Remote Desktop Protocol (RDP) lets you control a Windows computer from anywhere over the internet. It is built into Windows and widely used for remote work, IT management, and accessing home or office computers while traveling.
The security problem: RDP is one of the most attacked services on the internet. Scanners probe for open RDP ports (default: 3389) constantly. If your computer is exposed with weak credentials, attackers can brute-force their way in.
A VPN solves this by removing RDP from the public internet entirely. Your RDP port is only accessible to devices connected to the same VPN network.
Why RDP without a VPN is dangerous
Every device with a public IP address receives thousands of automated connection attempts per day from bots scanning for vulnerable services. RDP on port 3389 is one of the most targeted services because:
Credential attacks work. Many users leave default administrator credentials or use weak passwords on RDP. Automated tools can test millions of credential combinations.
RDP vulnerabilities exist. Several critical vulnerabilities in Windows RDP have been discovered (BlueKeep, DejaBlue, others), some of which allow remote code execution without authentication.
Ransomware groups specifically target exposed RDP. A significant portion of enterprise ransomware infections in recent years began with an attacker gaining access through exposed RDP.
The Microsoft Defender threat data consistently lists RDP brute-forcing among the top attack vectors for Windows systems.
How a VPN protects RDP
When you put your remote computer on a private VPN network:
Port 3389 is not exposed to the public internet. It only listens for connections from devices within the VPN network.
Attackers cannot find or probe the RDP port from the public internet. The attack surface effectively disappears.
Traffic between your client device and the remote computer is encrypted by the VPN tunnel.
This setup does not eliminate all RDP risk (you still need strong credentials, updated Windows, and MFA), but it removes the exposure to automated internet scanning, which is the dominant attack vector.
Setup approach 1: Site-to-site VPN with NordLayer
For businesses with multiple offices or remote employees, NordLayer (NordVPN’s business product) provides a site-to-site VPN that creates a shared private network for all connected devices.
In this setup, office computers with RDP enabled are only accessible from devices that are authenticated to the NordLayer account. Remote employees connect their laptop to NordLayer, which gives them access to office systems as if they were on the local network.
Setup approach 2: Tailscale (peer-to-peer mesh VPN)
Tailscale is a mesh VPN built on WireGuard that creates secure connections between specific devices without a central VPN server. It is free for personal use (up to 100 devices) and popular among developers and small teams.
Setting up Tailscale for RDP
Install Tailscale on the computer you want to connect to remotely (your “host” machine). Download from tailscale.com and sign in with your Google, Microsoft, or email account.
Install Tailscale on the client device (laptop, desktop) you will connect from.
Both devices appear in your Tailscale dashboard at tailscale.com. Each device gets a stable private IP address (in the 100.x.x.x range).
From your client device, open Remote Desktop Connection (Windows) or Microsoft Remote Desktop (macOS, iOS, Android). Enter the Tailscale IP address of your host machine (for example, 100.92.15.3).
Connect with your Windows credentials. The connection is routed through the Tailscale encrypted tunnel.
Your RDP port is never exposed to the public internet. The connection only works between devices enrolled in your Tailscale account.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Setup approach 3: Consumer VPN with port forwarding
Some consumer VPNs offer port forwarding as a feature, which allows a specific port on the VPN server to be mapped to a port on your computer. This can enable RDP access through the VPN, but it re-exposes the port, just through a different IP address.
This approach is less secure than a true private network setup and is not recommended for production use. It partially solves the problem (different IP, less visible to scanners) but does not eliminate it.
RDP security hardening beyond the VPN
Even with a VPN protecting your RDP:
Enable Network Level Authentication (NLA). NLA requires credentials before the RDP session is established, rather than at a visible login screen. This prevents unauthenticated access to the RDP service itself.
Use a non-standard port. Changing RDP from the default 3389 to a non-standard port (for example, 50000) does not improve security if the port is exposed, but reduces automated scanner noise. Combined with a VPN, the port does not matter, but it is good practice.
Enable Windows Defender Firewall rules to restrict RDP to specific IP addresses or network interfaces.
Use strong passwords and account lockout policies. After N failed login attempts, lock the account for a period of time. This defeats most brute-force attacks even if RDP is somehow accessible.
Keep Windows updated. RDP vulnerabilities in Windows are patched promptly by Microsoft. Running an unpatched Windows version with RDP exposed is high-risk.
Never expose RDP directly to the internet without a VPN or similar access control. Tailscale is the easiest solution for personal use: free, WireGuard-based, zero configuration. NordLayer is better for business teams needing centralized management. Combined with strong credentials and NLA, this setup reduces RDP attack surface to near zero.
Keep reading: Best VPN for Remote Work in 2026 and VPN vs Zero Trust (ZTNA): Which Does Your Business Actually Need?.