diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c
index 502ea9dad..42843faab 100644
--- a/libfreerdp/core/gateway/rpc_client.c
+++ b/libfreerdp/core/gateway/rpc_client.c
@@ -140,12 +140,14 @@ int rpc_client_on_fragment_received_event(rdpRpc* rpc)
 	else if (header->common.ptype == PTYPE_FAULT)
 	{
 		rpc_recv_fault_pdu(header);
+		Queue_Enqueue(rpc->client->ReceiveQueue, NULL);
 		return -1;
 	}
 
 	if (header->common.ptype != PTYPE_RESPONSE)
 	{
 		fprintf(stderr, "Unexpected RPC PDU type: %d\n", header->common.ptype);
+		Queue_Enqueue(rpc->client->ReceiveQueue, NULL);
 		return -1;
 	}
 
@@ -155,6 +157,7 @@ int rpc_client_on_fragment_received_event(rdpRpc* rpc)
 	if (!rpc_get_stub_data_info(rpc, buffer, &StubOffset, &StubLength))
 	{
 		fprintf(stderr, "rpc_recv_pdu_fragment: expected stub\n");
+		Queue_Enqueue(rpc->client->ReceiveQueue, NULL);
 		return -1;
 	}
 
@@ -301,7 +304,8 @@ int rpc_client_on_read_event(rdpRpc* rpc)
 		Queue_Enqueue(rpc->client->FragmentQueue, rpc->client->RecvFrag);
 		rpc->client->RecvFrag = NULL;
 
-		rpc_client_on_fragment_received_event(rpc);
+		if (rpc_client_on_fragment_received_event(rpc) < 0)
+			return -1;
 	}
 
 	return status;
diff --git a/libfreerdp/core/gateway/tsg.c b/libfreerdp/core/gateway/tsg.c
index b8bbb552c..be891abfa 100644
--- a/libfreerdp/core/gateway/tsg.c
+++ b/libfreerdp/core/gateway/tsg.c
@@ -615,6 +615,13 @@ BOOL TsProxyAuthorizeTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 	packet->packetId = *((UINT32*) &buffer[offset]); /* PacketId */
 	SwitchValue = *((UINT32*) &buffer[offset + 4]); /* SwitchValue */
 
+	if (packet->packetId == E_PROXY_NAP_ACCESSDENIED)
+	{
+		fprintf(stderr, "status: E_PROXY_NAP_ACCESSDENIED (0x%08X)\n", E_PROXY_NAP_ACCESSDENIED);
+		fprintf(stderr, "Ensure that the Gateway Connection Authorization Policy is correct\n");
+		return FALSE;
+	}
+
 	if ((packet->packetId != TSG_PACKET_TYPE_RESPONSE) || (SwitchValue != TSG_PACKET_TYPE_RESPONSE))
 	{
 		fprintf(stderr, "Unexpected PacketId: 0x%08X, Expected TSG_PACKET_TYPE_RESPONSE\n",
@@ -1366,9 +1373,10 @@ BOOL tsg_connect(rdpTsg* tsg, const char* hostname, UINT16 port)
 		return FALSE;
 
 	pdu = rpc_recv_dequeue_pdu(rpc);
-
-	if (!pdu)
+	if (!pdu) {
+		fprintf(stderr, "TsProxyCreateChannel: error reading response\n");
 		return FALSE;
+	}
 
 	call = rpc_client_call_find_by_id(rpc, pdu->CallId);