Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this situation:

network mask.

  • router/gateway: Ubuntu server (only command line, no gui) with internal lan ip and a dynamic dns on the external ip

  • Windows pc on with RDP (remote desktop connection) enabled on 3389

I want to forward the RDP service on the external address: how can i do that?

What are the iptables rules I need to connect to my Windows pc from the outside world?

share|improve this question
Q. What port does Remote Desktop use? Does everything go over port 3389? A. Port 3389 is the only port you need to open. Windows will attempt to stream sound through User Datagram Protocol (UDP) first. If no port is available for UDP, sound will stream through a virtual channel in Remote Desktop Protocol, which uses port 3389. – brandstaetter Dec 1 '09 at 13:56
3389, as i wrote before. Yes, i need only 3389 udp, but i don't know how to "construct" iptables rules for that forwarding.. i need a hint, googled it but i haven't found a clear explanation :( – apelliciari Dec 1 '09 at 14:28

So just giving you this rule probably won't be enough. Here's why: I'm not sure if (a) it'll work right (haven't tested it) and (b) if it does work it'll do more than work - it'll probably forward RDP packets to ANY machines in your network. The dilemma is, how to get the right IP address for the -d nnn.nnn.nnn.nnn/nnn argument. So... buyer beware; if 0/0 works it'll probably work to ALL machines behind your router.

Anyways, here you go:

iptables -A FORWARD -p tcp -s 0/0 -d 0/0 --destination-port 3389 -j ACCEPT

Here's some good reading on iptables:


share|improve this answer
Also you might have to repeat the line with "-p udp" instead of "-p tcp" – pbr Dec 1 '09 at 21:45

You need to create a destination NAT (DNAT) rule to map the RDP (3389) on your internet connection's IP address to your internal systems IP address. Something like this:

iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 3389 -j DNAT --to

Replace $EXTIF with your external ethernet adapter (eth0, etc1,...). You can read this for more information (or if I got something wrong in this example, I didn't test it)

share|improve this answer

just port foward 3389 tcp and udp to the computer that has the remote desktop enabled. Then figuar out you external ip by going to a speedtesting website. Once done then all you need to get to your desktop is to type your external or GLOBAL ip address into a remote desktop terminal. user/password. done.

to port foward 3389 you need to enter your router and add that rule. there is no routing table you need to add. just that rule.

share|improve this answer
i need that iptable rule! i don't know the right syntax to forward 3389 tcp and udp to that computer from the server – apelliciari Dec 1 '09 at 16:18
using you can go over your basics and start your model for your system. not using a standard router and tring to use a linux server is great but you i need to know your set up before i can give you the syntax but this website should clear up setting your iptables and ipchains for port forwarding – mike Dec 2 '09 at 8:28

Here is the rule you need:

iptables -t filter -A rdp -p tcp --dport 3389 -m state --state NEW -j ACCEPT -m comment --comment "rdp"

share|improve this answer

I would also suggest using a random port number from the outside... it's security by obscurity, but if you have port 3389 open on the outside of your home router, an attacker will easily see this and try to brute-force their way in to your system.

Any port above 1024 will work.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .