The latest articles on DEV Community by Sharuk FK (@sharuk_fk_7883e6ff2447418). https://dev.to/sharuk_fk_7883e6ff2447418 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4231812%2F87c7580e-784d-48e5-9835-f318def9cb86.png https://dev.to/sharuk_fk_7883e6ff2447418 en Sharuk FK Sat, 07 Nov 2026 09:34:57 +0000 https://dev.to/sharuk_fk_7883e6ff2447418/how-to-tunnel-windows-remote-desktop-rdp-securely-over-ssh-port-22-without-exposing-port-3389-13p6 https://dev.to/sharuk_fk_7883e6ff2447418/how-to-tunnel-windows-remote-desktop-rdp-securely-over-ssh-port-22-without-exposing-port-3389-13p6 <h1> How to Tunnel Windows Remote Desktop (RDP) Securely Over SSH (Stop Exposing Port 3389) </h1> <p>If you have a Windows workstation, staging server, or cloud VM connected to the public internet with port <strong>3389</strong> open, your machine is under non-stop attack.</p> <p>Within minutes of opening port 3389, automated botnets begin hammering your server with thousands of NTLM credential-stuffing attempts per hour. Worse, unpatched vulnerabilities in the Remote Desktop Protocol (like the infamous BlueKeep CVE-2019-0708) can allow remote attackers to execute arbitrary code without any authentication.</p> <p>The industry-standard solution is <strong>RDP over SSH</strong>: completely close port 3389 in your firewall and tunnel all graphical remote desktop traffic through an encrypted SSH stream on port 22.</p> <p>In this guide, we'll walk through:</p> <ol> <li>Why native RDP is a massive security hazard.</li> <li>How SSH local port forwarding encapsulates RDP.</li> <li>Step-by-step CLI setup on Windows 10/11 and Linux.</li> <li>How to automate the entire process in one click.</li> </ol> <h2> The Danger of Exposing Native Port 3389 </h2> <p>Traditional Remote Desktop relies on direct TCP/UDP connections to port 3389:</p> <div class="crayons-card c-embed text-styles text-styles--secondary"> <div class="c-embed__content"> <div class="c-embed__cover"> <a href="https://sshdesktop.com/rdp-over-ssh" class="c-link align-middle" rel="noopener noreferrer"> <img alt="" src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fsshdesktop.com%2Fassets%2Fimages%2Fog-image.svg" height="630" class="m-0" width="1200"> </a> </div> <div class="c-embed__body"> <h2 class="fs-xl lh-tight"> <a href="https://sshdesktop.com/rdp-over-ssh" rel="noopener noreferrer" class="c-link"> RDP over SSH Tunnel &amp; RDP/SSH Connection Manager | Secure Remote Desktop | SSH Desktop </a> </h2> <p class="truncate-at-3"> Tunnel RDP port 3389 over encrypted SSH port 22. Secure Windows 10/11 &amp; Linux Remote Desktop connections with an intuitive, unified RDP and SSH connection manager. </p> <div class="color-secondary fs-s flex items-center"> <img alt="favicon" class="c-embed__favicon m-0 mr-2 radius-0" src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fsshdesktop.com%2Fassets%2Fimages%2Ffavicon.svg" width="32" height="32"> sshdesktop.com </div> </div> </div> </div> devops security sysadmin windows