RDP to a Windows VM on Google Cloud via IAP

You can open a Remote Desktop session to a Windows VM that has no external IP address by tunnelling port 3389 through Identity-Aware Proxy. It takes one firewall rule, one IAM role, and one gcloud command per session; the RDP client then connects to localhost.

1. Prerequisites

A Google Cloud project with billing enabled, and the gcloud CLI installed and initialised (gcloud init).
A Windows Compute Engine VM. An external IP is not required.
An RDP client: Remote Desktop Connection (mstsc) on Windows, Microsoft Remote Desktop on macOS, or Remmina/FreeRDP on Linux.

2. Allow IAP to reach port 3389

gcloud compute firewall-rules create allow-rdp-ingress-from-iap \
  --direction=INGRESS \
  --action=allow \
  --rules=tcp:3389 \
  --source-ranges=35.235.240.0/20 \
  --network=default

35.235.240.0/20 is the range IAP uses for TCP forwarding; it is the only source that will ever reach 3389. Add --target-tags=rdp-via-iap and tag the VM if you want the rule limited to specific instances.

3. Grant the tunnel role

For a whole project:

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=user:[email protected] \
  --role=roles/iap.tunnelResourceAccessor

To restrict a person to one VM, grant the role on that instance from the console — Security → Identity-Aware Proxy → SSH and TCP Resources — or via the IAP API; see IAM roles for IAP. Groups (--member=group:[email protected]) keep this manageable.

IAP only opens the tunnel; Windows still needs a local account. If you don't have one:

gcloud compute reset-windows-password VM_NAME --zone=ZONE

This creates the account if it doesn't exist and prints a new password. It needs roles/compute.instanceAdmin.v1 (and roles/iam.serviceAccountUser if the VM runs as a service account). Google warns that resetting an existing account's password can lose data encrypted with the old password, and that on a domain controller it may reset domain user passwords — use a dedicated account, or your AD credentials on domain-joined VMs.

5. Open the tunnel

gcloud compute start-iap-tunnel VM_NAME 3389 \
  --local-host-port=localhost:3390 \
  --zone=ZONE

Leave this running. It prints Listening on port [3390] when ready. Any free local port works; 3390 avoids clashing with a local RDP service.

6. Connect with your RDP client

Windows: run mstsc /v:localhost:3390, or type localhost:3390 in Remote Desktop Connection.
macOS: Microsoft Remote Desktop → Add PC → PC name localhost:3390.
Linux: xfreerdp /v:localhost:3390 /u:USERNAME or Remmina with server localhost:3390.

7. Troubleshooting

Symptom	Likely cause → fix
`Error while connecting [4033]`	Missing `roles/iap.tunnelResourceAccessor` on this instance, VM doesn't exist, or it's not running → check IAM on the IAP page; confirm the VM is up.
`Error while connecting [4003]`	Firewall rule missing/wrong port, or nothing listening on 3389 (Remote Desktop disabled on the VM) → verify step 2 and that RDP is enabled in Windows.
`Error while connecting [4047]`	VM stopped or still booting → start it and wait for boot to finish.
Tunnel opens, RDP says credentials are wrong	That's the Windows login, not IAP → reset the password (step 4).
Session drops after a long pause	IAP closes idle sessions after one hour → reconnect.
Very slow screen updates	Install NumPy for gcloud's Python (see TCP forwarding explained); IAP isn't built for bulk transfer.

More codes and causes: IAP troubleshooting.

Common questions

Do I need to open port 3389 to the internet?

No. The firewall rule allows only 35.235.240.0/20 (IAP). Nothing else can reach the port, and the VM doesn't need a public IP.

Can I use a domain account instead of a local one?

Yes — the tunnel doesn't care how Windows authenticates. Skip the password reset and log in with DOMAIN\user as usual.

Can I copy files over the tunnel?

RDP clipboard and drive redirection work as normal, but IAP TCP forwarding "isn't intended for bulk transfer of data" — use Cloud Storage for large files.

Does this work from a Mac or Linux laptop?

Yes; gcloud runs on all three, and any RDP client can connect to localhost:3390.