How to Tunnel Windows Remote Desktop (RDP) Securely Over SSH (Stop Exposing Port 3389)
If you have a Windows workstation, staging server, or cloud VM connected to the public internet with port 3389 open, your machine is under non-stop attack.
Within minutes of opening port 3389, automated botnets begin hammering your server with thousands of NTLM credential-stuffing attempts per hour. Worse, unpatched vulnerabilities in the Remote Desktop Protocol (like the infamous BlueKeep CVE-2019-0708) can allow remote attackers to execute arbitrary code without any authentication.
The industry-standard solution is RDP over SSH: completely close port 3389 in your firewall and tunnel all graphical remote desktop traffic through an encrypted SSH stream on port 22.
In this guide, we'll walk through:
- Why native RDP is a massive security hazard.
- How SSH local port forwarding encapsulates RDP.
- Step-by-step CLI setup on Windows 10/11 and Linux.
- How to automate the entire process in one click.
The Danger of Exposing Native Port 3389
Traditional Remote Desktop relies on direct TCP/UDP connections to port 3389:
RDP over SSH Tunnel & RDP/SSH Connection Manager | Secure Remote Desktop | SSH Desktop
Tunnel RDP port 3389 over encrypted SSH port 22. Secure Windows 10/11 & Linux Remote Desktop connections with an intuitive, unified RDP and SSH connection manager.
sshdesktop.com
Top comments (0)