Toolman 100% local

Port 3389 — RDP

TCP registered

What runs on port 3389

Windows Remote Desktop.

Remote Desktop. Exposed RDP is the single most common initial access point for ransomware, by a wide margin: credential-stuffing against 3389 is fully automated and continuous. It belongs behind a VPN or a gateway with multi-factor authentication. Network Level Authentication helps but does not make direct exposure acceptable — the attacks that matter are against valid credentials, not against the protocol.

Security considerations

A primary ransomware entry vector. Put it behind a VPN, require network level authentication, and never expose it directly.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :3389
sudo ss -lntp | grep :3389

# Windows
netstat -ano | findstr :3389
Get-NetTCPConnection -LocalPort 3389

# is it reachable from outside?
nc -zv example.com 3389
curl -v telnet://example.com:3389

Freeing the port

# find the process, then stop it
sudo lsof -ti :3389 | xargs kill        # Linux / macOS
netstat -ano | findstr :3389            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

No. Port 3389 should never be reachable from a public address. Bind it to localhost or a private network, and reach it through a VPN or bastion host if remote access is genuinely needed. Internet-wide scanners find newly exposed instances of this service within minutes.

Opening or blocking port 3389

There is no blanket-allow rule on this page, because there is no case for one. RDP on port 3389 should be reachable from named addresses or not at all, so what follows restricts rather than opens:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 3389 proto tcp
sudo ufw deny 3389/tcp                    # everything else

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=3389 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 3389 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3389 -j DROP

# Windows
New-NetFirewallRule -DisplayName "RDP 3389" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.0.0.0/8 -Action Allow

Change 10.0.0.0/8 to whatever your private range actually is. A firewall rule is the second line: the first is binding the service to a private interface, because a service that only listens on 127.0.0.1 cannot be reached however the firewall is configured.

Quick reference

Port3389
ProtocolTCP
ServiceRDP
RangeRegistered (1024–49151) — any user process may bind

Frequently asked questions

What is port 3389 used for?

Windows Remote Desktop.

Is it safe to open port 3389?

A primary ransomware entry vector. Put it behind a VPN, require network level authentication, and never expose it directly.

How do I check if port 3389 is open?

Locally, sudo lsof -i :3389 on macOS or Linux, or netstat -ano | findstr :3389 on Windows. From outside, nc -zv host 3389 tells you whether anything answers.

Why do I get "address already in use" on port 3389?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :3389 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers