Why is exposing port 3389 dangerous?

Public-facing RDP servers are constantly targeted by ransomware groups using automated brute-force attacks and unpatched remote code execution vulnerabilities.

How can I secure RDP on my server?

Require Network Level Authentication (NLA), change the default port, enforce strong multi-factor authentication (MFA), and require VPN access before connecting.

How can I test if port 3389 is exposed?

Test your external IP with our Open Port Checker to confirm whether port 3389 is visible from the public internet.

Home/Open Port Checker/Port 3389

Port 3306 Port 5432

Registered Port Reference

Port 3389: RDP (Remote Desktop Protocol) (TCP/UDP)

Microsoft Remote Desktop Protocol providing graphical desktop access and administration for Windows systems.

Port Number

3389

Transport

TCP/UDP

Security Risk

Critical

Standard / RFC

MS-RDPBCGR

Test Port 3389 Reachability Live

Verify whether Port 3389 is open, closed, or filtered on your server or public IP address.

Loading port checker...

Service Architecture & Function

Port 3389 is the default listening port for Microsoft Remote Desktop Services (RDP). It transmits display graphics, mouse clicks, keyboard strokes, audio, and clipboard contents between client computers and remote Windows servers.

Security Profile & Hardening

Publicly accessible RDP ports are prime targets for ransomware gangs and automated credential stuffing campaigns. High-profile vulnerabilities like BlueKeep (CVE-2019-0708) allow remote code execution over unauthenticated RDP. Never expose port 3389 directly; always place RDP behind a VPN, Remote Desktop Gateway, or Cloudflare Access tunnel.

Example Firewall Commands:

# UFW (Ubuntu/Debian)

sudo ufw allow from 10.0.0.0/8 to any port 3389 proto tcp

# iptables (Direct Kernel)

iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 3389 -j ACCEPT