149

What port(s) should I open/NAT to allow me to use Remote Desktop?

2
  • What ports should I open for remote desktop - Answer: None. Opening RDC to the Internet is a BAD IDEA. Port scanners will pick up an open 3389 pretty quickly and try to break your logon. grc.com/port_3389.htm
    – Alan
    Jul 14, 2017 at 5:33
  • Fair enough, but opening the port to a specific IP address is not bad practice at all.OP did not specify that opening to the general public was the intention. Feb 7, 2018 at 17:04

8 Answers 8

190

Remote Desktop requires TCP port 3389 to be open. Also, opening UDP port 3389 enables acceleration since RDP 8.0.

It is possible to change the port used by the terminal server (or PC which is accessed), see this Microsoft support article: How to change the listening port for Remote Desktop. The UDP port for accelerated connection uses the same port number as the TCP setting and cannot be changed separately.

UDP acceleration is available since RDP 8.0 (shipped with Windows 8 and Windows Server 2012, available via an update on Windows 7 / Windows Server 2008 R2).

8
  • 11
    You can also have a different port if you use port forwarding. The private port is 3389 as said above unless you change it, and the public port can be whatever. I have mine set to 10000, so when I connect using Remote Desktop Connection, I have to enter mycomputer.com:10000
    – Joseph
    May 25, 2009 at 18:47
  • 2
    Updated link to MS support article: support.microsoft.com/en-us/help/306759. For reference, the registry key is HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber.
    – Mark Berry
    Oct 29, 2018 at 18:04
  • @MarkBerry It says RDP tcp... should i not block 3389 on udp? Jul 5, 2019 at 10:22
  • @deadManN - Most firewalls and routers block all inbound ports unless you open them, so if you have that as a default rule, for RDP, you only need to add an exception for TCP 3389.
    – Mark Berry
    Jul 6, 2019 at 15:28
  • Note that RDP, especially on the default port 3389, is increasingly a target for hacking, e.g. by GoldBrute. Also, there have been two RDP vulnerabilities disclosed in the last two months: CVE-2019-0708 and CVE-2019-9510. Patch, don't use RDP, or use 2FA for RDP.
    – Mark Berry
    Jul 6, 2019 at 15:47
16

In addition to opening port 3389 for UDP and TCP, I had to go edit the windows firewall rule and set Edge traversal to allow. Like this:

enter image description here

3
  • Which version of Windows is this and how did you get there?
    – Brian Z
    Dec 9, 2018 at 18:30
  • 4
    @BrianZ This is Windows 7/8/10 and to get there, just open Start Menu search for "Firewall" and click on "Advanced Settings" on the left-side panel, click on Inbound Rules on left-side panel and on the main panel find Remote Desktop - User Mode (TCP-In) and Remote Desktop - User Mode (UDP-In) and Allow edge traversal for both of them.
    – Shayan
    Jan 3, 2019 at 19:15
  • 1
    It works for me without this setthing, why do you thin this is necessary?
    – nights
    Mar 12, 2019 at 11:02
10

If you don't want to use 3389 externally, open a different port externally, but point it to 3389 on the IP address of the machine you want RDC on. This is helpful for routing many systems with RDC. It's also nice because it won't require any registry edits.

1
  • This should be the accepted answer. You should never advertise 3389, and you will need a different port for each instance behind NAT anyway.
    – mckenzm
    Apr 10, 2022 at 21:32
7

The only exception to the previous answer (3389) is when using Small Business Server through Remote Web Workplace.

In this case the server NAT's the connection between you and server port 80 (HTTP) or 443 (HTTPS), and then to the internal computer; so only 80/443 is required.

4

You should open TCP and UDP 3389 (unless you specified a custom port).

While the accepted answer (only TCP 3389) used to be correct at the time, it is no longer up to date. In 2012 Microsoft introduced UDP transport of RDP. Depending on your network this can drastically improve performance of your RDP session. See this link by Microsoft for a much more detailed explanation: https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/RemoteFX-for-WAN-Overview-of-Intelligent-and-Adaptive-Transports/ba-p/247478

2

If security is concerned and you happen to have an Linux based router(e.g. OpenWrt), then don't add any NAT entry, for 3389 in this case.

Use your router as a jump server and create a SSH port forward.

  1. Your router's sshd listens on 22 port for LAN network.
  2. it also listens on port A for WAN network(the only one exposed), with only public-key authentication, so no brute force password attempts.
  3. create public/private key pair, put the private one on your client devices, copy the public one onto your router (into the authorized_keys file)
  4. establish the tunnel from your client devices: ssh -p [port A] -L:[port B]:RDP-box:3389 root@router (you can save this in SSH config or Terminal profiles for ease use in the future)
  5. connect RDP from localhost:[port B]
0

we can set custom RDP port numbers using following path >> HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

0

By default, Remote Desktop Protocol uses port 3389. However, you can change it to use a non-standard port.

Please refer to the following article for this.

https://manage.accuwebhosting.com/knowledgebase/933/How-to-change-the-default-RDP-Remote-Desktop-listening-port-on-your-Windows-VPS.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .