Port 3389 — RDP (TCP)
What is Port 3389?
RDP (Remote Desktop Protocol) is Microsoft's protocol for graphical remote control of Windows systems over port 3389. It provides full desktop access including audio, clipboard, and drive redirection. Exposed port 3389 is a primary ransomware attack vector — operators use brute-force and credential stuffing to gain access. Always use a VPN instead of exposing RDP directly and enable Network Level Authentication (NLA).
This is a registered port (1024–49151) often assigned to vendor or application services like RDP. · No formal RFC; Microsoft RDP protocol
When do you need Port 3389 open?
Open if you need graphical Remote Desktop access to a Windows machine over the network. Highly targeted by automated brute-force attacks — restrict access to known IP addresses or route through a VPN rather than exposing RDP publicly.
Common uses and software
- Windows Remote Desktop Client (mstsc.exe)
- Microsoft Remote Desktop (macOS / iOS / Android)
- FreeRDP
- Remmina (Linux)
- Royal TSX
Security
Exposed RDP is a leading ransomware attack vector. Never expose port 3389 directly to the internet. Use a VPN and connect to RDP through the VPN only. Enable Network Level Authentication (NLA). Apply Windows Updates to patch known RDP vulnerabilities (BlueKeep CVE-2019-0708, DejaBlue). Consider moving to a non-standard port as a minor deterrent against automated scanners.
Is Port 3389 safe?
An open port increases your attack surface. Safety depends on how RDP is configured.
This port is actively targeted by automated attacks. Keep it closed unless RDP is actively required, and restrict access to known IP ranges in your firewall.
Test connectivity for Port 3389 on any host.
How to Open Port 3389
To allow incoming connections to Port 3389 (RDP) from outside your network, configure your firewall and add a port forwarding rule on your router pointing to your device's local IP address.
Open Windows Defender Firewall → Advanced Settings → Inbound Rules → New Rule → Port → TCP → Specific local ports: 3389 → Allow the connection → Name and save the rule.
netsh advfirewall firewall add rule name="Open Port 3389" dir=in action=allow protocol=tcp localport=3389sudo ufw allow 3389/tcpsudo iptables -A INPUT -p tcp --dport 3389 -j ACCEPTLog into your router (192.168.1.1 or 192.168.0.1) → Port Forwarding → Add a new rule: Protocol TCP, External port 3389, Internal IP: your device's local IP, Internal port 3389 → Save.
How to close Port 3389
If you do not need RDP, block this port in your firewall or router.
To block port 3389 on Windows, run the following command in PowerShell or Command Prompt (as Administrator):
netsh advfirewall firewall add rule name="Block Port 3389" dir=in action=block protocol=tcp localport=3389sudo ufw deny 3389/tcpsudo iptables -A INPUT -p tcp --dport 3389 -j DROPRemove or disable any port forwarding rule for Port 3389.
Frequently Asked Questions
What is Port 3389 used for?▾
Port 3389 is the default TCP port for RDP. It is used by servers and applications that need to accept incoming connections for this service. Whether you need it open depends on whether you are actively running a RDP server — if not, it should remain closed to reduce your attack surface.
Is Port 3389 safe to keep open?▾
An open Port 3389 increases your attack surface. If you are not actively running RDP, close this port in your firewall and remove any port forwarding rules. If RDP must be accessible, restrict access to known IP ranges, keep the service software updated with security patches, and use strong authentication.