Secure RDP without VPN: closed until you unlock it
Remote Desktop open to the internet is found by scanners within hours, and then the password guessing starts. The safest RDP port is one that strangers can't reach at all, while you still can, from wherever you are.
- Best: RDP not reachable from the internet at all - only through a VPN or a Remote Desktop Gateway.
- Without a VPN: limit the firewall rule to the addresses you really use, keep Network Level Authentication on, use strong passwords.
- Not security: moving RDP to another port. Scanners find it anyway.
- Closed until unlocked: port knocking, or a signed unlock from your phone, opens RDP only for your own address, only for a while.
1. Why open RDP gets attacked
Port 3389 is on every scanner's list. Once found, bots try common user names (administrator, admin, user…) and leaked passwords, day and night. You see them as failed logons, Security event 4625. One weak or reused password is enough, and RDP itself has had serious security holes in the past, which an attacker can only use if the port is reachable.
2. The Windows-native options
VPN
The classic answer: RDP is reachable only on the LAN, and you connect a VPN first. Windows Server can be a VPN server itself (Routing and Remote Access), or your router or firewall does it. Very effective, but the VPN is now the door that must be kept patched and protected, and every user needs a VPN client set up.
Remote Desktop Gateway
A Windows Server role (part of Remote Desktop Services) that carries RDP inside HTTPS on port 443. Only the gateway is exposed, and it decides who may reach which computer. It can be combined with multi-factor authentication, for example with the NPS extension for Microsoft Entra multifactor authentication. A good fit for companies with several Servers; more to set up and maintain than a small office or a home PC needs.
Limit the firewall rule to your addresses
If RDP has to stay reachable, let only known addresses in: wf.msc › Inbound Rules › Remote Desktop - User Mode (TCP-In) (and UDP-In) › Scope › Remote IP address. The rule names (not the display names) are the same in every Windows language:
Set-NetFirewallRule -Name RemoteDesktop-UserMode-In-TCP,RemoteDesktop-UserMode-In-UDP -RemoteAddress 203.0.113.10,192.168.1.0/24(Windows 8 / Server 2012 and later; on older versions use the Scope tab.) This works well for fixed office addresses. It does not work when you travel, or when your home or mobile connection gets a new address every day.
Network Level Authentication
System Properties › Remote › Allow connections only from computers running Remote Desktop with Network Level Authentication. The user must authenticate before a session and the login screen are created. Keep it on. It reduces the attack surface, but it does not stop password guessing.
Strong passwords and account lockout
Long, unique passwords, and no account simply called administrator that is allowed to log on via RDP. An account lockout policy slows guessing down, but attackers can also lock out your real administrators with it.
MFA for RDP
Plain RDP has no second factor built in. Options are the RD Gateway with an MFA extension, smart cards or Windows Hello for Business in a domain, or a third-party credential provider that asks for a one-time code at logon. All of them still let strangers reach the login.
Changing the RDP port is not security
Moving RDP from 3389 to, say, 53389 (registry value PortNumber under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp) reduces log noise from the dumbest bots. Scanners that check all ports find RDP on any port within minutes. Treat it as cosmetics, never as protection.
3. Port knocking: closed until you knock
Port knocking keeps the port closed for everyone. A small program sends a secret sequence of packets to other, closed ports - the "knock". A service watching the firewall sees the right sequence and opens the real port for the sender's address only, for a short time. Scanners see nothing.
The idea is good; the classic form has weaknesses. Windows has no port knocking built in. The knock is plain packets that can be observed and replayed on the same network, and you need a knock client on every device. Newer variants (single packet authorization) sign the knock cryptographically to fix that.
At a glance
| VPN | RD Gateway | Firewall IP scope | Port knocking | Coinetic phone unlock | |
|---|---|---|---|---|---|
| Extra server or service to set up | Yes (VPN server) | Yes (Gateway role) | No | Yes (knock service) | No |
| Extra software on your device | VPN client | No (Remote Desktop client) | No | Knock client | No (phone browser) |
| Works when your address changes (mobile, hotel) | Yes | Yes | No | Yes | Yes |
| RDP opens only for you, then closes by itself | – | – | No (always open to the listed addresses) | Depends on the setup | Yes |
| Password guessers banned automatically | – | – | – | – | Yes |
| AI security analyst (Ask AI on any connection) | – | – | – | – | Yes (Pro + AI) |
A VPN or RD Gateway is a good choice if you already run one. The table only shows what each option needs and does for RDP.
4. Doing this by hand means…
- A VPN or gateway to run and patch, and a client on every laptop and phone.
- Address lists to maintain: each new home connection, hotel or mobile address means editing the firewall rule - or leaving it wide open "just for now".
- Attacks keep coming while RDP is reachable, at night too, and Windows does not block the guessing address.
- No alert when someone unknown does get a session.
5. With Coinetic: your RDP port is invisible to the internet - until you unlock it from your phone
Coinetic closes it, or makes it invisible forever or until you unlock it from your phone. If nobody needs RDP from outside, one click limits it to your own network and VPN for good. If you do need it, Device approval keeps it invisible until you unlock it:
Coinetic works through the Windows Firewall that is already there. Its Device approval ("Unlock from my phone") keeps the port closed to the internet: without an unlock, scanners and password guessers find nothing to attack. From your LAN and over a VPN, RDP always works.
How it works
- Register your phone once. In Coinetic: Security › Device approval…, choose the ports (e.g. RDP 3389) and how long an unlock lasts (default 8 hours), click Register phone and scan the QR code. Add the page to your phone's home screen.
- Tap Unlock when you need access. Open the page on your phone, tap Unlock and confirm with your fingerprint, face or PIN. Coinetic opens the port only for the internet address your phone is on.
- It closes itself. When the hours you chose are up, the port is closed again - no need to remember. The Coinetic Protection service does all of this in the background, also with nobody logged on.
Why it is safe
- Your phone signs every unlock with its passkey: exactly this computer, the phone's address, the ports, the hours, a one-time number and a time limit of a few minutes.
- Your computer checks the signature itself, with the phone's key it remembered when you registered the phone, and opens nothing unless everything matches.
- The relay server only passes messages on. Even someone who took it over could not open your port: they cannot sign as your phone, and a changed or unknown key is refused with a HIGH alert.
- Lost phone? Block it. Blocking or deleting a phone closes everything it opened at once - closing always works.
Compared with a VPN: a VPN remains a good option, especially for whole teams. Device approval needs no VPN server and no VPN client on your devices, and no address lists to maintain - just your phone. (If the Server is behind a router, the router still forwards the RDP port; the Windows Firewall keeps it closed until you unlock.)
And around it
- Every session is watched: each connection to the port is recorded with address, country and duration; an unknown session asks "was that you?", with No - ban + close port one click away.
- Password guessers are banned: Coinetic reads failed RDP logons and bans an internet address after the number of failures you choose. Your own network and whitelisted addresses are never banned.
- Open doors are found: the security scan shows ports open to the internet and can close one to your LAN and VPN with one click.
- Your AI security analyst (Pro + AI): right-click any line, ban, port or connection and choose Ask AI, e.g. “Who connected to RDP today, and was every session mine?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.
Download Coinetic, install, done - it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Is RDP safe without a VPN?
Not when it is open to the whole internet. It can be acceptable when the firewall lets in only known addresses, or when the port is closed until you unlock it, together with NLA and strong passwords.
Can I connect to RDP from my phone?
Yes, with Microsoft's Remote Desktop app for iOS and Android. The same rules apply: the phone's address must be allowed through, so with Coinetic you tap Unlock first, then connect.
Does changing the RDP port help?
It only reduces log noise. Scanners find RDP on any port. Close it or limit who can reach it instead.
What happens if I lose my phone?
In Coinetic, block or delete the phone in Security › Device approval: everything it opened is closed at once. From the LAN or a VPN, RDP keeps working.