How to Configure Port Forwarding for Remote Desktop Protocol

Remote Desktop gives you access to a Windows PC when you are away from it. If you are connecting from outside the PC’s local network, your router needs to know where to send that incoming connection, and this is where port forwarding comes in.

However, setting up the forwarding rule alone is not enough. Remote Desktop needs to be enabled on the host PC, its firewall needs to allow the connection, and the network needs to accept incoming traffic.

In this guide, we will walk you through configuring RDP port forwarding, what to check if it does not work, ways to secure RDP access, and how PureVPN Port Forwarding can make the process of opening and managing ports easier.

What Port Does Remote Desktop Use?

Remote Desktop Protocol (RDP) uses port 3389 by default for both TCP and UDP traffic. The RDP service listens on this port for incoming connection requests from Remote Desktop clients, such as Remmina and Windows App.

You can also configure RDP to use a different listening port. If you do, the firewall and port forwarding rules need to allow that port, and the Remote Desktop client needs to connect using the same port number.

How Does Port Forwarding Work With Remote Desktop?

When you start an RDP connection from outside the host computer’s local network, the request first reaches the router through its public IP address. The router then uses the port forwarding rule to send that traffic to the local IP address of the computer running Remote Desktop.

This is necessary because the router uses Network Address Translation (NAT) to manage traffic between the internet and devices on the local network. The rule tells it which device should receive incoming traffic on the RDP port.

For the connection to reach the right computer, the rule needs to point to its local IP address and the port RDP is listening on. With the default configuration, that is port 3389. If you have changed the RDP listening port, the forwarding rule needs to use the corresponding port instead.

What Do You Need Before Setting Up RDP Port Forwarding?

Before creating the port forwarding rule, make sure the host computer and network are ready for an incoming RDP connection. You will need:

• An RDP host: The computer you want to access remotely needs to be running an RDP server that can accept incoming connections.
• RDP enabled and configured: The RDP service needs to be running, and the account you plan to use must have permission to connect remotely.
• Router administrator access: You need access to the router settings to create the port forwarding rule.
• The host computer’s local IP address: The router uses this to direct RDP traffic to the correct computer. Keep the address reserved or static so it does not change.
• Firewall access for RDP: The host computer’s firewall needs to allow incoming connections on the port used by RDP.
• A publicly reachable internet connection: Incoming traffic needs to reach your router. CGNAT or upstream NAT can prevent this.

How to Configure Port Forwarding for Remote Desktop

RDP port forwarding requires a few settings on both the computer and router. Just follow the instructions below to configure it correctly:

Step #1: Enable and Configure RDP

An RDP server needs to be running on the computer you want to access, and your user account needs permission to connect remotely. The exact steps depend on the operating system and RDP server you are using. If the computer you want to access is running Windows, you can enable Remote Desktop under Settings > System > Remote Desktop.

Step #2: Find the Computer’s Local IP Address

Find the local IPv4 address assigned to the computer by your router. You can usually find it in the device’s network settings or connection details. Use the computer’s local IP address, not your router’s public IP or its Default Gateway address. You will need the local IP when creating the forwarding rule.

Step #3: Reserve the Local IP Address

Keep the computer on the same local IP address so the forwarding rule continues pointing to the right device. If the address changes, the existing rule will no longer point to the computer you want to access. Many routers let you reserve an IP address for a particular device through their DHCP settings. You can also use a static IP address where appropriate.

Step #4: Log In to Your Router

Open your router’s administration page in a browser and sign in with the administrator credentials. If you do not know the router’s address, check the network details on a device connected to it for the Default Gateway. Look for Port Forwarding, Port Mapping, NAT, or a similarly named section. 

Step #5: Create the RDP Port Forwarding Rule

Create a new forwarding rule and enter the details for your RDP connection. Router interfaces vary, but you will commonly see fields such as:

• Service or name: Enter a recognizable name, such as RDP.
• External port: Enter the port that will receive the incoming RDP connection.
• Internal port: Enter the port on which the RDP server is listening.
• Protocol: Select TCP and UDP if you are forwarding the default RDP traffic. If your router requires separate rules for each protocol, create one for TCP and another for UDP.
• Destination or local IP: Enter the local IP address of the computer running the RDP server.

If RDP is using its default configuration, the default port is 3389. If you have configured a different listening port, the forwarding and firewall rules need to correspond to that port. Save or apply the rule once you have entered the required values.

Step #6: Check the Firewall

The firewall on the computer accepting the RDP connection needs to permit incoming traffic on the RDP listening port. A forwarding rule on the router will not help if the firewall blocks the traffic when it reaches the computer. If you are using a custom RDP port, the firewall rule needs to allow that port rather than the default port.

Step #7: Test the Remote Desktop Connection

Use a device on a different network to test the connection. Open your RDP client and enter the public IP address of the RDP host’s network. If you use a custom listening port, enter the address as address:port. Then connect and sign in with an account that has remote access permission.

Why Is RDP Port Forwarding Not Working?

If the RDP connection does not work after you create the forwarding rule, the problem is often one or more of the following:

Problem	What to check
RDP is not enabled	Confirm that the RDP server is running and accepting incoming connections
Wrong local IP address	Verify that the forwarding rule points to the local IP of the computer running the RDP server
Local IP address has changed	See whether the computer received a different local IP after the rule was created. Update the rule or reserve the correct address
Incorrect port or protocol	Compare the port and protocol in the forwarding rule with those used by your RDP configuration
Firewall is blocking RDP	Allow incoming traffic on the RDP listening port through the firewall on the RDP host
Double NAT	If another router or NAT device sits upstream, the incoming connection also needs a path through that NAT layer
CGNAT	Your ISP may place your connection behind carrier-grade NAT, preventing incoming traffic from reaching your router directly

How to Port Forward for Remote Desktop Using PureVPN

PureVPN’s Port Forwarding add-on lets you open specific ports through your VPN connection without setting up a forwarding rule on your router. It can also be used when CGNAT prevents incoming traffic from reaching your router. Once the RDP host and its firewall are configured for the required port, follow these steps:

1. Log in to the PureVPN Member Area.
2. Open Subscriptions and select Configure next to Port Forwarding.
3. Select Enable specific ports.
4. Enter the port used by your RDP connection, such as 3389 if RDP is using its default port.
5. Select Apply Settings.
6. Open the PureVPN app and connect to a server location that supports Port Forwarding.

The remote RDP client can then connect using the IP address assigned to the PureVPN connection and the RDP port you configured. 

Is It Safe to Port Forward Remote Desktop?

Port forwarding makes the RDP service reachable from the public internet, which also exposes it to unwanted connection attempts. If you use RDP port forwarding, take these steps to reduce the risk:

• Keep Network Level Authentication enabled: NLA requires authentication before a full Remote Desktop session is established.
• Use strong, unique account credentials: Protect RDP-enabled accounts with strong passwords that are not reused elsewhere.
• Limit who can use Remote Desktop: Only allow remote access for accounts that need it, and restrict inbound connections through firewall rules where appropriate.

• Keep the RDP host updated: Install security updates for the operating system and RDP components.
• Use MFA where supported: Add multi-factor authentication when your RDP environment and authentication method support it.
• Avoid directly exposing RDP where possible: Use a VPN or, in managed environments, RD Gateway for remote access.

Frequently Asked Questions