What port 3389 is
Port 3389 is the default port of the Remote Desktop Protocol (RDP), which Windows uses for Remote Desktop and Remote Desktop Services. The session runs over TCP 3389, and newer clients and servers also use UDP 3389 for a faster transport when it is reachable, falling back to TCP otherwise. Connections are encrypted with TLS, and Network Level Authentication (NLA) makes the user log in before a full session is created. Some non-Windows servers, such as xrdp on Linux, use the same port.
Should it be open to the internet?
No. Exposed RDP is one of the most common ways attackers get into networks: bots guess passwords around the clock, and serious bugs such as BlueKeep (CVE-2019-0708) let unpatched hosts be taken over without a password. Safer options:
- A VPN or zero trust network access, and RDP only on the internal network.
- A Remote Desktop Gateway, which wraps RDP in HTTPS on port 443 and can require MFA.
- An SSH tunnel through a bastion host.
- At minimum, a firewall rule that allows only known source addresses.
Firewall rules
In PowerShell, replace the broad built-in rule with one for your office range:
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"
New-NetFirewallRule -DisplayName "RDP from office" -Direction Inbound `
-Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.0/24 -Action Allow
New-NetFirewallRule -DisplayName "RDP UDP from office" -Direction Inbound `
-Protocol UDP -LocalPort 3389 -RemoteAddress 203.0.113.0/24 -Action Allow
On a Linux host running xrdp:
sudo ufw allow from 203.0.113.0/24 to any port 3389 proto tcp
In a cloud provider, do the same in the security group or network firewall, and remove any rule that allows 3389 from 0.0.0.0/0.
Changing the port
You can move RDP by changing the PortNumber value (DWORD) under:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
Open the new port in the firewall before restarting, then connect with mstsc /v:host.example.com:3390. This cuts down log noise from bots but does not stop a targeted scan. Treat it as cosmetic, not as protection.
How to check what is listening
netstat -ano | findstr :3389
Get-Service TermService
Test-NetConnection host.example.com -Port 3389
From Linux or macOS: nc -zv host.example.com 3389.
Security notes
- Keep NLA enabled (System Properties, Remote tab, "Allow connections only from computers running Remote Desktop with Network Level Authentication").
- Set an account lockout policy so password guessing locks accounts quickly, and rename or disable the built-in Administrator account.
- Limit who can log in through the "Remote Desktop Users" group.
- Patch promptly; RDP bugs are exploited quickly after disclosure.
- Watch the Security event log for event ID 4625 (failed logon) to spot guessing.
Related ports
- Port 22: SSH, the usual way to reach Linux servers.
- Port 1433: SQL Server, often on the same Windows hosts.
- Port 23: Telnet, another remote access port that should stay closed.
Check whether a server answers on 3389 from the public internet with the Port Scanner.