You decide which services we may enable for analytics, personalization, and external content.
We use cookies and similar technologies on our website to personalize content, embed external media, and better understand how individual areas are used.
Necessary cookies
These entries support essential functions such as security, stability, and form processing.
Optional sections
Your data may be processed with your consent or on the basis of legitimate interests. In the cookie settings, you can reject or explicitly allow each optional category.
Some services process personal data in third countries. By consenting, you also agree to this transfer. You can find more information in our Privacy Policy.
You can reopen and change your selection at any time. · 1.0.2
Port 3389 is the default port for Microsoft’s Remote Desktop Protocol (RDP). Here you’ll find key details about the port and firewall commands to restrict access selectively.
Built by Justin Schuessler
Try the commands on your own VPS, with root access and your own firewall.
Add multiple ports one at a time, up to 12.
Remote access · Registered port · OSI layer 7
Remote Desktop for Windows. Newer Windows versions also use UDP 3389 for smoother performance.
IANA: officially registered as ms-wbt-server
Firewall commands
Open port
sudo ufw allow 3389/tcpFor Ubuntu and Debian. ufw creates the rule for both IPv4 and IPv6. If ufw is disabled, allow SSH first (sudo ufw allow 22/tcp), then enable it with sudo ufw enable, or you'll lock yourself out.
On a ZAP-Hosting VPS with an active network firewall, you also need to allow the port in the Customer Panel.
Port 3389 explained
Port 3389 lets you access the graphical interface of a Windows server or Windows PC via Remote Desktop. RDP transmits the screen, keyboard and mouse, and optionally the clipboard, drives and printers. Newer Windows versions also use UDP 3389 alongside TCP 3389 for smoother transmission. On a Windows VPS, RDP is usually the primary way to manage it.
RDP was developed by Microsoft and introduced with Windows NT 4.0 Terminal Server Edition. The protocol is not an RFC standard; it is documented in Microsoft’s open specification MS-RDPBCGR. The IANA lists port 3389 under the name “ms-wbt-server” as a registered port. Clients are available for macOS, Linux and mobile devices as well as Windows.
A publicly accessible port 3389 is one of the most common entry points for ransomware. Attackers deliberately scan the internet for RDP and try weak passwords through brute force. Vulnerabilities such as BlueKeep (CVE-2019-0708) have also allowed attackers to take over unpatched systems without logging in. Never open port 3389 to the entire internet: restrict it to your own IP address, or access RDP through a VPN or SSH tunnel. Also enable Network Level Authentication, use long passwords and account lockouts after failed attempts, and install Windows updates promptly.
More ports
These ports are often part of the same setup. Click one to see its explanation and firewall commands.
View all well-known ports and the complete IANA list
Port list source: IANA Service Name and Transport Protocol Port Number Registry, as of October 22, 2026. iana.org
Discover more
Calculate the network address, broadcast address, subnet mask, and usable host range from a CIDR address, and convert between CIDR and IP ranges (IPv4 and IPv6).
Built by Jakub Martyniak
Interactively learn the 7 layers of the OSI model: click layers, assign terms such as switch, ARP, or port 443, and explore animated encapsulation, a quiz, and a cheat sheet for the IHK exam.
Built by Justin Schuessler
Interactively learn the 4 layers of the TCP/IP model (DoD model) according to RFC 1122, with OSI model mapping, animated encapsulation, a port quiz, and a cheat sheet.
Built by Justin Schuessler
Check whether specific ports are open on an IP or hostname—select a protocol or game instead of scanning all ports at once.
Built by Sebastian Rademacher
FAQ
Quick answers about port 3389.
In Windows Firewall, you can use PowerShell with New-NetFirewallRule -DisplayName RDP-Admin -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.10 -Action Allow. Replace the example IP with your own, then disable the general RDP rule that opens the port to all addresses.
RDP primarily uses TCP 3389. Newer Windows versions also use UDP 3389 for smoother video and audio transmission. RDP still works without UDP, just with slightly lower performance.
No, you should never open port 3389 to the entire internet. Open RDP ports are constantly targeted with login attempts and are a known route for ransomware. Restrict access to your IP or use a VPN.
Using a different port only reduces automated scans; it does not protect against targeted attacks. A port scan will find RDP on another port, too. Restricting access by IP, using a VPN, enabling Network Level Authentication, and installing updates provide real security.
Any more questions?
Contact SupportWith a ZAP-Hosting VPS, you have root access, can set up services and firewall rules yourself, and can immediately see which ports are open.
No setup. No risk. Online in seconds.
Looking for more tools? View all network tools