How to Tunnel Windows Remote Desktop (RDP) Securely Over SSH (Stop Exposing Port 3389)

If you have a Windows workstation, staging server, or cloud VM connected to the public internet with port 3389 open, your machine is under non-stop attack.

Within minutes of opening port 3389, automated botnets begin hammering your server with thousands of NTLM credential-stuffing attempts per hour. Worse, unpatched vulnerabilities in the Remote Desktop Protocol (like the infamous BlueKeep CVE-2019-0708) can allow remote attackers to execute arbitrary code without any authentication.

The industry-standard solution is RDP over SSH: completely close port 3389 in your firewall and tunnel all graphical remote desktop traffic through an encrypted SSH stream on port 22.

In this guide, we'll walk through:

  1. Why native RDP is a massive security hazard.
  2. How SSH local port forwarding encapsulates RDP.
  3. Step-by-step CLI setup on Windows 10/11 and Linux.
  4. How to automate the entire process in one click.

The Danger of Exposing Native Port 3389

Traditional Remote Desktop relies on direct TCP/UDP connections to port 3389:

RDP over SSH Tunnel & RDP/SSH Connection Manager | Secure Remote Desktop | SSH Desktop

Tunnel RDP port 3389 over encrypted SSH port 22. Secure Windows 10/11 & Linux Remote Desktop connections with an intuitive, unified RDP and SSH connection manager.

favicon sshdesktop.com