Port 3389 (RDP (Remote Desktop))

Microsoft Remote Desktop Protocol for Windows desktops and servers. UDP 3389 is used as a faster transport alongside TCP.

Registered (user) port, 1024-49151 TCPUDP Remote access Expose only to trusted sources

What port 3389 is used for

Microsoft Remote Desktop Protocol for Windows desktops and servers. UDP 3389 is used as a faster transport alongside TCP.

Security: should port 3389 be open?

Expose only to trusted sources. Do not expose RDP directly to the internet. It is a top ransomware entry point through password spraying and past bugs such as BlueKeep (CVE-2019-0708). Put it behind a VPN or Remote Desktop Gateway, require Network Level Authentication and MFA, and lock out repeated failures.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ms-wbt-server TCP MS WBT Server Jordan Marchese -

ms-wbt-server UDP MS WBT Server Jordan Marchese -

Registry dates for this port: last modified 2022-11-03.

Check what is listening on port 3389

Linux: is anything listening on TCP 3389?

sudo ss -tlnp 'sport = :3389'

Linux: UDP 3389

sudo ss -ulnp 'sport = :3389'

Linux / macOS: which process owns the port

sudo lsof -nP -i :3389

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':3389 '

Windows (Command Prompt)

netstat -ano | findstr :3389

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 3389 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 3389

From Windows

Test-NetConnection HOST -Port 3389

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 3389

Allow only trusted sources on port 3389 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 3389 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 3389 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3389 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 3389 accept
sudo nft add rule inet filter input tcp dport 3389 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 3389 trusted' -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.10 -Action Allow