Build a Restricted Tailscale RDP Administration Path

Expected Outcome

One authorized admin reaches a supported Windows RDP host through Tailscale while ordinary LAN/WAN paths and unauthorized identities are denied; the recovery path is documented and tested.

Assumptions

• Windows edition that supports hosting Remote Desktop

• Tailscale lab/tailnet with control of grants/ACL policy

• One authorized admin identity and one unauthorized test identity

• Console or alternate recovery access before firewall restrictions

• No public 3389 exposure

Bill of Materials

• Tailscale software

• Windows machines with RDP enabled

• Firewall software (optional)

• Password manager (optional for secure password handling)

Build Steps

1. Define the permitted path

   Document admin identity -> Tailscale device/user authorization -> target Tailscale address/name -> RDP service. Decide whether LAN RDP should also be denied for the exercise and preserve console recovery.

2. Enroll target and admin client in Tailscale

   Authenticate devices using the intended identity controls, verify unique node identity, and confirm basic Tailscale reachability before enabling/restricting RDP.

3. Create least-privilege Tailscale access policy

   Allow the admin identity/group to reach only the target's TCP 3389 (or the chosen RDP service path). Confirm the unauthorized test identity lacks that grant.

4. Restrict Windows Firewall to the Tailscale source/path

   Enable RDP only on supported Windows hosts and create/review firewall scope so the intended Tailscale network/interface/source can reach it. Do not rely on changing the RDP port as a security control.

5. Test authorized access

   From the authorized client, connect to the target using the Tailscale address/name and complete Windows authentication. Record Tailscale policy/device and Windows log evidence.

6. Test bypass and unauthorized paths

   Attempt the same connection from a non-Tailscale path and from the unauthorized Tailscale identity; both should fail according to the design.

7. Exercise rollback

   Using console/recovery access, show how to remove the restrictive firewall/policy change and regain a known management path if Tailscale or identity policy becomes unavailable.

Validation

• Authorized admin reaches RDP over Tailscale

• Unauthorized Tailscale identity is denied

• Documented non-Tailscale bypass path is denied if that is the design

• TCP 3389 is not exposed publicly

• Windows/Tailscale evidence identifies the successful/denied path

• Console/recovery backout is tested

Troubleshooting

• No RDP over Tailscale: separate Tailscale reachability/policy from Windows firewall/RDP listener/authentication

• Authorized and unauthorized both work: inspect Tailscale grants and Windows firewall scope immediately

• Do not weaken Windows authentication or expose 3389 publicly as a troubleshooting shortcut

Cleanup or Rollback

• Remove disposable test identities/grants

• Restore only the approved ongoing firewall/Tailscale policy

• Keep recovery instructions with the system runbook

Next Improvements

• Monitor access logs for any unauthorized access attempts

• Regularly update Tailscale and Windows systems to the latest versions

• Review and adjust access controls as necessary based on usage