Apache Guacamole on AWS
An AMI on AWS Marketplace, launched into your own AWS account with a CloudFormation stack.
- Deploys with
- CloudFormation
- Recommended size
- t3a.small
- Ready in
- 5-10 minutes
Setup guides
Launch on AWS Clientless remote desktop gateway
Self-hosted Apache Guacamole on AWS and Google Cloud
Run Apache Guacamole in your own AWS account or GCP project and reach Windows desktops over RDP, Linux servers over SSH, and VNC sessions from a web browser. Nothing to install on the user side, and one gateway in front of machines that never need a public IP.
- Ready in 5-10 minutes
- Apache 2.0 licensed
- RDP, SSH and VNC in the browser
What is Apache Guacamole?
Apache Guacamole is a clientless remote desktop gateway from the Apache Software Foundation, free and open source under the Apache License 2.0. Users sign in to a central server and pick from the machines they have been given, and the session runs in an HTML5 page. It suits IT and DevOps teams that want one controlled entry point to their servers and desktops, and support teams that cannot install software on every laptop.
-
Clientless
Nothing to install: a modern web browser is the whole client.
-
RDP, SSH, VNC and Telnet
Standard protocols, so the target machines need no agent.
-
Per-user access
Choose which connections each user or group can open.
-
File transfer
SFTP over SSH and VNC, and a virtual drive inside RDP sessions.
-
Sign-in options
Extensions for LDAP, TOTP, Duo, SAML and OpenID Connect.
-
Session recording
Graphical recordings and text typescripts of sessions.
What's in the Meetrix Guacamole AMI
A manual install means building guacd, deploying the web application, wiring up authentication and putting a reverse proxy with SSL in front. The AMI ships it ready, so the login page is up when the stack finishes.
- Apache Guacamole 1.6.0 with guacd, running in Docker on Ubuntu
- An nginx reverse proxy in front of the web application
- The guacadmin password set from the stack parameters
- Automatic SSL when your domain is hosted on Route 53
- A CloudFormation template for your own AWS account, with an S3 bucket for backups
- Email support from Meetrix at aws@meetrix.io
- On Google Cloud: PostgreSQL, Let's Encrypt SSL for your domain, and a 5-day free trial
How to set up a self-hosted Guacamole gateway
-
Launch the server
Launch the CloudFormation stack from AWS Marketplace, or the deployment form on Google Cloud Marketplace, with your domain and admin password. Allow 5-10 minutes.
-
Point your domain
Create an A record for your domain with the server's public IP: the PublicIp stack output on AWS, or the VM's external IP on Google Cloud.
-
Sign in
Open your Guacamole domain and log in as guacadmin with the admin password you set at launch.
-
Add connections
Under Settings, then Connections, add each machine by protocol, address and credentials, and grant it to your users.
Choose your cloud
Launch on AWS 
Apache Guacamole on Google Cloud
The same Guacamole gateway as a Google Cloud Marketplace image, with PostgreSQL and an Nginx reverse proxy, deployed into your own GCP project.
- Deploys with
- Marketplace deployment form
- Recommended size
- e2-small
- Free trial
- 5 days, up to USD 50 licence credit
Setup guides
Launch on Google Cloud Protocols and the ports your targets must allow
Guacamole connects to each machine from the gateway, so the target only has to accept traffic from the Guacamole instance, not from the internet.
| Protocol | Default port | Typical target |
|---|---|---|
| RDP | 3389 | Windows desktops and servers |
| SSH | 22 | Linux servers and network devices |
| VNC | 5900 | Linux and macOS desktops |
| Telnet | 23 | Legacy devices |
Allow these ports with the Guacamole instance as the source, in the target security group on AWS or a VPC firewall rule on Google Cloud. A closed port is the usual reason a saved connection fails to open.
Apache Guacamole vs Teleport
| Apache Guacamole | Teleport | |
|---|---|---|
| Licence | Apache 2.0, free for any use | Commercial; Community Edition binaries free under 100 employees and US$10M revenue |
| Protocols | RDP, SSH, VNC, Telnet, Kubernetes | SSH, RDP, Kubernetes, databases, MCP servers |
| Client | Web browser only | Web UI and the tsh client |
| SAML and OIDC sign-in | Yes, via extensions | Enterprise only |
| Hosting | Self-hosted | Teleport Cloud or self-hosted |
Teleport details are from its own feature matrix. Teleport feature matrix →
Apache Guacamole FAQ
What is Apache Guacamole?
A free, open-source remote desktop gateway from the Apache Software Foundation. Users reach machines over RDP, SSH, VNC and Telnet from a web browser, with no client software or plugin installed.
Is Apache Guacamole free?
Yes. It is licensed under the Apache License 2.0, including for business use. You pay for the server and any Meetrix software fee shown on the AWS or Google Cloud listing.
How do I sign in the first time?
Open your Guacamole domain and log in as guacadmin with the admin password you set at launch, the AdminPassword stack parameter on AWS or the Admin password field in the Google Cloud deployment form. Create separate non-admin users for day-to-day access.
Which instance size should I choose?
t3a.small on AWS or e2-small on Google Cloud is the recommended starting point. Each active session uses CPU and memory on the gateway, so size up if many people will connect at the same time.
Does it set up SSL?
Yes. The image requests a Let's Encrypt certificate for your domain, on AWS automatically when the domain is hosted on Route 53. If that fails, a script on the server generates the certificate manually.
Can I use Guacamole as a bastion host?
Yes. Point connections at the private IPs of machines in the same or a peered VPC and allow RDP, SSH or VNC from the Guacamole instance, with a security group on AWS or a VPC firewall rule on Google Cloud. Those machines then need no public IP.
How do I upgrade?
Back up your server data, remove the old deployment and launch the new version from AWS Marketplace or Google Cloud Marketplace.
How does Guacamole compare with Teleport?
Guacamole is fully open source under Apache 2.0 and needs only a browser. Teleport adds database and MCP server access and a command-line client, but its free Community Edition is limited by company size and SAML and OIDC sign-in are Enterprise features.
Need a hand with Guacamole?
We run remote access and self-hosted infrastructure for teams every day, from VPNs to identity providers. Tell us what you need.
Contact us