Port 3389 (RDP)

Port 3389 is Remote Desktop Protocol (RDP), used to control a Windows computer or server remotely with Remote Desktop Connection (mstsc) or the Windows App. IANA lists it as ms-wbt-server.

Service: RDP
Protocol: TCP and UDPBoth. RDP connects over TCP 3389 and also uses UDP 3389 for faster transport when it is allowed; Microsoft’s own firewall example opens both.
IANA registry: Officially assigned: ms-wbt-server (MS WBT Server), TCP/UDP

Check if a port is open on your IP

We only check the address you are visiting from, one TCP port at a time. You cannot enter someone else’s address: this is not a port scanner.

Is it safe to open port 3389?

RDP open to the internet is a favourite target of password-guessing bots, and serious flaws have hit it, such as CVE-2019-0708 (BlueKeep). Do not publish 3389 directly: use a VPN or an RD Gateway, require Network Level Authentication and strong passwords, and keep Windows patched.

Sources

“Port 3389 is already in use”: how to fix it

The error means another program is already listening on port 3389. Find its process ID (PID), then stop that program or start yours on a different port.

Windows (Command Prompt or PowerShell as administrator)

netstat -ano | findstr :3389

taskkill /PID <PID> /F

macOS

lsof -nP -iTCP:3389 -sTCP:LISTEN

kill <PID>

Linux

sudo ss -ltnp | grep :3389

sudo lsof -i :3389

sudo kill <PID>

Replace <PID> with the number from the last column (Windows) or the PID column (macOS, Linux).

How to open port 3389

Router: in the router’s admin page find Port Forwarding (sometimes Virtual Server or NAT), forward TCP + UDP port 3389 to the local IP of the computer running the service, and save.

Windows Defender Firewall (PowerShell as administrator)

New-NetFirewallRule -DisplayName "Port 3389 TCP" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3389

New-NetFirewallRule -DisplayName "Port 3389 UDP" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 3389

Linux with ufw

sudo ufw allow 3389/tcp

sudo ufw allow 3389/udp

Linux with firewalld

sudo firewall-cmd --permanent --add-port=3389/tcp

sudo firewall-cmd --permanent --add-port=3389/udp

sudo firewall-cmd --reload

Then run the check above. If the port is still closed, see why a port can look closed below.

Why a port can look closed when your server is running

Most home networks sit behind a router doing NAT: the router owns the public address, and your computer has a private one such as 192.168.1.10. A connection from the internet reaches the router and stops there unless you add a port forwarding rule to your computer.

Many mobile and some home providers go further and use carrier-grade NAT (CGNAT): several customers share one public address, and your router itself gets an address from 100.64.0.0/10. Then no rule on your side can open a port; ask the provider for a public IP or use a tunnel or VPN service.

Even with forwarding in place, the firewall on the computer (Windows Defender Firewall, ufw, firewalld) must allow the port, and the program must listen on all interfaces (0.0.0.0), not only on 127.0.0.1.

UDP cannot be checked this way: a UDP service usually stays silent to packets it does not understand, so “no answer” means nothing. This check uses TCP only.

Frequently asked questions

What is port 3389 used for?

Port 3389 is Remote Desktop Protocol (RDP), used to control a Windows computer or server remotely with Remote Desktop Connection (mstsc) or the Windows App. IANA lists it as ms-wbt-server.

Is port 3389 TCP or UDP?

Both. RDP connects over TCP 3389 and also uses UDP 3389 for faster transport when it is allowed; Microsoft’s own firewall example opens both.

Is it safe to open port 3389?

How do I free port 3389 if it is already in use?

Find the process: on Windows run netstat -ano | findstr :3389 and stop it with taskkill /PID <pid> /F; on macOS or Linux run lsof -i :3389 and stop it with kill <pid>.

Source: IANA Service Name and Transport Protocol Port Number Registry, last updated 2026-11-10, retrieved 2026-11-12.