Backend

A Fixed Public Entry for Windows RDP Using Natapp's TCP Tunnel

By 一只牛博 · Aug 17, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Many corporate Windows machines sit behind NAT without a public IP, and third-party remote desktop tools add client maintenance, login friction, or subscription limits. This approach keeps the native RDP stack and adds only a lightweight, pay-per-use tunnel agent, giving a fixed address for under $2/month plus negligible traffic costs for light sessions.

Summary

Windows Remote Desktop stays intact; only the Natapp client runs on the office machine, forwarding local port 3389 to a fixed public hostname and port. External Mac, Windows, and phone clients connect to that address with their built-in RDP tools, so files and applications remain on the office PC without opening per-app ports. The VIP2 plan costs 10 RMB/month base plus 1.1 RMB/GB of traffic, making it viable for occasional access where a free tunnel's changing address would be a hassle. Setup requires confirming RDP listens locally, creating a TCP tunnel in the Natapp console, installing the client as a Windows system service for persistence across reboots, and layering an access token on top of Windows credentials to harden the public entry point. A step-by-step troubleshooting sequence isolates failures by checking local RDP, tunnel status, address correctness, token verification, and sleep state in order.

Takeaways

— Windows 10/11 Home cannot act as an RDP host; Pro, Enterprise, Education, or Server is required.

— Run Test-NetConnection 127.0.0.1 -Port 3389 on the office PC to confirm RDP is listening before configuring any tunnel.

— Natapp's VIP2 plan provides a fixed TCP address and port for 10 RMB/month plus 1.1 RMB/GB of traffic, with a 100 Mbps bandwidth cap.

— The public port assigned by Natapp does not need to match the local 3389 port, and no router changes are needed.

— Install the Natapp client as a Windows system service so the tunnel survives reboots without a logged-in user; the machine must still disable automatic sleep.

— An access token in Natapp adds a second authentication layer: the connecting IP must first verify via a browser before RDP credentials are accepted, and the whitelist expires after 24 hours.

— External clients connect to the full public_hostname:public_port address, not to localhost:3389.

— Troubleshoot connection failures in order: local RDP, Natapp tunnel status, correct address on the client, token verification, Windows credentials and NLA, and finally the machine's sleep state.

Conclusions

Keeping the native Windows RDP stack and tunneling only the network layer avoids the client-compatibility and licensing headaches that come with TeamViewer-style alternatives.

Pay-per-gigabyte pricing flips the economics for remote desktop that sits idle most of the day; a month of light daily use can cost under $2 total.

Requiring a browser-based token verification before RDP authentication even begins is a pragmatic, low-effort way to block scanners and brute-force attempts on a public TCP port without running a VPN.

Concepts & terms

Natapp TCP Tunnel

A Chinese tunneling service that exposes a local TCP port to the public internet through a fixed domain and port, similar to ngrok. Paid plans offer persistent addresses; free tunnels provide random, changing addresses.

Network Level Authentication (NLA)

A Windows Remote Desktop security feature that requires the connecting user to authenticate before a full RDP session is established, reducing resource consumption and the attack surface on the host.

Natapp Access Token

A secondary authentication mechanism where a connecting IP must first visit the tunnel's public address in a browser and submit a secret token. The IP is then whitelisted for 24 hours, after which RDP credentials can be used.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗