FWIW, we use our Firewall to limit RDP access to trusted IP addresses.