Port 3389: RDP

What uses port 3389

Remote Desktop connects to Windows machines on TCP 3389, with UDP 3389 used for better performance on newer clients. RDP exposed to the internet is the most common entry point for ransomware: attackers guess weak passwords or exploit vulnerabilities such as BlueKeep. Put it behind a VPN, Remote Desktop Gateway (443) or a zero-trust access service.

Should port 3389 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

• Enable Network Level Authentication (NLA), account lockout and multi-factor authentication. Changing the port doesn’t stop scanners for long.

Check what is listening on port 3389

sudo ss -ltnp 'sport = :3389'
sudo ss -lunp 'sport = :3389'

sudo lsof -nP -iTCP:3389 -sTCP:LISTEN
sudo lsof -nP -iUDP:3389

Get-NetTCPConnection -LocalPort 3389 -State Listen
Get-NetUDPEndpoint -LocalPort 3389
netstat -ano | findstr :3389

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 3389

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:3389 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 3389 -State Listen).OwningProcess

Allow port 3389 from trusted networks only

The examples allow 3389 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 3389 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 3389 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 3389 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="3389" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="3389" protocol="udp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "RDP 3389/TCP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "RDP 3389/UDP" -Direction Inbound -Protocol UDP -LocalPort 3389 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 3389 from another machine

nc -zv example.com 3389

Test-NetConnection example.com -Port 3389

Related ports

• Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.
• Port 5900 (VNC): used by VNC for remote desktop access.
• Port 445 (SMB): used by SMB for Windows file and printer sharing.
• Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.

More remote access ports

23 (Telnet) , 1194 (OpenVPN) , 2222 (SSH (alternate)) , 5985 (WinRM (HTTP)) , 5986 (WinRM (HTTPS)) , 51820 (WireGuard) . See all ports in the port lookup.

Sources

• IANA port registry: 3389

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions