Allow RDP port 3389 through your PC's firewall or antivirus

Sometimes the block is on your own computer. Security suites with a built-in firewall, "network protection" or "application control" can stop mstsc.exe or any outbound connection to TCP 3389. This guide shows how to confirm that, how to add a narrow exception, and how to make sure protection is back on afterwards.

Before you start

• Your server's IP address from your VPS provider's control panel. The examples use 203.0.113.10.
• Administrator rights on your own computer, to change security settings.
• A second device on the same network, if you have one. It helps prove the block is local.

Signs the block is on your PC

• Another device on the same Wi-Fi can connect to 203.0.113.10:3389, but this one cannot.
• The problem started after you installed or updated a security product.
• Your security app shows a notification or log entry about Remote Desktop or mstsc.exe being blocked.

Run a port test to see the current state:

Test-NetConnection 203.0.113.10 -Port 3389 -InformationLevel Quiet

False on this computer and True on another device on the same network points to local software.

Check Windows Defender Firewall

Windows Defender Firewall allows outbound traffic by default, so it is rarely the cause on its own. A policy or security tool can still add outbound block rules. List any enabled outbound block rules:

Get-NetFirewallRule -Direction Outbound -Action Block -Enabled True |
  Format-Table DisplayName, Profile

If a rule mentions Remote Desktop, mstsc or port 3389, look at it closely. In Windows Firewall, a block rule always wins over an allow rule, so adding an allow rule will not help while the block exists. Disable the block rule if you created it yourself:

Disable-NetFirewallRule -DisplayName "Name of the block rule"

If your company manages the computer, ask IT before you change anything.

Check third-party security software

Many antivirus suites replace or add to Windows Firewall with their own. Product menus change often, so look for these kinds of settings in your security app:

• Firewall or network protection, with a list of application rules.
• Application control or program rules, where mstsc.exe may be set to "block" or "ask".
• Intrusion prevention or network attack blocker, which can flag RDP traffic.
• Logs or history, which usually show the exact block event.

If you cannot find the setting, search the vendor's help site for "allow application through firewall" for your product.

Add a narrow exception

Allow only what you need. Pick one of these, in order of preference:

1. Allow the Remote Desktop app. Add an allow rule for C:\Windows\System32\mstsc.exe. For Windows App from the Microsoft Store, allow the app by name in your security product.
2. Allow outbound TCP to port 3389. If your product works with ports, allow outbound TCP with remote port 3389.
3. Allow the destination. If supported, limit the rule further to the remote address 203.0.113.10.

For Windows Defender Firewall, an outbound allow rule limited to the server and port looks like this:

New-NetFirewallRule -DisplayName "RDP to server (TCP 3389)" `
  -Direction Outbound -Protocol TCP -RemotePort 3389 `
  -RemoteAddress 203.0.113.10 -Action Allow

Note that this uses -RemotePort, because the port belongs to the server, not to your computer.

Test with protection paused (short test)

If you are not sure which feature is blocking, a quick pause test helps:

1. Pause the firewall or network protection in your security app for the shortest option offered, such as 10 or 15 minutes.
2. Run the port test and try connecting to 203.0.113.10:3389.
3. Re-enable protection straight away, whether the test passed or not.

If the connection worked only while paused, the security app is the cause. Add the exception from the previous section and test again with protection on.

Mac and Linux computers

• macOS: the built-in macOS firewall controls incoming connections only, so it does not block outbound RDP. Outbound blocks come from third-party tools such as network filters or antivirus apps. Check their rules for Windows App.
• Linux: desktop firewalls such as UFW usually allow all outgoing traffic. If you set a default deny outgoing policy, allow it with sudo ufw allow out 3389/tcp.

Check it works

With protection fully back on, test again:

Test-NetConnection 203.0.113.10 -Port 3389

TcpTestSucceeded: True means the exception works. Connect with Remote Desktop and confirm the session opens.

Troubleshooting

• Allow rule added, still blocked: a block rule or a second security product is still active. Check both the Windows block rules and the third-party app.
• Works until reboot: some suites reset temporary rules. Make the exception permanent in the app's settings, not in a one-time prompt.
• Exception for mstsc does not help Windows App: they are different programs. Add an exception for each app you use.
• Fails on every device on this network: the block is on the router or ISP. See Is your ISP or router blocking port 3389?.

Next steps

• Confirm the server end: Test whether RDP port 3389 is reachable.
• Other connection errors: Fix Remote Desktop can't connect.