#Analysis)

Allow detailed protocol analysis of (many) unknown protocol features (channels)

[Inspection](#Inspection)

MITM proxy for session inspection and recording

# [OPTIONS](#OPTIONS)

[-h,--help](#h,--help)

Display a help text explaining usage.

[--buildconfig](#buildconfig)

Print the build configuration of the proxy and exit.

[-v,--version](#v,--version)

Print the version of the proxy and exit.

[--dump-config](#dump-config)

Dump a template configuration to **<config-ini-file>** or to **stdout** or **stderr**

**<config-ini-file>**

Start the proxy with settings read from **<config-ini-file>**

# [WARNING](#WARNING)

The proxy does not support authentication out of the box but acts simply as intermediary. Only **RDP** and **TLS** security modes are supported for pass through connections. User and password are transmitted in plain text from client to the proxy in these modes. With **NLA** the credentials never leave the connecting client and only the **NTLM** hashes are compared.

To implement proper authentication a **proxy-module** can be implemented that may authenticate against some backend and map connecting users and credentials to target server users and credentials.

# [TEST SETUP](#TEST_SETUP)

A simple test setup of freerdp-proxy might look like this:

[SAM](#SAM)

[User/Domain/Password](#User/Domain/Password)

[Alternatively](#Alternatively)

This setup is designed for testing purposes only and does not do any authentication mapping of connecting users to target machine users, so any allowed connecting user will use the same credentials on the target.

# [EXAMPLES](#EXAMPLES)

freerdp-proxy /some/config/file

freerdp-proxy --dump-config /some/config/file

# [PREPARATIONS](#PREPARATIONS)

1\. generate certificates for proxy

**winpr-makecert -rdp -path . proxy**

2\. generate proxy configuration

**freerdp-proxy --dump-config proxy.ini**

3\. edit configurartion and:

\* provide (preferably absolute) paths for **CertificateFile** and **PrivateKeyFile** generated previously  
\* remove the **CertificateContents** and **PrivateKeyContents**  
\* Adjust the **\[Server]** settings **Host** and **Port** to bind a specific port on a network interface  
\* Adjust the **\[Target]** **Host** and **Port** settings to the **RDP** target server  
\* Adjust (or remove if unuse) the **Plugins** settings

3\. start proxy server

**freerdp-proxy proxy.ini**

# [EXIT STATUS](#EXIT_STATUS)

**0**

Successful program execution.

**1**

Otherwise.

# [SEE ALSO](#SEE_ALSO)

[freerdp(7)](/man/os/freerdp-3/freerdp.7) [wlog(7)](/man/os/freerdp-3/wlog.7)

# [AUTHOR](#AUTHOR)

FreeRDP <team@freerdp.com>

2023-12-14 3.32.1

---

Document: freerdp-proxy(1) from freerdp-3 3.32.1-r0 (Chainguard OS)
Source: https://github.com/FreeRDP/FreeRDP