RDP Into a Proxmox VM Without Opening It Up to the Network

I run an Ubuntu Desktop VM on my Proxmox server and wanted to RDP into it without exposing port 3389 to my whole network. What i ended up with: tunnel RDP through SSH.

The Idea

I already trust my SSH connection to the Proxmox host. So instead of opening RDP up directly, I have SSH secretly carry the RDP traffic for me:

[Laptop] --localhost:3389--> [SSH tunnel] --> [Proxmox host] --3389--> [VM]

My RDP client just connects to localhost:3389 like normal. It has no idea SSH is quietly relaying that traffic all the way to the VM.

Setup

VM side: install and run xrdp like usual.

Laptop side, add this to ~/.ssh/config:

Host proxmox-rdp
    HostName <proxmox-host-ip>
    User <your-user>
    LocalForward 3389 <VM_IP>:3389

That LocalForward line forwards local port 3389 to the VM's port 3389.

Connecting

1.Start the VM in Proxmox.
2.Open the tunnel(ran on my client):

   ssh proxmox-rdp -N

(-N = just forward the port. It'll look frozen. That's normal, just leave it open.)

3.RDP to localhost:3389.

Close that terminal, tunnel's gone, RDP stops working.

Why Bother

Only SSH needs to be exposed, not RDP. All the traffic rides inside SSH's encryption.

Watch Out For

If the VM's IP is DHCP and changes after a reboot, the LocalForward line goes stale. Set a static IP or DHCP reservation to avoid this.