Port reference
Port 3389 (TCP/UDP) – RDP
Microsoft Remote Desktop Protocol — graphical remote access to Windows hosts.
Quick facts
- Transport
- tcp, udp
- Category
- Well-known
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on Windows Server and Pro/Enterprise workstations once Remote Desktop is enabled. Often exposed directly to the internet on misconfigured hosts.
What is port 3389 used for?
Port 3389 is the default port for Microsoft's Remote Desktop Protocol (RDP), the graphical remote-access feature built into Windows. It lets you connect to and control another Windows PC or server's full desktop over the network. The Windows Remote Desktop Connection app (mstsc.exe) uses it, as do clients like Microsoft Remote Desktop, FreeRDP, and Remmina on macOS and Linux.
When would you open it?
Open or forward port 3389 when you need to reach a Windows machine remotely — for example to manage a server, work from home on an office PC, or administer a cloud VM. Only open it if you are actually running Remote Desktop on that host.
Is it safe to open?
RDP is a top target for password-guessing and ransomware, so exposing it directly to the internet is risky. Keep it behind a VPN or Remote Desktop Gateway and require Network Level Authentication and MFA. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3389
nmap -p 3389 <target>netstat -ano | findstr :3389
Test-NetConnection <host> -Port 3389lsof -i :3389
nmap -p 3389 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3389 to your device's local IP, internal port 3389, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3389/tcpsudo firewall-cmd --permanent --add-port=3389/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3389 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3389" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying
- BlueKeep pre-auth RCE (CVE-2019-0708)
- DejaBlue RCE chain (CVE-2019-1181/1182)
- Man-in-the-middle on RDP sessions without NLA
Hardening
- Require Network Level Authentication (NLA)
- Never expose 3389 to the internet — gate behind VPN or an RD Gateway
- Enforce MFA and strong, locked-out passwords
- Restrict access by IP allowlist and account lockout policy
- Patch promptly; BlueKeep-class bugs are wormable
How to block this port
sudo ufw deny 3389/tcpsudo firewall-cmd --permanent --remove-port=3389/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3389 -j DROPNew-NetFirewallRule -DisplayName "Block 3389" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Blocknmap snippet
nmap -p3389 --script rdp-enum-encryption,rdp-ntlm-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is port 3389 dangerous?
- Exposed RDP is one of the most common ransomware entry vectors. It's safe only behind a VPN/gateway with NLA, MFA, and account lockout enabled.
- Does RDP use TCP or UDP?
- Both. RDP primarily uses TCP 3389; modern clients also use UDP 3389 for a faster transport, falling back to TCP.