Check the Windows Firewall rule for RDP port 3389

Windows VPS and Admin RDP servers accept Remote Desktop on TCP port 3389. Windows Defender Firewall must allow that port inbound, or nobody can connect. This guide shows how to find the rule, confirm it is enabled and correct, recreate it if it has gone missing, and narrow it to your own IP addresses safely.

Before you start

• A Remote Desktop session to the server at 203.0.113.10:3389, signed in as an administrator.
• PowerShell as Administrator: right-click Start, choose Terminal (Admin) or Windows PowerShell (Admin).
• Know where the browser console is: it is in the control panel for your service in your VPS provider's control panel. It works without Remote Desktop, so it is your way back if a firewall change goes wrong.

Find the rule for port 3389

Firewall rules and their ports are stored separately, so search by port and then show the matching rules:

Get-NetFirewallPortFilter -Protocol TCP |
  Where-Object LocalPort -eq 3389 |
  Get-NetFirewallRule |
  Format-Table Name, DisplayName, Enabled, Direction, Action, Profile

A healthy result has at least one rule with:

• Enabled: True
• Direction: Inbound
• Action: Allow
• Profile: Any, or one that includes the profile your network uses (usually Public on a VPS).

Check which profile the server's network uses:

Get-NetConnectionProfile | Format-Table Name, InterfaceAlias, NetworkCategory

If the rule covers only Domain and the network is Public, the rule will not apply.

Check the rule's details

Look at the address and program filters, which can also block traffic. Replace the display name with the one from the previous step:

$rule = Get-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)"
$rule | Get-NetFirewallAddressFilter | Format-List RemoteAddress
$rule | Get-NetFirewallApplicationFilter | Format-List Program

• RemoteAddress: Any means connections are allowed from anywhere.
• A list of addresses means only those IPs can connect. Make sure your current IP is included.
• Program: Any is normal for a port rule.

Also check that no block rule overrides it. Block rules win over allow rules:

Get-NetFirewallPortFilter -Protocol TCP |
  Where-Object LocalPort -eq 3389 |
  Get-NetFirewallRule |
  Where-Object Action -eq 'Block'

This should return nothing.

Recreate the rule if it is missing

If the search found no allow rule, add one. If you are connected at the moment, an existing session may survive briefly, but new connections will fail until the rule exists, so do this from the browser console if needed.

New-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" `
  -Direction Inbound -Protocol TCP -LocalPort 3389 `
  -Action Allow -Profile Any

If an old rule exists but is disabled, enable it instead of adding a duplicate:

Enable-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)"

Then confirm Remote Desktop itself still listens on 3389:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

The result should show PortNumber: 3389.

Scope the rule to your IP addresses

Limiting the rule to the addresses you connect from blocks almost all password-guessing bots. Do it only if your IP is fixed or changes rarely.

1. Find your current public IP from your own PC, for example by searching what is my IP in a browser.
2. Set the rule's allowed addresses, listing every location you use. This example allows one office IP and one home range:

   Set-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" `
     -RemoteAddress 198.51.100.20, 192.0.2.0/24

1. Without closing your current session, open a new Remote Desktop connection to 203.0.113.10:3389 to prove it still works.
2. To undo the scope at any time:

   Set-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" -RemoteAddress Any

Check it works

From your own PC, test the port:

Test-NetConnection 203.0.113.10 -Port 3389

TcpTestSucceeded: True means the firewall allows you in. On the server you can confirm the listener is up:

Get-NetTCPConnection -LocalPort 3389 -State Listen

Troubleshooting

• Rule exists but the port test fails: the profile does not match the network, a block rule overrides it, or your IP is outside the scoped addresses. Run the checks above.
• Locked out after a change: open the browser console from your VPS provider's control panel, sign in and run the reset command Set-NetFirewallRule... -RemoteAddress Any or recreate the rule. More help is in Fix a firewall change that locked you out of RDP.
• Two rules for 3389: harmless, but confusing. Keep one and remove the duplicate with Remove-NetFirewallRule -Name <Name> using the Name column from the search.
• Port test works, but sign-in fails: the firewall is fine. Check your username and password in your VPS provider's control panel.

Next steps

• Allow only your own address step by step: Allow only your IP on RDP port 3389.
• Open other ports safely: Open a port in Windows Firewall.