{"id":3431,"date":"2026-10-18T15:30:00","date_gmt":"2026-10-18T15:30:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=3431"},"modified":"2026-10-17T08:05:22","modified_gmt":"2026-10-17T08:05:22","slug":"what-port-does-rdp-use","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/18\/what-port-does-rdp-use\/","title":{"rendered":"What Port Does RDP Use? 3389 TCP and UDP Explained"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">What port does RDP use? Remote Desktop Protocol uses TCP port 3389 by default, and modern Windows hosts can also use UDP port 3389 for the RDP transport. Knowing the protocol and port matters when you are checking a firewall, testing a new Windows VPS, or connecting to a server whose administrator changed the default.<\/p>\n\n\n\n<aside class=\"ap-card\" aria-label=\"Buffalo Windows RDP 4 GB (Basic KVM 4)\">\n<span class=\"ap-card__badge\">Easy RDP<\/span>\n<div class=\"ap-card__body\"><p class=\"ap-card__name\">Buffalo Windows RDP 4 GB (Basic KVM 4)<\/p><p class=\"ap-card__best\">Best for one browser profile, MT4\/MT5 EA, rater work, Google Ads account<\/p><ul class=\"ap-card__features\"><li>3 vCPU Intel Xeon E5-2699 v4, 4 GB reserved RAM<\/li><li>60 GB SSD (RAID 1), 3 TB traffic on a 200 Mbps port<\/li><li>Full Administrator, private KVM VM, 1 dedicated US IPv4<\/li><li>Windows Server 2019, Windows 10 Pro or Windows 11 Pro image; bring your own licence<\/li><li>Browser console, reinstall, reboot from the client area<\/li><li>Pay by crypto (Cryptomus), UPI\/card (Razorpay, Cashfree) or card (Paddle)<\/li><\/ul><\/div>\n<div class=\"ap-card__side\"><p class=\"ap-card__price\">$9.99\/mo <small>USD monthly<\/small><\/p><a class=\"ap-card__btn\" href=\"https:\/\/my.vpslake.com\/index.php?rp=\/store\/buffalo-new-york-basic-kvm-windows-rdp\/basic-kvm-4-windows-rdp\">Order now \u2192<\/a><\/div>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Short answer: RDP uses TCP and UDP 3389<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The default RDP port is <strong>3389<\/strong>. On a normal Windows Remote Desktop setup, the server-side listener is associated with both transports:<\/p>\n\n\n\n<figure class=\"wp-block-table ap-table\"><table><thead><tr><th>Transport<\/th><th>Default destination port<\/th><th>What it does<\/th><\/tr><\/thead><tbody><tr><td>TCP<\/td><td>3389<\/td><td>Establishes the reliable RDP connection and carries session traffic<\/td><\/tr><tr><td>UDP<\/td><td>3389<\/td><td>Can carry RDP transport traffic when the client and network support it<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft lists TCP and UDP 3389 as the standard port for Remote Desktop Services. The port can be changed on the host, so 3389 is the default, not a guarantee that every server uses it. A firewall rule also has to permit the port, and the RDP service must be running and enabled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The number belongs to the <strong>destination<\/strong> on the Windows server. Your local computer normally uses a temporary source port to reach the server; you do not need to set your local source port to 3389.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why RDP uses both TCP and UDP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">TCP and UDP solve different transport problems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">TCP creates an ordered, reliable stream. It confirms delivery, retransmits missing data, and controls the connection when packets arrive out of order. That makes it suitable for establishing the session and carrying traffic that must arrive correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">UDP has less connection overhead. RDP can use it as an additional transport for a more responsive session, especially when the network has latency or changing conditions. It is not a second RDP login port: UDP uses the same default port number, 3389, but it is a separate transport protocol.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If UDP 3389 is blocked while TCP 3389 is reachable, a client may still connect over TCP. You may notice different performance or session behavior, depending on the Windows versions, client, and network path. If both protocols are intended to work, allow both explicitly in the relevant firewall rules.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There is an important distinction here:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>TCP 3389 open<\/strong> means a TCP connection can reach the server\u2019s RDP listener.<\/li>\n\n\n<li><strong>UDP 3389 allowed<\/strong> means the RDP client has a path to use the UDP transport.<\/li>\n\n\n<li><strong>A successful port test<\/strong> does not prove that your username, password, NLA setting, or RDP permissions are correct.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For the broader port map, see Microsoft\u2019s <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/windows-server\/remote\/ports-used-by-rds\" target=\"_blank\" rel=\"noopener\">official list of ports used by Remote Desktop Services<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to check which port RDP listens on<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you have administrator access to the Windows computer, check the configured listener instead of assuming it is 3389. Open PowerShell as an administrator and run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n  -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' `\n  -Name 'PortNumber'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>PortNumber<\/code> value is the configured RDP listening port for the default <code>RDP-Tcp<\/code> listener. On an unchanged system, it normally reports 3389. If the value is shown in hexadecimal by another registry tool, switch to decimal before interpreting it as a port number.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check active listeners. Replace <code>&lt;port&gt;<\/code> with the value you found:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -LocalPort &lt;port&gt; -State Listen\nGet-NetUDPEndpoint -LocalPort &lt;port&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The TCP command should return a listening endpoint if the RDP service is accepting TCP connections on that port. The UDP command helps you see whether a UDP endpoint exists, but the result can depend on the Windows build and the current RDP transport state.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next, inspect the Windows Firewall rules. This command displays the protocols and local ports associated with rules in the built-in Remote Desktop group:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetFirewallRule -DisplayGroup 'Remote Desktop' |\n  Get-NetFirewallPortFilter |\n  Select-Object Protocol, LocalPort<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A valid listener and a firewall rule are separate checks. You can have RDP configured for 3389 but still be unable to connect because a Windows Firewall profile, cloud firewall, router, or upstream network filter blocks the traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From another Windows computer, test TCP reachability with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Test-NetConnection -ComputerName &lt;server-ip-or-hostname&gt; -Port 3389<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you use a custom port, replace 3389 with that port. <code>TcpTestSucceeded: True<\/code> confirms that the TCP path is reachable; it does not complete an RDP login.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to connect to RDP on a custom port<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The connection format is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server-address:port<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For example, if the server\u2019s public IP is <code>203.0.113.10<\/code> and RDP listens on 3390, enter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>203.0.113.10:3390<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In the Windows Remote Desktop Connection app, type that value in the <strong>Computer<\/strong> field. You can also launch the client from a command prompt or PowerShell window:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mstsc.exe \/v:203.0.113.10:3390<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you normally connect with an <code>.rdp<\/code> file, the file can specify the destination as well. VPSLake\u2019s <a href=\"https:\/\/vpslake.com\/rdp-file-generator\">free RDP file generator<\/a> is useful when you want to create a connection file with the server address and custom port already filled in.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/vpslake.com\/blog\/wp-content\/uploads\/2026\/10\/what-port-does-rdp-use-1.webp\" alt=\"The RDP file generator can prefill a server address and custom port in an RDP connection file.\"\/><figcaption class=\"wp-element-caption\">The RDP file generator can prefill a server address and custom port in an RDP connection file.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Use the same address and port for every layer that forwards or filters the connection. For example, if a router forwards public TCP 3390 to private TCP 3389, the client uses <code>public-address:3390<\/code>, while the internal forwarding rule targets 3389. If you changed the listener itself to 3390, the server firewall and any external firewall must allow 3390 too.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The common connection mistakes are simple:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Entering <code>server-address,port<\/code> instead of <code>server-address:port<\/code> in the Remote Desktop client.<\/li>\n\n\n<li>Changing the registry value but leaving the old firewall rule as the only allowed port.<\/li>\n\n\n<li>Opening TCP on the new port but forgetting UDP when the configuration is meant to support both transports.<\/li>\n\n\n<li>Testing the old port after the server was changed.<\/li>\n\n\n<li>Changing the port and restarting before confirming that you still have console or recovery access.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For a complete walkthrough of the change, see <a href=\"https:\/\/vpslake.com\/blog\/2026\/03\/27\/how-to-access-rdp-with-a-custom-port-step-by-step-guide-for-secure-remote-access\/\">how to access RDP with a custom port<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are changing the standard listener on Windows Server, the related <a href=\"https:\/\/vpslake.com\/blog\/2026\/10\/11\/change-default-rdp-port-windows-server\/\">guide to changing the default RDP port<\/a> covers the same configuration in a server-focused format.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Should you change port 3389?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes. A custom port can fit a port-forwarding plan, avoid a conflict with another service, or match a provider\u2019s network design. It can also reduce casual noise from scanners that only probe the conventional port, but it does not make the RDP service secure by itself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Changing the number does not replace a strong, unique password, current Windows updates, Network Level Authentication, least-privilege user accounts, or a firewall policy that limits who can reach the service. It also does not encrypt a connection more strongly than the RDP configuration already does. Treat the port as a routing setting, not an authentication or access-control feature.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you change it, plan the full sequence:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Confirm that you have administrator access and a recovery or console path.<\/li>\n\n\n<li>Choose an unused port and record it in your password manager or server documentation.<\/li>\n\n\n<li>Change the <code>PortNumber<\/code> value for the correct <code>RDP-Tcp<\/code> listener.<\/li>\n\n\n<li>Add matching inbound firewall rules for TCP and, if needed, UDP on the new port.<\/li>\n\n\n<li>Restart the Remote Desktop Services service or the server as required by the configuration.<\/li>\n\n\n<li>Test the new port from a second connection before closing your current session.<\/li>\n\n\n<li>Remove or disable obsolete firewall rules only after the new connection works.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft\u2019s <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/remote\/remote-desktop-services\/remotepc\/change-listening-port\" target=\"_blank\" rel=\"noopener\">documentation for changing the Remote Desktop listening port<\/a> shows the registry location, PowerShell commands, firewall examples, and <code>hostname:port<\/code> connection format. Follow that documentation for the Windows version you manage, because a mistake in the registry or firewall can lock you out.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to check when RDP port 3389 is not working<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start at the server and work outward. This keeps a firewall problem separate from a credentials problem.<\/p>\n\n\n\n<figure class=\"wp-block-table ap-table\"><table><thead><tr><th>Check<\/th><th>What it tells you<\/th><\/tr><\/thead><tbody><tr><td>Remote Desktop is enabled<\/td><td>Windows is configured to accept remote sessions<\/td><\/tr><tr><td><code>TermService<\/code> is running<\/td><td>The Remote Desktop Services service is available<\/td><\/tr><tr><td><code>PortNumber<\/code> is correct<\/td><td>You are testing the configured listener, not an assumed port<\/td><\/tr><tr><td>TCP firewall rule is enabled<\/td><td>The basic RDP transport is allowed through Windows Firewall<\/td><\/tr><tr><td>UDP rule is enabled, if required<\/td><td>The optional RDP UDP transport has a matching path<\/td><\/tr><tr><td>Cloud or provider firewall allows the port<\/td><td>Traffic is not blocked before it reaches Windows<\/td><\/tr><tr><td><code>Test-NetConnection<\/code> succeeds<\/td><td>A TCP path exists from the test machine<\/td><\/tr><tr><td>The account is allowed to sign in<\/td><td>The connection can pass authorization after reaching the service<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">If the TCP test fails, inspect the destination IP, the port, Windows Firewall, and any provider-level firewall first. If the TCP test succeeds but the login fails, check the username format, password, account status, Remote Desktop Users membership, NLA compatibility, and server policy. A port number cannot fix an authentication or permissions error.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When you are testing a Windows VPS, also confirm that you are using its current public IPv4 address. A private address such as <code>10.x.x.x<\/code>, <code>172.16.x.x<\/code> through <code>172.31.x.x<\/code>, or <code>192.168.x.x<\/code> is not normally reachable directly from the public internet without routing or forwarding.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is RDP always on port 3389?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. 3389 is the default for the standard RDP listener, and it is the port most clients expect when you enter only a hostname or IP address. An administrator can configure another port, after which the client must use the <code>host:port<\/code> format and the firewall must allow the new value.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is RDP TCP or UDP?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">RDP can use both TCP and UDP. TCP 3389 is the core default path, while UDP 3389 can be used as an additional transport when the client, server, and network support it. If UDP is unavailable, a TCP connection may still work.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How do I connect to RDP on port 3390?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enter <code>server-address:3390<\/code> in the Remote Desktop client, or run <code>mstsc.exe \/v:server-address:3390<\/code>. The server must actually listen on 3390, and its Windows Firewall plus any external firewall or port-forwarding rule must allow the matching traffic.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is changing the RDP port enough to secure a server?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. A custom port is a configuration choice and may reduce generic scans, but it does not replace updates, strong credentials, NLA, restricted firewall access, or a secure gateway or VPN design. Keep the service protected even when it is no longer using 3389.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How can I find my RDP port without guessing?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On the server, query <code>HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp<\/code> and read <code>PortNumber<\/code>. Then confirm the active listener and firewall rules, and test the same port from another machine with <code>Test-NetConnection<\/code>.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Is RDP always on port 3389?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. 3389 is the default for the standard RDP listener, and it is the port most clients expect when you enter only a hostname or IP address. An administrator can configure another port, after which the client must use the host:port format and the firewall must allow the new value.\"}}, {\"@type\": \"Question\", \"name\": \"Is RDP TCP or UDP?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"RDP can use both TCP and UDP. TCP 3389 is the core default path, while UDP 3389 can be used as an additional transport when the client, server, and network support it. If UDP is unavailable, a TCP connection may still work.\"}}, {\"@type\": \"Question\", \"name\": \"How do I connect to RDP on port 3390?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Enter server-address:3390 in the Remote Desktop client, or run mstsc.exe \/v:server-address:3390. The server must actually listen on 3390, and its Windows Firewall plus any external firewall or port-forwarding rule must allow the matching traffic.\"}}, {\"@type\": \"Question\", \"name\": \"Is changing the RDP port enough to secure a server?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. A custom port is a configuration choice and may reduce generic scans, but it does not replace updates, strong credentials, NLA, restricted firewall access, or a secure gateway or VPN design. Keep the service protected even when it is no longer using 3389.\"}}, {\"@type\": \"Question\", \"name\": \"How can I find my RDP port without guessing?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"On the server, query HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp and read PortNumber. Then confirm the active listener and firewall rules, and test the same port from another machine with Test-NetConnection.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"What port does RDP use? Learn why TCP and UDP 3389 are the default, how to check your listener, connect to a custom port, and troubleshoot RDP.","protected":false},"author":1,"featured_media":3432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[10],"tags":[32,23,686,687,42],"class_list":["post-3431","post","type-post","status-publish","format-standard","has-post-thumbnail","category-windows-rdp","tag-rdp","tag-remote-desktop","tag-tcp","tag-udp","tag-windows-server","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/3431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=3431"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/3431\/revisions"}],"predecessor-version":[{"id":3448,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/3431\/revisions\/3448"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/3432"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=3431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=3431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=3431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}