How to tunnel Windows Remote Desktop (RDP) securely over SSH port 22 without exposing port 3389
How to Tunnel Windows Remote Desktop (RDP) Securely Over SSH (Stop Exposing Port 3389) If you have a Windows workstation, staging server, or cloud VM connected to the public internet with port 3389 open, your machine i
How to Tunnel Windows Remote Desktop (RDP) Securely Over SSH (Stop Exposing Port 3389)
If you have a Windows workstation, staging server, or cloud VM connected to the public internet with port 3389 open, your machine is under non-stop attack.
Within minutes of opening port 3389, automated botnets begin hammering your server with thousands of NTLM credential-stuffing attempts per hour. Worse, unpatched vulnerabilities in the Remote Desktop Protocol (like the infamous BlueKeep CVE-2019-0708) can allow remote attackers to execute arbitrary code without any authentication.
The industry-standard solution is RDP over SSH: completely close port 3389 in your firewall and tunnel all graphical remote desktop traffic through an encrypted SSH stream on port 22.
In this guide, we'll walk through:
- Why native RDP is a massive security hazard.
- How SSH local port forwarding encapsulates RDP.
- Step-by-step CLI setup on Windows 10/11 and Linux.
- How to automate the entire process in one click.
The Danger of Exposing Native Port 3389
Traditional Remote Desktop relies on direct TCP/UDP connections to port 3389:
RDP over SSH Tunnel & RDP/SSH Connection Manager | Secure Remote Desktop | SSH Desktop
Tunnel RDP port 3389 over encrypted SSH port 22. Secure Windows 10/11 & Linux Remote Desktop connections with an intuitive, unified RDP and SSH connection manager.
sshdesktop.com
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.