Restrict RDP port 3389 to your own IP addresses

Moving Remote Desktop to a non-default port cuts out most automated scans, but anyone who finds the port can still try passwords. The strongest simple fix is to let only your own IP addresses reach port 3389. Everyone else's connection is dropped before Windows ever shows a login screen.

This guide sets a remote address scope on the 3389 firewall rule, covers home connections whose IP changes, and keeps the browser console as your way back in.

Before you start

• Administrator access to the server over Remote Desktop.
• Access to your VPS provider's control panel, so you can open the browser console if you lock yourself out.
• A list of the public IP addresses you connect from: home, office, and perhaps a second admin's address.

Find your public IP address

Your public IP is the address the server sees, not the 192.168.x.x address on your laptop. From the computer you connect from, run:

(Invoke-RestMethod -Uri 'https://api.ipify.org').Trim()

Or open any "what is my IP" page in a browser. Write the address down. The examples use 198.51.100.20 for home and 198.51.100.45 for the office.

You can also see it from the server. While connected over Remote Desktop, run this on the server:

Get-NetTCPConnection -LocalPort 3389 -State Established |
  Select-Object RemoteAddress -Unique

Find the 3389 firewall rule

On the server, open PowerShell as Administrator and list the rules that cover TCP 3389:

Get-NetFirewallPortFilter -Protocol TCP |
  Where-Object LocalPort -eq 3389 |
  Get-NetFirewallRule |
  Format-Table DisplayName, Name, Enabled, Action

Note the DisplayName. The steps below use Remote Desktop (TCP 3389). Use the exact name from your output.

If more than one enabled allow rule covers 3389, you must scope all of them. Any rule left open to everyone still lets everyone in.

Limit the rule to your IP

Set the remote address scope to your IP:

Set-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" `
  -RemoteAddress 198.51.100.20

To allow more than one address, pass a comma-separated list. You can mix single IPs and ranges in CIDR form:

Set-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" `
  -RemoteAddress 198.51.100.20, 198.51.100.45, 192.0.2.0/24

Set-NetFirewallRule -RemoteAddress replaces the whole list each time. To add an address later, include all the existing ones as well. Check the current list first:

Get-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" |
  Get-NetFirewallAddressFilter |
  Select-Object RemoteAddress

Using the graphical tool instead

1. Press Win + R, type wf.msc and press Enter.
2. Click Inbound Rules and double-click the 3389 rule.
3. Open the Scope tab.
4. Under Remote IP address, choose These IP addresses and click Add.
5. Enter your IP and click OK, then OK again.

Handle a home IP that changes

Many home broadband and mobile connections get a new public IP from time to time. When that happens, the firewall blocks you. You have a few options:

• Allow your provider's range. If your IP always starts the same way, such as 198.51.100.x, allow that /24. It is broader than one IP, but still blocks almost the whole internet.
• Ask your ISP for a static IP. Many providers sell one as an add-on.
• Connect through a fixed point. Route RDP through a VPN or SSH server with a fixed IP and allow only that address. See Tunnel Remote Desktop port 3389 through SSH.
• Update the rule when it changes. Use the browser console, run the Set-NetFirewallRule command with your new IP and reconnect.

For more patterns, see RDP access rules for dynamic IPs.

Check it works

1. Keep your current Remote Desktop session open.
2. From the same computer, open a second connection to 203.0.113.10:3389. It should connect.
3. From a network that is not on the list, such as phone data with a hotspot, test the port:

   Test-NetConnection 203.0.113.10 -Port 3389 -InformationLevel Quiet

It should return False. That means the scope is working.

Only close the original session once the second one has connected.

Get back in if you lock yourself out

1. Open your VPS provider's control panel, go to your service's control panel and open the browser console.
2. Sign in to Windows and open PowerShell as Administrator.
3. Either set your new IP, or remove the scope entirely so any address can connect:

   Set-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" -RemoteAddress Any

1. Reconnect over Remote Desktop and set the correct scope again.

Troubleshooting

• Blocked even from an allowed IP: your public IP has probably changed, or you entered the private LAN address. Check it again from the connecting computer.
• Other IPs can still connect: another enabled allow rule covers 3389 or all ports. Re-run the rule list and scope or disable the extra rule.
• Works from home, not from the office: offices often use several outbound IPs. Ask IT for the full list or range.
• Error "No MSFT_NetFirewallRule objects found": the display name does not match. Copy it exactly from the rule list, including spaces and brackets.

Next steps

• Add more layers: Secure Remote Desktop on Windows Server.
• Stop password guessing that gets through: Block RDP brute-force attacks.