Is your ISP or router blocking port 3389? How to tell

When Remote Desktop to 203.0.113.10:3389 fails, the block can sit anywhere between your computer and the server. Home routers, parental controls, security add-ons from your ISP and corporate proxies can all stop outbound TCP 3389. This guide shows how to narrow it down with a few simple comparisons, so you fix the right thing.

Before you start

• Your server's IP address from your VPS provider's control panel.
• A Windows, Mac or Linux computer on the network that fails.
• A phone with mobile data and hotspot (tethering) turned on.
• Access to your router's admin page, if you want to check its settings. The address and login are usually printed on a sticker on the router.

Step 1: confirm the server is up

Rule out the server before blaming the network.

1. In your VPS provider's control panel, check the service shows as Running.
2. Open the browser console from the control panel. If you see the Windows login or desktop, the server is up.

If the server is stopped or stuck, restart it from the control panel and wait a few minutes before testing again.

Step 2: compare home Wi-Fi with mobile data

This is the key test. Run the same command on two different networks, from the same computer.

On home Wi-Fi:

Test-NetConnection 203.0.113.10 -Port 3389 -InformationLevel Quiet

Then connect the same computer to your phone's hotspot and run it again. On a Mac or Linux machine, use this instead:

nc -vz -w 5 203.0.113.10 3389

Read the results:

• Fails on Wi-Fi, works on mobile data: your home network or ISP is blocking the port. Continue with steps 3 and 4.
• Fails on both: the problem is most likely on the server side. Check the firewall from the browser console, as in Check that Windows is listening on RDP port 3389.
• Works on both: the network is fine. Check the address format and credentials in your RDP app.

Step 3: check your router

Most home routers allow all outbound traffic by default, but some have features that block uncommon ports. Sign in to the router's admin page and look for:

• Outbound or "access control" firewall rules that allow only web and email ports.
• Parental controls or family safety profiles. These often block everything except web browsing for the devices they cover.
• Security or threat-protection features from the router maker, which may flag remote access tools.
• Device-specific schedules that cut off internet access at certain times.

Menu names differ by router brand, so check the manual or the maker's support site if you cannot find these settings. If you find a rule that blocks outbound traffic, add an exception for TCP port 3389 to 203.0.113.10, or switch the device to an unrestricted profile.

Step 4: check ISP-level filters

Some providers offer network-level filtering, often called "safe browsing", "content filter" or "security shield". These are usually controlled from your account page on the ISP's website or app, not from the router.

• Sign in to your ISP account and look for filtering or security add-ons.
• Turn them off temporarily, wait a few minutes, and test the port again.
• If the test now passes, add an exception if the service allows it, or leave the filter off.

If you cannot find any setting, contact the ISP and ask whether they block outbound TCP 3389.

Step 5: look for proxies and VPNs

On work laptops and some home setups, traffic may pass through a proxy or VPN that only allows web traffic.

• Windows: open Settings → Network & internet → Proxy and check whether a proxy is set.
• VPN apps: disconnect any VPN and test again. Some VPNs block uncommon ports or route traffic through a country where they are filtered.
• Corporate devices: an endpoint security agent may enforce company network rules even at home. Ask your IT team.

If a work network is the cause, see Connect to RDP port 3389 from office, hotel or school Wi-Fi.

Rule out your own computer

If another device on the same Wi-Fi can reach port 3389 but your computer cannot, the block is local. A security suite or the Windows firewall on your PC may be blocking mstsc.exe or outbound TCP 3389. See Allow RDP port 3389 through your PC's firewall or antivirus.

Check it works

After any change, repeat the Wi-Fi test:

Test-NetConnection 203.0.113.10 -Port 3389

TcpTestSucceeded: True from home Wi-Fi means the block is gone. Connect with your RDP app to 203.0.113.10:3389.

What to send support

If you are still stuck, open a ticket with:

• The server's IP address.
• The date, time and time zone of your tests.
• The full output of Test-NetConnection from both Wi-Fi and mobile data.
• Your public IP on each network (from a "what is my IP" page).
• Your ISP's name and the router model.

With that, the support team can quickly see whether traffic from your network reaches the server.

Troubleshooting

• Mobile data test fails too: some mobile networks also filter ports. Try a third network, such as a friend's Wi-Fi, before deciding the server is at fault.
• Works for a few minutes, then stops: look for router schedules or an intrusion prevention feature that reacts to repeated connections.
• Only one device is blocked: the problem is on that device or its router profile, not the ISP.

Next steps

• Make sure your server answers: Test whether RDP port 3389 is reachable.