Run Apache Guacamole in your own AWS account or GCP project and reach Windows desktops over RDP, Linux servers over SSH, and VNC sessions from a web browser. Nothing to install on the user side, and one gateway in front of machines that never need a public IP.
Apache Guacamole is a clientless remote desktop gateway from the Apache Software Foundation, free and open source under the Apache License 2.0. Users sign in to a central server and pick from the machines they have been given, and the session runs in an HTML5 page. It suits IT and DevOps teams that want one controlled entry point to their servers and desktops, and support teams that cannot install software on every laptop.
Nothing to install: a modern web browser is the whole client.
Standard protocols, so the target machines need no agent.
Choose which connections each user or group can open.
SFTP over SSH and VNC, and a virtual drive inside RDP sessions.
Extensions for LDAP, TOTP, Duo, SAML and OpenID Connect.
Graphical recordings and text typescripts of sessions.
A manual install means building guacd, deploying the web application, wiring up authentication and putting a reverse proxy with SSL in front. The AMI ships it ready, so the login page is up when the stack finishes.
Launch the CloudFormation stack from AWS Marketplace, or the deployment form on Google Cloud Marketplace, with your domain and admin password. Allow 5-10 minutes.
Create an A record for your domain with the server's public IP: the PublicIp stack output on AWS, or the VM's external IP on Google Cloud.
Open your Guacamole domain and log in as guacadmin with the admin password you set at launch.
Under Settings, then Connections, add each machine by protocol, address and credentials, and grant it to your users.
An AMI on AWS Marketplace, launched into your own AWS account with a CloudFormation stack.
Launch on AWS 
The same Guacamole gateway as a Google Cloud Marketplace image, with PostgreSQL and an Nginx reverse proxy, deployed into your own GCP project.
Launch on Google Cloud Guacamole connects to each machine from the gateway, so the target only has to accept traffic from the Guacamole instance, not from the internet.
| Protocol | Default port | Typical target |
|---|---|---|
| RDP | 3389 | Windows desktops and servers |
| SSH | 22 | Linux servers and network devices |
| VNC | 5900 | Linux and macOS desktops |
| Telnet | 23 | Legacy devices |
Allow these ports with the Guacamole instance as the source, in the target security group on AWS or a VPC firewall rule on Google Cloud. A closed port is the usual reason a saved connection fails to open.
| Apache Guacamole | Teleport | |
|---|---|---|
| Licence | Apache 2.0, free for any use | Commercial; Community Edition binaries free under 100 employees and US$10M revenue |
| Protocols | RDP, SSH, VNC, Telnet, Kubernetes | SSH, RDP, Kubernetes, databases, MCP servers |
| Client | Web browser only | Web UI and the tsh client |
| SAML and OIDC sign-in | Yes, via extensions | Enterprise only |
| Hosting | Self-hosted | Teleport Cloud or self-hosted |
Teleport details are from its own feature matrix. Teleport feature matrix →
A free, open-source remote desktop gateway from the Apache Software Foundation. Users reach machines over RDP, SSH, VNC and Telnet from a web browser, with no client software or plugin installed.
Yes. It is licensed under the Apache License 2.0, including for business use. You pay for the server and any Meetrix software fee shown on the AWS or Google Cloud listing.
Open your Guacamole domain and log in as guacadmin with the admin password you set at launch, the AdminPassword stack parameter on AWS or the Admin password field in the Google Cloud deployment form. Create separate non-admin users for day-to-day access.
t3a.small on AWS or e2-small on Google Cloud is the recommended starting point. Each active session uses CPU and memory on the gateway, so size up if many people will connect at the same time.
Yes. The image requests a Let's Encrypt certificate for your domain, on AWS automatically when the domain is hosted on Route 53. If that fails, a script on the server generates the certificate manually.
Yes. Point connections at the private IPs of machines in the same or a peered VPC and allow RDP, SSH or VNC from the Guacamole instance, with a security group on AWS or a VPC firewall rule on Google Cloud. Those machines then need no public IP.
Back up your server data, remove the old deployment and launch the new version from AWS Marketplace or Google Cloud Marketplace.
Guacamole is fully open source under Apache 2.0 and needs only a browser. Teleport adds database and MCP server access and a command-line client, but its free Community Edition is limited by company size and SAML and OIDC sign-in are Enterprise features.
We run remote access and self-hosted infrastructure for teams every day, from VPNs to identity providers. Tell us what you need.
Contact us