How to Port Forward RDP (Port 3389) to Access Your PC Remotely: A 5-Step Guide

The core step is forwarding external port 3389 on your router to the internal IP address of the PC you want to reach. Once that’s set up, you can connect to Remote Desktop from anywhere using just your public IP and port number. That said, exposing this port with default settings carries real security risk, so make sure to read the precautions at the end along with the steps below.

Before you start

Remote Desktop can only be hosted on Windows Pro or higher editions. Port forwarding also breaks the moment your PC’s internal IP changes, so set up a static IP or a DHCP reservation on your router before doing anything else.

Port forwarding in 5 steps

1. Step 1: Confirm Remote Desktop is enabled. Check Windows Settings > System > Remote Desktop and make sure the toggle is on.
2. Step 2: Assign your PC a static internal IP. Use your router’s DHCP reservation feature so the PC always keeps the same internal IP address.
3. Step 3: Open your router’s port forwarding settings. Log into your router’s admin page (often 192.168.0.1 or 192.168.1.1) and find the “Port Forwarding” or “Virtual Server” menu.
4. Step 4: Add the forwarding rule. Enter the external port, internal port, and your PC’s internal IP, and set the protocol to TCP.
5. Step 5: Allow it through the firewall and test the connection. Confirm Windows Firewall allows Remote Desktop, then test the connection from an external network (like mobile data) using your public IP and port.

Security precautions you shouldn’t skip

Leaving port 3389 exposed on its default number makes it an easy target for automated brute-force attacks. Where possible, change the external port to something other than 3389, restrict access to a whitelist of known IPs, and make sure the account uses a strong password with two-factor authentication.

If opening a port and exposing your public IP feels like more risk than it’s worth, a remote control SaaS that connects through an encrypted relay without opening any inbound port is a solid alternative. For teams that work remotely or travel often, this approach can be a simpler and safer way to reach a remote PC without touching router settings at all.

For environments managing multiple PCs remotely, a service like Y-Remote, with per-account permissions and connection logs, can help.