Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?

Right-click 'My Computer' and then click 'Properties'. Click the 'Remote' tab and then choose 'Allow remote connections to this computer'. Then click the 'OK' button.

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?


Step 2: Open Remote Desktop port (port 3389) in Windows firewall
Go into the control panel in your computer and then into 'System and security' and then into 'Windows Firewall'. Click 'Advanced settings' on the left side. Ensure that 'Inbound Rules' for Remote Desktop is 'Enabled'. Please note that if you are using a firewall other than Windows Firewall on your computer, you must open port 3389 in the firewall.

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?


Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?


Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?


Step 3: Set up Port Forwarding (Port Translation) in the router

Please log into the router website (generally at http://192.168.1.1 or http://192.168.0.1) and go into the 'Port Forwarding' section. Add a new 'Port Forwarding' rule for TCP port 3389 to be forwarded to the internal IP of your computer. To get the internal IP address of the device, you may type ipconfig in "cmd.exe". It is usually in the form of "192.168.1.**".

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?


NOTE: If you need to connect to several machines behind the same router, you should set up port forwarding for all these machines. Let's suppose machine 1 has an internal IP 192.168.1.41, machine 2 has an internal IP 192.168.1.42, and machine 3 has an internal IP 192.168.1.43. We can setup different external ports for different machines as shown in the picture below.

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?


To see if the port forwarding has been setup correctly, you can use our Port Check network tool to see if the corresponding port is open. If you get a "Success" response from the port check, then your network has been correctly set up.
STEP 4: Map your dynamic IP to a hostname
Internet service providers change your IP address on a regular basis, but with dynamic DNS you can keep your domain pointing at the current IP of your home server or other devices.

You may register a domain name of your own (yourdomain.com) and sign up for Dynu Dynamic DNS Service for it or use a free Dynu domain name (yourdomain.dynu.com). You may refer to this Getting started tutorial for more information.

STEP 5: Use Dynu DDNS service to access your computer remotely

Download the appropriate client software and run it in the computer to keep the hostname mapped to your dynamic IP. You may also set up the DDNS service in your router if your router supports it. You should now be able to access your computer using yourhostname.dynu.com from the internet via Remote Desktop using any compatible Remote Desktop client and your domain name.

Which port must be opened in the firewall of a Windows system so that a Remote Desktop connection?


NOTE: In the case of connecting several machines, for machine 1, you can use "yourhostname.dynu.com:3389", for machine 2, you may use "yourhostname.dynu.com:3390", and for machine 3, you may use "yourhostname.dynu.com:3391".

Remote Desktop allows you to access your computer from a different computer. You can open the Remote Desktop port only on your computer to allow it to be accessed only on your local network or open it also on your router to use the computer over the Internet. Before you open the remote desktop port on a router or firewall program, you will need to enable your user account to have Remote Desktop privileges on the computer you want to access.

Open the Port on the Computer

  1. Click "Start," right-click "Computer" and select "Properties." Click "Remote settings." Approve the User Account Control window if it appears.

  2. Click on the circle to the left of "Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)." Click "Select Users..." if you want to enable users other than the current one that you are logged on to your computer with to remotely access the computer. Otherwise, skip to step 4.

  3. Click "Add," type the name of the user you want to enable to use the computer remotely and click "OK" twice.

  4. Click "OK" to save the changes. Click the "Windows" icon on the desktop, type "Firewall" without quotes and click "Allow a program through Windows Firewall."

  5. Scroll down until you find "Remote Desktop" -- not to be confused with "Remote Desktop - RemoteFX" -- in the list of programs that opened. Check the box for "Home/Work (Private)" if it is not already checked. Enabling Remote Desktop should have already done this for you, but this helps ensure that the program will not be blocked by Windows Firewall when you try to access your computer.

  6. Open any other firewall program that you have on your computer. If you do not have an additional firewall program installed, skip to the next step. Enable port number 3389 to be able to pass through your firewall. Refer to the documentation for your firewall program, as the steps are different for each, if you are unsure of how to do this.

Open the Port on the Router

  1. Open your Web browser on the computer on which you have enabled Remote Desktop connections on. Go to the IP address of your router. Enter the user name and password for the router to log on. This information can be found in the router's documentation.

  2. Find a section with a name similar to "Virtual Servers" or "Port forwarding" and open it. Enter the port number 3389 for the internal and external ports. Select the protocol "TCP."

  3. Enter the IP address of the computer that you enabled Remote Desktop connections on. Press the "Windows" and "R" keys simultaneously and release them if you need to find the IP address on the computer. Otherwise, skip to step 5.

  4. Type "cmd" and click "OK." Type "ipconfig" without quotes and press the "Enter" key. Find the value for "IPv4 Address" for the network adapter that connects your computer to the Internet. This is the IP address to use when opening the port on your router.

  5. Find the "WAN" or "Internet" IP on your router's configuration page. Write down this information for later.

  6. Save the changes to the router and then close your Web browser. Click the "Windows" icon from the desktop on a second computer. Type "remote" and click "Remote Desktop Connection."

  7. Type in the Internet IP that you recorded from your router earlier and click "Connect." Enter the username and password for the remote computer and click "OK." A successful connection confirms that the port was opened properly.

Remote Desktop Protocol (RDP) is a Microsoft proprietary protocol that enables remote connections to other computers, typically over TCP port 3389. It provides network access for a remote user over an encrypted channel. Network administrators use RDP to diagnose issues, login to servers, and to perform other remote actions. Remote users use RDP to log into the organization’s network to access email and files.

Cyber threat actors (CTAs) use misconfigured RDP ports that are open to the Internet to gain network access. They are then in a position to potentially move laterally throughout a network, escalate privileges, access and exfiltrate sensitive information, harvest credentials, or deploy a wide variety of malware. This popular attack vector allows CTAs to maintain a low profile since they are utilizing a legitimate network service and provides them with the same functionality as any other remote user. CTAs use tools, such as the Shodan search engine, to scan the Internet for open RDP ports and then use brute force password techniques to access vulnerable networks. Compromised RDP credentials are also widely available for sale on dark web marketplaces.

In 2018, the Multi-State Information Sharing and Analysis Center (MS-ISAC) observed an increase in ransomware variants that strategically target networks through unsecured RDP ports or by brute forcing the password. The ransomware is then manually deployed across the entire compromised network and is associated with higher ransom demands.

Recommendations:

  • Assess the need to have RDP, port 3389, open on systems and, if required:
    • place any system with an open RDP port behind a firewall and require users to VPN in through the firewall;
    • enable strong passwords, multi-factor authentication, and account lockout policies to defend against brute-force attacks;
    • whitelist connections to specific trusted hosts;
    • restrict RDP logins to authorized non-administrator accounts, where possible. Adhere to the Principle of Least Privilege, ensuring that users have the minimum level of access required to accomplish their duties; and
    • log and review RDP login attempts for anomalous activity and retain these logs for a minimum of 90 days. Ensure that only authorized users are accessing this service.
  • If RDP is not required, perform regular checks to ensure RDP ports are secured.
  • Verify cloud environments adhere to best practices, as defined by the cloud service provider. After cloud environment setup is complete, ensure that RDP ports are not enabled unless required for a business purpose.
  • Enable automatic Microsoft Updates to ensure that the latest versions of both the client and server software are running.

The MS-ISAC is the focal point for cyber threat prevention, protection, response, and recovery for the nation’s state, local, tribal, and territorial (SLTT) governments. More information about this topic, as well as 24×7 cybersecurity assistance is available at 866-787-4722, [email protected]. The MS-ISAC is interested in your comments – an anonymous feedback survey is available.