Forwarding TCP 3389 from a router to an office computer can be the quickest way to enable remote work. It is not a remote-access plan. It is a decision to let any host on the internet find the RDP login screen, with security depending on that single service and its users’ credentials.
Not every public service will be compromised. Public visibility does mean continuous contact with scans, password attempts, and logins using credentials stolen elsewhere. A non-standard port may reduce some log noise; it does not create a security boundary.
First confirm what is actually visible
Start with the address owner’s permission and a known scope. Record:
- the public address and port
- the destination host and NAT rule
- the service and its owner
- whether authentication has MFA
- which sources should be allowed
- where logs go and who reviews them
- the business reason for keeping access
Do not assume “the firewall is on” means there is no exposure. A router rule, a cloud provider control, and the host firewall are separate layers. The internet exposure worksheet helps collect them without scanning someone else’s ranges.
A password is not the only problem
If sign-in uses a password, it should be long and unique, but that does not remove the effects of phishing, token theft, or credentials stored on an infected computer. Account lockout may slow guessing, but poor settings may also let an attacker lock employees out. Patching reduces known vulnerabilities; it does not fix a valid login with a stolen account.
Remote access therefore needs several independent barriers:
- No direct RDP publication. The connection passes through a maintained VPN or remote-access gateway.
- MFA at the entry layer. Confirm that it covers the actual login flow, not only an administration portal.
- Source restrictions. If the company knows fixed addresses or networks, allow only those. This does not replace MFA, but it reduces exposure.
- Separate administration accounts and least privilege. Daily email should not share an account with server administration.
- Entry and host logs. Keep failed and successful attempts, the account, source address, zoned time, and rule changes.
A gateway or VPN is also an internet-facing service. It needs patching, configuration backups, account reviews, and monitoring. It does, however, move the entry point to a service that can be deliberately constrained and observed.
Where segmentation and isolation fit
A remote connection should not land in a flat network. Segmentation limits which systems the session can reach. Isolation separates the account, administrator workstation, and other paths so that one stolen login does not open the entire environment.
Plan the closure; do not switch off blindly
If RDP is public today, do not remove the rule before checking who uses it. Name the owner, prepare an alternative channel, test it from an external network, inform users, and only then close the forwarding rule. Record the change date and monitor rejected attempts and support reports for an agreed period.
If the port cannot be closed immediately, document the temporary state: allowed sources, Network Level Authentication (NLA) enabled, MFA, patching, alerts, the risk owner, and a firm date for removing the exception. “Temporary” without a date is permanent architecture.