How to Tunnel Windows Remote Desktop (RDP) Securely Over SSH (Stop Exposing Port 3389)
If you have a Windows workstation, staging server, or cloud VM connected to the public internet with port 3389 open, your machine is under non-stop attack.
Within minutes of opening port 3389, automated botnets begin hammering your server with thousands of NTLM credential-stuffing attempts per hour. Worse, unpatched vulnerabilities in the Remote Desktop Protocol (like the infamous BlueKeep CVE-2019-0708) can allow remote attackers to execute arbitrary code without any authentication.
The industry-standard solution is RDP over SSH: completely close port 3389 in your firewall and tunnel all graphical remote desktop traffic through an encrypted SSH stream on port 22.
In this guide, we'll walk through:
- Why native RDP is a massive security hazard.
- How SSH local port forwarding encapsulates RDP.
- Step-by-step CLI setup on Windows 10/11 and Linux.
- How to automate the entire process in one click.
The Danger of Exposing Native Port 3389
Traditional Remote Desktop relies on direct TCP/UDP connections to port 3389:
RDP over SSH Tunnel & RDP/SSH Connection Manager | Secure Remote Desktop | SSH Desktop
Tunnel RDP port 3389 over encrypted SSH port 22. Secure Windows 10/11 & Linux Remote Desktop connections with an intuitive, unified RDP and SSH connection manager.
sshdesktop.com ![AMR Mechanical and Electrical Engineering — Ch.07: Contents {#contents .TOC-Heading} [KR]](https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fohx8abwdpqiwkduwwi0h.png)
![AI Safety Alignment and Interpretability — Ch.09: Experiments and Benchmarks [EN]](https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F9hazn8ww2z9duiujkqmt.png)