---
title: RDP access should be restricted from the internet
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > RDP access should be restricted from
  the internet
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# RDP access should be restricted from the internet
 
## Description{% #description %}

This rule fails when an enabled ingress VPC firewall rule allows RDP traffic on port 3389 from `0.0.0.0/0` or `::/0`. RDP open to the internet exposes instances to brute-force and exploit attempts against the Remote Desktop service. A firewall rule matches when it allows `tcp`, protocol `6`, or all protocols, and its ports include 3389, include a range that covers 3389, or are omitted (which allows every port). Source ranges can be IPv4 or IPv6 CIDR blocks, and a rule with no source ranges, source tags, or source service accounts is treated as `0.0.0.0/0`, the GCP default. A missing direction is treated as ingress. Malformed rules fail even when another entry or the source range is valid, including an allow entry with no protocol, a port that is not a number or ascending `N-M` range within 0 to 65535, or an empty source entry. Disabled firewall rules and egress rules are skipped.

## Remediation{% #remediation %}

1. Edit the flagged firewall rule to allow port 3389 only from known source ranges, or delete it, by following [Use VPC firewall rules](https://docs.cloud.google.com/firewall/docs/using-firewalls).
1. For administrative access through [IAP for TCP forwarding](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding), allow ingress on port 3389 from `35.235.240.0/20` for IPv4 VMs or `2600:2d00:1:7::/64` for IPv6 VMs, using a separate firewall rule for each IP family when both are needed.

## References{% #references %}

- [VPC firewall rules](https://docs.cloud.google.com/firewall/docs/firewalls)
- [CIS Google Cloud Platform Foundation Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)