When you configure Windows virtual machine-based desktops to be accessible through a NAT and port mapping device on the same external IP address, you must give each desktop a unique set of port numbers. The clients can then use the same destination IP address, but use a unique TCP port number for the HTTPS connection to direct the connection to a specific virtual desktop.
For example, HTTPS port 1000 directs to one desktop and HTTPS port 1005 directs to another, with both using the same destination IP address. In this case, configuring unique external port numbers for every desktop for the desktop protocol connections would be too complex. For this reason, the plugin settings externalPCoIPPort,externalRDPPort, and externalFrameworkChannelPort can take an optional relational expression instead of a static value to define a port number relative to the base HTTPS port number used by the client.
If the port mapping device uses port number 1000 for HTTPS, mapped to TCP 443; port number 1001 for RDP, mapped to TCP 3389; port number 1002 for PCoIP, mapped to TCP and UDP 4172; and port number 1003 for the framework channel, mapped to TCP 32111, to simplify configuration, the external port numbers can be configured to be externalRDPPort=+1, externalPCoIPPort=+2 and externalFrameworkChannelPort=+3. When the HTTPS connection comes in from a client that used an HTTPS destination port number of 1000, the external port numbers would automatically be calculated relative to this port number of 1000 and would use 1001, 1002 and 1003 respectively.
To deploy another virtual desktop, if the port mapping device used port number 1005 for HTTPS, mapped to TCP 443; port number 1006 for RDP, mapped to TCP 3389; port number 1007 for PCoIP, mapped to TCP and UDP 4172; and port number 1008 for the framework channel, mapped to TCP 32111, with exactly the same external port configuration on the desktop (+1, +2, +3, and so on) when the HTTPS connection comes in from a client that used an HTTPS destination port number of 1005, the external port numbers would automatically be calculated relative to this port number of 1005 and use 1006, 1007, and 1008 respectively.
This scheme allows all desktops to be identically configured and yet all share the same external IP address. Allocating port numbers in increments of five (1000, 1005, 1010 …) for the base HTTPS port number would therefore allow over 12,000 virtual desktops to be accessed on the same IP address. The base port number is used to determine the virtual desktop to route the connection to, based on the port mapping device configuration. For an externalIPAddress=10.20.30.40, externalRDPPort=+1, externalPCoIPPort=+2 and externalFrameworkChannelPort=+3 configured on all virtual desktops, the mapping to virtual desktops would be as described in the NAT and port mapping table.
| VM# | Desktop IP Address | HTTPS | RDP | PCOIP (TCP and UDP) | Framework Channel |
|---|---|---|---|---|---|
| 0 | 192.168.0.0 | 10.20.30.40:1000 -> 192.168.0.0:443 | 10.20.30.40:1001 -> 192.168.0.0:3389 | 10.20.30.40:1002 -> 192.168.0.0:4172 | 10.20.30.40:1003 -> 192.168.0.0:32111 |
| 1 | 192.168.0.1 | 10.20.30.40:1005 -> 192.168.0.1:443 | 10.20.30.40:1006 -> 192.168.0.1:3389 | 10.20.30.40:1007 -> 192.168.0.1:4172 | 10.20.30.40:1008 -> 192.168.0.1:32111 |
| 2 | 192.168.0.2 | 10.20.30.40:1010 -> 192.168.0.2:443 | 10.20.30.40:1011 -> 192.168.0.2:3389 | 10.20.30.40:1012 -> 192.168.0.2:4172 | 10.20.30.40:1013 -> 192.168.0.2:32111 |
| 3 | 192.168.0.3 | 10.20.30.40:1015 -> 192.168.0.3:443 | 10.20.30.40:1016 -> 192.168.0.3:3389 | 10.20.30.40:1017 -> 192.168.0.3:4172 | 10.20.30.40:1018 -> 192.168.0.3:32111 |
In this example, Horizon Client connects to IP address 10.20.30.40 and an HTTPS destination port number of (1000 + n * 5) where n is the desktop number. To connect to desktop 3, the client would connect to 10.20.30.40:1015. This addressing scheme significantly simplifies the configuration setup for each desktop. All desktops are configured with identical external address and port configurations. The NAT and port mapping configuration is done within the NAT and port mapping device with this consistent pattern, and all desktops can be accessed on a single public IP address. The client would typically use a single public DNS name that resolves to this IP address.
