Never put RDP straight on the internet — and what to do instead

Forwarding port 3389 on your router is the fastest way to reach a PC from outside, and it is the single most exploited misconfiguration in small networks. The attack does not need to find you — it finds everyone.

What actually happens when you open the port

The public IPv4 space is small enough to scan end to end in minutes. Automated scanners sweep it continuously, and anything answering on 3389 is catalogued within hours of appearing — not because someone targeted you, but because everything gets catalogued.

What follows is not clever. It is a queue of automated login attempts against common usernames — Administrator, admin, user, the machine name, the company name — with passwords from previous breaches. This runs continuously for as long as the port is open. There is no notification, and Windows will happily keep answering.

The reason this matters more than most misconfigurations: an RDP session is not read-only. A successful login is an interactive desktop on the machine, with whatever rights that account has. Exposed RDP has been the leading initial access vector for ransomware in small and mid-sized organisations for years, precisely because the payoff is immediate and total.

The things people do that do not fix it

• Changing the port number. Moving RDP to 33890 stops the laziest scanners and nothing else. Full-range port scans are cheap, and the service identifies itself as soon as it is probed.
• A strong password alone. It defeats guessing, which is real progress — but it does nothing about a credential that leaks somewhere else, and nothing about a vulnerability in the service itself. RDP has had pre-authentication remote code execution flaws; a password is no defence against a bug that fires before the password is checked.
• Restricting by source IP. Genuinely helps, if your source IP is actually fixed. Most home and mobile connections are not, and the rule quietly becomes either useless or a lockout.
• Turning on Network Level Authentication and stopping there. NLA is a real improvement and should be on. It is not a substitute for keeping the service off the public internet.

Four things that do fix it

1. A VPN into your own network. The classic answer. RDP stays on the LAN and is unreachable from outside; you dial into the network first. WireGuard on a router or a small always-on box is straightforward and fast. The cost is setup and a client on every device you connect from.
2. An outbound-only remote access tool. The machine connects out to a relay and waits; nothing listens for inbound connections, so there is no port to scan and nothing to find. This is how nearly every modern remote access product works, and it is why they work behind routers that would make port forwarding impossible anyway.
3. An RD Gateway, if you are in a Windows-shop environment. It puts RDP behind an authenticating HTTPS front end rather than exposing the protocol itself. More work, and the right answer at organisational scale.
4. A jump host reachable only over SSH with key authentication, with RDP tunnelled through it. Strong, and firmly in "you already know how to do this" territory.

If you are stuck with exposed RDP today

Sometimes the port is already open and closing it is a next-week problem. In that order of priority: enable Network Level Authentication; enforce an account lockout policy so guessing stops being free; rename or disable the built-in Administrator account; restrict which accounts have Remote Desktop rights at all; and turn on logging so you can see the attempts. Then check the logs — the volume of failed logins is usually what convinces people to close the port.

And the long-term answer stays the same. Reaching your own computer should not require the computer to accept connections from strangers first — see why some connections never establish for how outbound-only tools sidestep the whole problem.

More guides