RDP port 3389
The default RDP port is 3389: TCP for the Remote Desktop connection and UDP for the faster transport current clients add. To change it, allow the new port in the firewall, set PortNumber under the RDP-Tcp registry key and restart. A new port reduces bot noise; NLA, IP allow-lists and VPNs provide real protection.
For admins of Windows VPS, RDP and cloud servers who need to move or lock down Remote Desktop safely.
knowledge
- Read time
- 3 min
- Sections
- 6
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What is the default RDP port?
Remote Desktop listens on port 3389 by default — TCP 3389 for the connection, and UDP 3389 for the faster UDP transport that current clients use alongside it. The listener runs on the Windows machine you connect to; your own PC needs only outbound access.
| Port | Protocol | Purpose |
|---|---|---|
| 3389 | TCP | Main Remote Desktop connection (required) |
| 3389 | UDP | UDP transport for smoother screen updates; falls back to TCP if blocked |
| 443 | TCP | RD Gateway, which wraps RDP inside HTTPS |
The protocol itself is explained in what RDP is. This guide covers the listener, the firewall and safer ways to reach a Windows VPS.
Should you change the RDP port on a Windows server?
Changing the port cuts automated password guessing aimed at 3389, but it is noise reduction, not security; access control comes from Network Level Authentication, an IP allow-list or a VPN. Do both if the server faces the internet.
- Bots scan 3389 continuously, so a new server sees login attempts within hours of going online.
- A non-default port removes most of that log noise and account-lockout churn.
- Port scanners still find a moved listener; strong passwords and lockout policies remain essential.
How do you change the RDP port without locking yourself out?
Add firewall rules for the new port first, set PortNumber under the RDP-Tcp registry key, restart, and connect on the new port before closing 3389. Restarting Remote Desktop Services disconnects every session, including yours, so keep the VPS provider's web console open as a way back in.
The example uses 3390; choose any unused port and use the same number throughout. Run PowerShell as administrator:
# 1. Check the current port
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber'
# 2. Allow the new port (Microsoft's example uses the Public profile; use -Profile Any if unsure)
New-NetFirewallRule -DisplayName 'RDP-3390-TCP-In' -Profile Any -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3390
New-NetFirewallRule -DisplayName 'RDP-3390-UDP-In' -Profile Any -Direction Inbound -Action Allow -Protocol UDP -LocalPort 3390
# 3. Change the listening port
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value 3390
# 4. Restart (this ends current RDP sessions)
Restart-Computer- From your PC, confirm the port answers:
Test-NetConnection your-server-ip -Port 3390. - Connect with
your-server-ip:3390in Remote Desktop Connection or Windows App. - Only after a successful login, disable the old inbound rule for 3389.
- If nothing connects, use the provider's console to set
PortNumberback to 3389.
Commands follow Microsoft's change the listening port documentation.
Which firewall rules does the new RDP port need?
Allow the new port inbound on TCP, and UDP if you want the UDP transport, in Windows Defender Firewall and in any provider or network firewall in front of the server. Restrict the rule to your office or home IP whenever that address is stable.
# Limit the TCP rule to one office IP
Set-NetFirewallRule -DisplayName 'RDP-3390-TCP-In' -RemoteAddress 203.0.113.25
# Confirm the server is listening on the new port
Get-NetTCPConnection -LocalPort 3390 -State ListenIf a correct office address is still refused, an older block rule may be dropping it; see unblock an IP address before concluding the port change failed.
How do NLA, an allow-list and a VPN make RDP safer?
Network Level Authentication makes users sign in before a desktop session is created, an allow-list drops every other IP at the firewall, and a VPN keeps RDP off the public internet entirely. Use the strongest option the team can live with.
| Control | What it blocks | Effort |
|---|---|---|
| Network Level Authentication | Unauthenticated sessions consuming server resources | One setting; on by default in current Windows Server |
| Account lockout policy | Unlimited password guessing | Group or local security policy |
| IP allow-list | All traffic except listed addresses | Needs fixed client IPs |
| VPN or RD Gateway | Direct internet exposure of RDP | Extra service to run and maintain |
# Ensure NLA is required (1 = on)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Value 1Also rename or disable the built-in Administrator account and give each person their own login, so access can be removed when someone leaves.
Which WebJi® servers come with RDP access?
WebJi® Windows VPS, RDP VPS and Windows cloud servers all give administrator RDP access, with the port and firewall under your control. Cloud servers start at ₹5,900 a month before 18% GST for 2 vCPU and 8 GB RAM, with Windows Server 2019, 2022 or 2025 images; checkout confirms the current price.
If a firewall change locks you out, email support@webji.services (24/7, Hindi and English, average first reply under 60 minutes) with the server IP and the port you set.
Frequently asked questions
How do I connect to RDP on a custom port?
Add the port after a colon in the computer field, for example 203.0.113.10:3390 or server.example.com:3390. Saved .rdp files need the same change in their "full address" line.
Do I need to open UDP 3389 as well?
It is optional. Without UDP the session still works over TCP, but screen updates can feel slower on high-latency links. If you allow UDP, apply the same IP restrictions you use for TCP.
Which port number should I choose?
Any unused port between 1025 and 65535 that no other service on the server uses. Avoid well-known ports such as 3306 or 8080, and note the number in your password manager with the server details.
Is RDP over the internet safe for a trading or accounting server?
Only with NLA, strong unique passwords, an account lockout policy and, ideally, an IP allow-list or VPN. Servers holding financial or customer data should not expose RDP openly, whatever the port number.
Commands checked against Microsoft Learn on 14 November 2026 · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.