FreeRDP

Last reviewed Aug 26, 2026 · 808 words

You have almost certainly used FreeRDP without knowing it. Apache Guacamole's guacd links against libfreerdp for every RDP session it brokers, Remmina's RDP plugin is FreeRDP, and most Linux "remote desktop" apps that can open a Windows machine are wrapping the same C library. So the useful way to think about FreeRDP is not as a product you install but as three things a self-hoster touches: a command-line client, the engine behind your browser-based remote desktop, and occasionally a server for sharing a Linux session.

The client command that actually works

Distributions package the client as xfreerdp (X11) or wlfreerdp (Wayland); FreeRDP 3 packages on some distros name it xfreerdp3. The options that matter for a Windows desktop on your LAN:

xfreerdp /v:win-desktop.lan /u:aidan /dynamic-resolution /clipboard \
  /sound:sys:pulse +auto-reconnect /cert:tofu

/dynamic-resolution resizes the remote session when you resize the window, /clipboard and /sound redirect what you expect, +auto-reconnect survives a Wi-Fi blip, and /cert:tofu trusts the machine's self-signed certificate on first use and complains if it changes later. Add /d:DOMAIN for a domain-joined machine and /drive:home,/home/aidan to expose a local folder inside the session. Windows Home editions do not include the RDP server, so the target must be Pro, Enterprise, or a Windows Server; FreeRDP cannot fix that.

To go through a Microsoft Remote Desktop Gateway, add /g:rdgw.example.com with /gu: and /gp: for the gateway credentials. That is the "gateway" case this page's slug refers to, and it is the setup most small businesses have when a self-hoster is asked to "make the office PC reachable".

It is the engine inside Guacamole

When Guacamole has an RDP quirk, it is usually a FreeRDP quirk. The 2018 CredSSP fix (CVE-2018-0886) is the classic example: Windows started rejecting clients that had not been patched, and Guacamole users with an old guacd build could not connect until FreeRDP was updated underneath. The lesson is that the version of guacd matters as much as the version of the Guacamole web app, and the official Docker image is the least painful way to keep them aligned. Network Level Authentication, RemoteApp, audio redirection, and the graphics pipeline that makes Guacamole usable over a slow link are all FreeRDP features surfacing through a web page.

Never put 3389 on the internet

RDP on a public port collects brute-force attempts within minutes and has had enough protocol-level holes over the years that exposure is not a defensible choice even with a strong password. Three patterns work. Put the Windows box on Tailscale or a WireGuard network and connect to its private address. Run Guacamole behind a reverse proxy with SSO and let it hold the RDP credentials. Or use an RD Gateway, which tunnels RDP over HTTPS with proper authentication in front. The remote access three ways post weighs those against each other; for one person and a couple of machines, the VPN route wins on effort.

Sharing a Linux desktop is possible but not its strength

FreeRDP ships freerdp-shadow-cli, a server that shares your current X session to any RDP client, and a sfreerdp sample server. Both work for a quick demo. For a headless Linux machine you want to reach every day, xrdp (which itself borrows from FreeRDP) or RustDesk are what people actually run, because they handle session creation, logins, and reconnects as a product rather than a sample. The 128 MB RAM figure in the catalogue is a client-side number; server-side memory is whatever the desktop session costs.

What it is not

It is not a web client on its own; that is Guacamole's job. It is not a server for Windows; Windows has one built in. It is not the tool for Linux-to-Linux day-to-day use, where VNC-based or RustDesk's own protocol are simpler. And it is not something you upgrade by itself on most systems; you get the version your distribution or your Guacamole image chose, which is why "which FreeRDP is guacd using" is a question worth asking when something breaks. The wider remote access category covers the products built on top of it.

What I'd do

Use xfreerdp from a Linux laptop to reach Windows machines over Tailscale, with the command above saved as a shell alias per machine. For anything that needs to be reachable from a browser or shared with other people, run Guacamole from the official image and keep it updated so the FreeRDP inside it stays current. Never open 3389, and treat FreeRDP itself as infrastructure you check the version of rather than an app you administer.