Port 3389 · RDP

Port 3389 is RDP, TCP and UDP.

Microsoft Remote Desktop Protocol — full GUI remote access to Windows. Frequently targeted by brute force and ransomware groups when exposed.

Palo Alto

Create the service objects for this port, then allow the App-ID on it. Restricting the rule to the port's service object keeps the rule working on a non-default port and stops the App-ID matching on other ports. Replace the placeholders with your own rule name and zones.

set service tcp-3389 protocol tcp port 3389
set service udp-3389 protocol udp port 3389

set rulebase security rules <rule-name> from <from-zone> to <to-zone> source any destination any application ms-rdp service [ tcp-3389 udp-3389 ] action allow

Risk and exposure

Rated high risk. Services on this port are commonly targeted by attackers. Keep it off the internet, or put it behind a VPN or a strict source allow-list, and monitor access.

Check it

• Linux ss -tlnp | grep :3389
• Linux ss -ulnp | grep :3389
• PowerShell Test-NetConnection <host> -Port 3389
• nmap nmap -p 3389 <host>
• nmap nmap -sU -p 3389 <host>

Related ports

• 5900 VNC
• 22 SSH
• 8161 ActiveMQ Console
• 10000 Webmin
• 15672 RabbitMQ Management

← Search all ports