PORT FORWARDING FOR RDP

Question

PORT FORWARDING FOR RDP

LGLDSR73-6492 1,480

I recently had a posted titled "RDP Into Win-11 Pro from Win-11 Home" and accepted the answer. Unfortunately I overlooked the following statement:

*"Since you’re connecting across locations, you’ll also need to enable VPN or forward port 3389 on the Massachusetts router to reach the system over the internet."

The original thread is located here.*

When I was a Network Administrator at Qualcomm I had many off-site End Users that I had to remote into. At no time did I have to setup Port Forwarding for them or use VPN. However, their systems were all using Windows-10 Professional and I left in 2019, well before Windows-11 was released.

Is this Port Forwarding requirement specific to Windows-11? Or because I will be using Windows-11 Home to remote into a system using Windows-11 Pro?

I am in Michigan, the Target system is in Massachusetts.

I apologize for the inappropriate Tag but nothing generated for RDP.

Thank you,

LGLDSR73

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

MUSTAFA SALAH 1,885

this is not a Windows 11 requirement, nor is it due to Windows 11 Home.

Important Note: Do Not Forward Port 3389

possible cases: NAT / Firewall / Dynamic IP assigned by ISP

LGLDSR73-6492 1,480 Reputation points

2026-07-01T11:37:30.6933333+00:00

IP assigned via DHCP from Router.

So this should work fine, correct?:

Step 1: Configure the Windows 11 Pro Computer (Host)

Before connecting, ensure the target Pro machine is permitted to receive remote connections.

On the Windows 11 Pro PC, press Windows Key + I to open Settings.

Click on System in the left menu, then select Remote Desktop.

Toggle the Remote Desktop switch to On.

Toggle the Remote Desktop switch to On.

Click Confirm on the pop-up window.

Look for the PC Name under the settings menu—you will need this exact name to connect later.

Step 2: Connect from the Windows 11 Home Computer (Client)

With Remote Desktop enabled on the Pro machine, you can now connect to it from your Home PC

On your Windows 11 Home PC, type Remote Desktop Connection in the taskbar search box and open it.

In the Computer field, type the PC Name or the IP Address of the Windows 11 Pro machine.

Click Connect.

When prompted for credentials, enter the username and password you use to sign in to the Windows 11 Pro computer.

Accept any certificate warnings that may appear, and your remote desktop session will launch
LGLDSR73-6492 1,480 Reputation points

2026-07-02T15:01:38.4466667+00:00

Can I please have some assistance with my question of Jul 1, 2026, 7:37 AM? Thank you.
MUSTAFA SALAH 1,885 Reputation points

2026-07-03T12:09:54.8266667+00:00
Dear LGLDSR73-6492,

For Simplicity, you can use:

Chrome Remote Desktop: https://remotedesktop.google.com/

AnyDesk: https://anydesk.com/

Any other 3rd-Party tool

<Install it on your remote PC and from any PC on any network you can access it only requirements: InternetConnection/PC Powered On. That's It>

In case of RDP (It's kinda complex not because of the implementation but because of the security - Of course you don't want someone online to hijack your system via RDP which is targeted).

Complex Solution:

I will assume you have PC-A & PC-B and you want to Access (PC-A) from anywhere as your remote

Also, I assume that you set a (Static IP) for PC-A & Enabled RDP Settings

Open your Router settings on Web Portal - Connected at PC-A and configure (Port Forwarding) - some times is called "Virtual Server" or other names depending on your model
Example:

Enter Port (Internal & External) as 3380, for internal IP (Enter the Static IP of the PC-A) for example 192.168.1.10

Now, get the Public IP of your router

From PC-B --> connect to the public IP of your router --> that will route the traffic to the PC-A automatically as it has RDP open&enabled --> Enter username+password of the PC-B account.

Note: Only issue you will encounter is that Public IP assigned by ISP is changing so you might need to get the new IP again. to fix this you can set up Dynamic DNS from the router settings.

Feel free to research the solution you will choose. However,

For Me, I will use (Chrome Remote Desktop) Easy and it Works! and Secure!

<Set it and forget it>

That's all,

Best,
MUSTAFA SALAH 1,885 Reputation points

2026-07-03T12:27:48.0966667+00:00
You may need to review:

Port Forwarding in your router settings: enable it for the static ip

Make sure that firewall allows RDP + 3389

If the 2 PCs are on the same network, you can use the private IP without port forwarding option.

If 2 PCs in different network, you need port forwarding + public IP
LGLDSR73-6492 1,480 Reputation points

2026-07-03T13:15:45.2233333+00:00
Thank you very much.

You wrote:

Port Forwarding in your router settings: enable it for the static ip

Make sure that firewall allows RDP + 3389

(1) I do not understand the reason for this. When I have used RDP to support Off-Site users at Lockheed, Raytheon and Qualcomm it was never necessary to do either #1 or #2. This was Windows 7 and Windows 10. At all three of these Corporations we were using DHCP assigned IP's for our local systems. The End Users were obviously on a different Network at their homes or at a DOD Contractors Site such as Northrup. DOD will not allow Port Forwarding.

(2) On Jun 30, 2026, 6:49 PM you stated "Important Note: Do Not Forward Port 3389". (see above).

(3) What I asked on Jul 1, 2026, 7:37 AM was taken from a MS document. Please see above.

Thank you very much for your assistance and please get back to me if you would.

Best,

LGLDSR73
MUSTAFA SALAH 1,885 Reputation points

2026-07-03T16:42:26.2766667+00:00

Hello LGLDSR73-6492,

(1) First 2 Steps are important if the 2 Devices on different networks. At you case, Organization/Work using same network and VPNs to connect it in one logical network.

"For Example: You need to access my laptop. You need to know my public IP and I need to enable port forwarding from my router to access my own laptop not other device in the network and I will enable port we agreed or the default 3389 and make sure RDP service is enabled + firewall is ok" --> Security is the answer + you will need username + password I 've to share with you so that you can intiate the session and authenticate.

(2) Yes, I do mentioned 3389 because is targeted by attackers since it's known one and if someone found that you have opened 3389 port. they may attempt to access --> again, security.

(3) can you please provide doc link

Regards,
LGLDSR73-6492 1,480 Reputation points

2026-07-03T17:28:39.5333333+00:00

"At you case, Organization/Work using same network and VPNs to connect it in one logical network."

No, you are not understanding me. Say I am at Lockheed in my Office on their Network. John Doe is at his home using Comcast. They are not on the same Network. In the hundreds of times I have remoted into systems it was never, ever necessary to open any Ports when using RDP.

I no longer have the URL to that document (I wish I did), but that came from MS and that is the entirety of the steps. It makes no mention of opening any Ports.
MUSTAFA SALAH 1,885 Reputation points

2026-07-03T21:06:04.9666667+00:00

Hello LGLDSR73-6492,

You are 100% right that you didn't have to open any ports. The reason it feels like magic is because Lockheed's IT department already did the heavy lifting for you so you wouldn't have to touch your home router.

So, a port was open. It's just open on Lockheed’s side, not yours. If Lockheed's IT team closed every single port on their firewall, your remote desktop wouldn't be able to connect, no matter what you did at home.

<Corporate VPN, RD Gateway, other solutions> --> doesn't need ports to open except for their underlying network ex. HTTPS /IPsec /.... other suite of protocols that support that.

That's all I know from my technical knowledge I have.

The thing is: there are a lot of changes nowadays because of the security and it changes how everything works from the (hardware /software /cloud /.... etc.)

I Shared with you the easy solution available that is secure and no network overhead or any vulnerabilities invovles.

Best of Luck,

Mustafa Salah
LGLDSR73-6492 1,480 Reputation points

2026-07-04T11:34:05.03+00:00
"You are 100% right that you didn't have to open any ports. The reason it feels like magic is because Lockheed's IT department already did the heavy lifting for you so you wouldn't have to touch your home router."

I was INSIDE Lockheed going OUTBOUND to employees home Routers, not my home Router.

"I Shared with you the easy solution available that is secure and no network overhead or any vulnerabilities invovles."

You mean with Chrome?

LGLDSR73
MUSTAFA SALAH 1,885 Reputation points

2026-07-05T13:03:41.39+00:00

If you are asking about (How) and (Why) in the past configs. Actually, I don't know.

If you don't have already MS Docs or has been already updated, I can't help.

That's All from my Side!

If you need remote access to your devices, You can go with (RDP /SSH /VNC) or using (Chrome Remote Desktop or any other Software).

That's it.

Best Regards,
MUSTAFA SALAH 1,885 Reputation points

2026-07-05T13:04:13.1933333+00:00

https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-allow-access
LGLDSR73-6492 1,480 Reputation points

2026-07-05T15:19:00.3166667+00:00

Thank you. Please close this Ticket, I am not seeing where I can select 'Best Answer'.

Best,

LGLDSR73
MUSTAFA SALAH 1,885 Reputation points

2026-07-05T18:42:49.5966667+00:00

FYI: I am a community volunteer.

If you require more support, Feel free to contact Microsoft support team: https://support.microsoft.com/contactus

Best,
Eric Tang 0 Reputation points

2026-09-16T04:24:30.9166667+00:00
Port forwarding was never actually required for RDP — and it isn't new to Windows 11. What changed is the network you're on.

At Qualcomm, your off-site users almost certainly reached those machines over an existing private path — a corporate VPN, MPLS/site-to-site links, or DirectAccess — so from the RDP client's view the target was already "on the network," and no per-machine port forwarding was needed. RDP just needs a route to TCP 3389 on the target; it doesn't care how that route exists.

Across the public internet with no such path, you have to create one. Options, best-to-worst:

VPN / overlay mesh (recommended): the target and your client both join a private network — the router/firewall's built-in VPN, or a mesh like Tailscale/ZeroTier/WireGuard. RDP then works exactly like it did at Qualcomm — no port forwarding, nothing exposed to the internet.

Reverse/agent-based tools (RustDesk, ScreenConnect, etc.): a small agent on the target dials outbound to a relay and you connect through it. No inbound rule, works behind CGNAT.

Port-forwarding 3389 (not recommended): it works, but exposes RDP directly to the internet — among the most brute-forced ports there is. If you must, restrict the source IP and require Network Level Authentication.

So it isn't a Win11-vs-Win10 or Home-vs-Pro thing — Home just can't host incoming RDP (only Pro can be the target), which is separate from the network-path question. Give the target a private path (VPN/mesh) and skip port forwarding entirely.