|
1 | 1 | --- |
2 | | -title: Ports that are used by RDS |
3 | | -description: Introduces the ports that are required to open on firewalls in order to configure Remote Desktop (RD) Services correctly. |
| 2 | +title: Ports That Are Used by RDS |
| 3 | +description: Introduces the ports that are required to open on firewalls to configure Remote Desktop Services (RDS) correctly. |
4 | 4 | ms.date: 02/08/2025 |
5 | 5 | manager: dcscontentpm |
6 | 6 | audience: itpro |
7 | 7 | ms.topic: troubleshooting |
8 | 8 | ms.reviewer: kaushika |
9 | 9 | ms.custom: sap:Remote Desktop Services and Terminal Services\Deployment, configuration, and management of Remote Desktop Services infrastructure, csstroubleshoot |
10 | 10 | --- |
11 | | -# Ports that are used by RDS |
| 11 | +# Ports that are used by Remote Desktop Services |
12 | 12 |
|
13 | | -This article introduces the ports that are required to open on firewalls in order to configure Remote Desktop (RD) Services correctly. |
| 13 | +This article introduces the ports that need to be open on firewalls to configure Remote Desktop Services (RDS) correctly. |
14 | 14 |
|
15 | | -The information and taxonomy is broken down by role service and component, and lists all inbound and outbound ports used. |
| 15 | +The information and taxonomy are broken down by role, service, and component, and all inbound and outbound ports used are listed. |
16 | 16 |
|
17 | | -## From Client to RD Resource |
| 17 | +## From client to RD resource |
18 | 18 |
|
19 | | -- TCP 443 (HTTPS) Required if RDWeb is deployed. |
20 | | -- TCP and UDP 3389: Standard RDP port. Can be configured on host and client to a different port number. |
| 19 | +- TCP 443 (HTTPS): Required if RDWeb is deployed. |
| 20 | +- TCP and UDP 3389: Standard Remote Desktop Protocol (RDP) port. It can be configured to a different port number on the host and client. |
21 | 21 |
|
22 | 22 | ## Remote Desktop Connection Broker (RDCB) |
23 | 23 |
|
24 | | -- TCP 5504: Connection to RD Web Access |
25 | | -- TCP 3389: Connection to RD Session Host |
26 | | -- TCP 3389: Connection to non-managed VM pools, managed machines use VMBus to open port. |
27 | | -- TCP 3389: Client port for clients not using RD Gateway |
28 | | -- TCP 445 and RPC: Connection to RD Virtualization Host |
29 | | -- TCP 445 and RPC: Connection to RD Session Host |
30 | | -- TCP 5985: WMI and PowerShell Remoting for administration. |
| 24 | +- TCP 5504: Used for connections to RD Web Access. |
| 25 | +- TCP 3389: Used for connections to RD Session Host. |
| 26 | +- TCP 3389: Used for connections to non-managed VM pools. Managed machines use Virtual Machine Bus (VMBus) to open ports. |
| 27 | +- TCP 3389: Client port for clients not using RD Gateway. |
| 28 | +- TCP 445 and RPC: Used for connections to RD Virtualization Host. |
| 29 | +- TCP 445 and RPC: Used for connections to RD Session Host. |
| 30 | +- TCP 5985: Used by Windows Management Instrumentation (WMI) and PowerShell Remoting for administration. |
31 | 31 |
|
32 | 32 | ## Remote Desktop Gateway |
33 | 33 |
|
34 | | -### Inbound external internet based traffic from RD Clients to the Gateway |
| 34 | +### Inbound external internet-based traffic from RD clients to the Gateway |
35 | 35 |
|
36 | | -- TCP 443: HTTP (includes RPC over HTTP) over SSL. The port is configurable using RD Gateway Management console. |
37 | | -- UDP 3391: RDP over UDP. The port is configurable using RD Gateway Management console. |
| 36 | +- TCP 443: Used for HTTP (including RPC over HTTP) over SSL. This port can be configured using the RD Gateway Management console. |
| 37 | +- UDP 3391: Used for RDP over UDP. This port can be configured using the RD Gateway Management console. |
38 | 38 |
|
39 | 39 | > [!NOTE] |
40 | | - > Firewalls that have directional UDP analysis, such as TMG, require UDP "Send Receive" configured. |
| 40 | + > Firewalls that have directional UDP analysis, such as TMG, require UDP "Send Receive" to be configured. |
41 | 41 |
|
42 | 42 | ### Internal traffic between the Gateway and the required User AD, Resource AD, DNS, NPS and so on |
43 | 43 |
|
44 | | -- TCP 88: Kerberos for user authentication |
45 | | -- TCP 135: RPC Endpoint Mapper |
46 | | -- TCP 135: Port that NTDS RPC services listens on AD |
47 | | -- TCP and UDP 389: LDAP for user authentication |
48 | | -- TCP and UDP 53: Internal resource name resolution, DNS |
49 | | -- TCP and UDP 389: If using LDAP for Certificate Revocation List (CRL) |
50 | | -- TCP 80: If using HTTP for CRL |
51 | | -- TCP 21: If using FTP for CRL |
52 | | -- UDP 1812 and 1813: If NPS Server is being used. |
53 | | -- TCP 5985: WMI and PowerShell Remoting for administration |
| 44 | +- TCP 88: Used by Kerberos for user authentication. |
| 45 | +- TCP 135: Used by the Remote Procedure Call (RPC) Endpoint Mapper. It's the port on which the NTDS RPC services listen on Active Directory (AD). |
| 46 | +- TCP and UDP 389: Used by the Lightweight Directory Access Protocol (LDAP) for user authentication. It's required when using LDAP for Certificate Revocation Lists (CRLs). |
| 47 | +- TCP and UDP 53: Used by the Domain Name System (DNS) for internal resource name resolution. |
| 48 | +- TCP 80: Required when using HTTP for CRLs. |
| 49 | +- TCP 21: Required when using FTP for CRLs. |
| 50 | +- UDP 1812 and 1813: Required when Network Policy Server (NPS) is used. |
| 51 | +- TCP 5985: Used by WMI and PowerShell Remoting for administration. |
54 | 52 |
|
55 | | -### Internal traffic from the Gateway and the Internal Remote Desktop resources |
| 53 | +### Internal traffic from the Gateway and the internal RD resources |
56 | 54 |
|
57 | | -- TCP and UDP 3389: RDP |
| 55 | +- TCP and UDP 3389: Used by RDP. |
58 | 56 |
|
59 | 57 | > [!Note] |
60 | | - > Firewalls that have directional UDP analysis, such as TMG, require UDP "Send Receive" configured in the UDP protocol |
| 58 | + > Firewalls that have directional UDP analysis, such as TMG, require UDP "Send Receive" to be configured in the UDP protocol. |
61 | 59 |
|
62 | 60 | ## Remote Desktop Web Access |
63 | 61 |
|
64 | | -If RD Web Access is on a perimeter network, configure the following ports. |
| 62 | +If RD Web Access is on a perimeter network, configure the following ports: |
65 | 63 |
|
66 | 64 | - TCP: \<WMI Fixed Port\> |
67 | | -- TCP 5504: connection to RD Connection Broker for centralized publishing |
68 | | -- TCP 5985: WMI and PowerShell Remoting for administration |
| 65 | +- TCP 5504: Used for connections to RDCB for centralized publishing。 |
| 66 | +- TCP 5985: Used by WMI and PowerShell Remoting for administration。 |
69 | 67 |
|
70 | 68 | ## Remote Desktop Session Host |
71 | 69 |
|
72 | | -- RD License Server Port RPC |
73 | | -- TCP 389 and 636: Active Directory communication |
74 | | -- TCP 5985: WMI and PowerShell Remoting for administration |
| 70 | +- RD License Server: RPC ports. |
| 71 | +- TCP 389 and 636: Used for AD communication。 |
| 72 | +- TCP 5985: Used by WMI and PowerShell Remoting for administration。 |
75 | 73 |
|
76 | 74 | ## Remote Desktop Virtualization Host |
77 | 75 |
|
78 | | -- RD License Server Port RPC |
79 | | -- TCP 389 and 636: Active Directory communication |
80 | | -- TCP 5985: WMI and PowerShell Remoting for administration |
| 76 | +- RD License Server: RPC ports. |
| 77 | +- TCP 389 and 636: Used for AD communication. |
| 78 | +- TCP 5985: Used by WMI and PowerShell Remoting for administration. |
81 | 79 |
|
82 | 80 | ## Remote Desktop Licensing Server |
83 | 81 |
|
84 | 82 | For more information, see [RDS Licensing (RDSL)](../networking/service-overview-and-network-port-requirements.md#rds-licensing-rdsl). |
85 | 83 |
|
86 | 84 | ### TCP |
87 | 85 |
|
88 | | -- TCP 135: RPC for License Server communication and RDSH |
89 | | -- TCP 1024-65535 (randomly allocated): Used for RPC in Windows Server versions that is earlier than Windows Server 2008 (see next line). |
| 86 | +- TCP 135: Used for RPC for License Server communication and Remote Desktop Session Host. |
| 87 | +- TCP 1024-65535 (randomly allocated): Used for RPC in Windows Server versions that are earlier than Windows Server 2008. |
90 | 88 | - TCP 49152-65535 (randomly allocated): Used for RPC in Windows Server 2008 and later versions. |
91 | | -- TCP 445: SMB |
92 | | -- TCP 443: Communication over the internet to the Microsoft Clearing House. |
93 | | -- TCP 5985: WMI and PowerShell Remoting for administration |
94 | | -- TCP 139: NetBIOS session service |
| 89 | +- TCP 445: Used by the Server Message Block (SMB) protocol. |
| 90 | +- TCP 443: Used for communication over the internet to the Microsoft Clearing House. |
| 91 | +- TCP 5985: Used by WMI and PowerShell Remoting for administration. |
| 92 | +- TCP 139: Used by the NetBIOS session service. |
95 | 93 |
|
96 | 94 | For more information, see [How to configure RPC dynamic port allocation to work with firewalls](../networking/configure-rpc-dynamic-port-allocation-with-firewalls.md). |
97 | 95 |
|
98 | 96 | ### NetBIOS |
99 | 97 |
|
100 | | -- UDP 137: NetBIOS Name resolution |
101 | | -- UDP 138: NetBIOS Datagram Service |
102 | | -- UDP and TCP 389: LDAP that is used with per-user CALs against Active Directory |
| 98 | +- UDP 137: Used for NetBIOS name resolution. |
| 99 | +- UDP 138: Used by the NetBIOS Datagram Service. |
| 100 | +- UDP and TCP 389: Used by LDAP that is used with per-user CALs against AD. |
103 | 101 |
|
104 | | -From a proxy standpoint, the registry key `HKLM\Software\Microsoft\TermServLicensing\lrwiz\Params` shows the Microsoft service that the RD LS communicates with. |
| 102 | +From a proxy standpoint, the registry key `HKLM\Software\Microsoft\TermServLicensing\lrwiz\Params` shows the Microsoft service that the RD License Server communicates with. |
0 commit comments