| Port | 3389 |
|---|---|
| Transport | TCP |
| Service | RDP — Windows Remote Desktop |
| Category | Remote access |
| Range | registered (1024–49151) |
| Encrypted | Yes, always (TLS or equivalent) |
| Exposure | Private network or VPN only |
Port 3389 RDP · TCP
RDP: Windows Remote Desktop. Encrypted and, with Network Level Authentication, reasonably robust, but it has had critical unauthenticated bugs (BlueKeep, 2019) and is the most common initial access vector for ransomware after phishing, through brute-forced or leaked passwords.
What runs on port 3389
RDP: Windows Remote Desktop. Encrypted and, with Network Level Authentication, reasonably robust, but it has had critical unauthenticated bugs (BlueKeep, 2019) and is the most common initial access vector for ransomware after phishing, through brute-forced or leaked passwords. The right answer for remote access is a VPN, a gateway (RD Gateway on 443) or a zero-trust proxy, never a forwarded 3389.
Software that uses it: Windows Remote Desktop Services · xrdp (Linux) · FreeRDP, Remmina, mstsc (clients) · RD Gateway
Should port 3389 be open?
Private network or VPN only. Nothing good comes from this port being reachable from the internet. Keep it on an internal network, reach it over a VPN or an SSH tunnel, and firewall it from everything that does not need it.
- If you must expose it: NLA on, account lockout policy, 2FA via a gateway, and change the port only to reduce noise.
- UDP 3389 is used for better performance since Windows 8; allow it alongside TCP.
Check port 3389
# on the host: is anything listening, and which process? ss -ltnp 'sport = :3389' sudo lsof -i :3389 # from another machine: is it reachable? nc -zv host 3389 nmap -p 3389 host curl -v telnet://host:3389 # raw TCP connect test, Ctrl-C to leave
A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.
Allow or block port 3389
# ufw (Ubuntu/Debian) sudo ufw allow from 10.0.0.0/8 to any port 3389 proto tcp sudo ufw deny 3389/tcp # nftables nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 3389 accept nft add rule inet filter input tcp dport 3389 drop # iptables (legacy) iptables -A INPUT -p tcp --dport 3389 -s 10.0.0.0/8 -j ACCEPT iptables -A INPUT -p tcp --dport 3389 -j DROP # firewalld sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=3389 protocol=tcp accept'
Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 3389" with no source is just "open".
Related ports
Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.
Questions
Is port 3389 TCP or UDP?
TCP. RDP is a connection-oriented protocol; there is no UDP service on 3389 by default (a scanner reporting UDP 3389 open is usually seeing a filtered port).
Is port 3389 encrypted?
Yes, always (TLS or equivalent). The port number does not make it safe by itself: certificate validation, authentication and patching still decide.
How do I check whether port 3389 is open?
On the server, ss -ltnp (or -lunp for UDP) shows whether something listens on 3389 and which process. From another machine, nc -zv host 3389 or nmap -p 3389 host tests reachability. "Open" in a scan means something answered; a firewall usually makes the port filtered (no answer) rather than closed (RST).
Can RDP run on a different port?
Yes; the number is a convention, not a requirement. Changing it reduces log noise from scanners but does not add security, and every client, firewall rule and monitoring check then needs the new number. Keep the default unless you have a concrete reason.