Change the Windows RDP port (and optionally restrict to a VPN)

RDP listens on TCP/3389 by default, a port that sees constant brute-force traffic. This guide moves it to another port and, optionally, lets only your VPN address reach it.

WARNING

Have the server's Console in Flux ready before you change anything. If you misconfigure the firewall or the registry, it is the only way back in.

Part 1: change the default RDP port

1. Win + R → type regedit → OK.

2. Go to the key:

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

3. Double-click PortNumber, select Decimal and enter a free port between 1025 and 65535, for example 3390. Click OK.

4. Restart the Remote Desktop service in an elevated Command Prompt, or reboot:

   net stop termservice
   net start termservice

Part 2: allow the new port through the firewall

The default firewall rule allows 3389 only, so the new port has to be opened.

1. Win + R → wf.msc → OK.
2. Inbound Rules → New Rule…, then:
   • Rule type: Port.
   • Protocol: TCP.
   • Specific local ports: the new port number.
   • Action: Allow the connection.
   • Profile: the profiles your server actually uses (Domain / Private / Public).
   • Name: e.g. Custom RDP Port.

Part 3 (optional): restrict to a VPN address

Open the inbound rule you just created, go to the Scope tab and select These IP addresses under Remote IP address. Add your VPN's public IP (e.g. 203.0.113.10) or a subnet (e.g. 10.8.0.0/24), then click OK.

TIP

If you do not have a VPN yet, see Set up a WireGuard VPN server or Set up Tailscale.

Part 4: connect using the new port

In Remote Desktop, append :port to the address:

198.51.100.20:3390

TIP

Check that the new port is reachable before you log out of an active RDP session. If it is not, you are locked out and need the Console to recover.