The scope of this article is to outline the configuration required to prevent users from using their MSTSC client and get loadbalanced to one of the backend RDS Servers configured within your farm.
In general, if a 2X Client Secure Gateway is configured to listen for incoming 2X Connections over Port 80, a user would be able to connect to it via MSTSC over port 80.
Right out of the box, Remote Application Server will loadbalance MSTSC connections to backend RDS Servers.
This is dictated by Tunnelling Policies which are set to tunnel to all servers in the site automatically.
To change this behavior, one would need to make the following changes to the Remote Application Server Console
-Open the 2X Console > Farm > Gateways > Tunnelling Policies tab -Change the option from All Servers in Site to None