How to Enable RDP Port (3389) Access in Sophos Firewall

RDP (Remote Desktop Protocol) allows remote access to Windows systems using port 3389. To enable secure RDP access through Sophos Firewall (SFOS), you must create a firewall rule and NAT rule (if accessing from WAN). Below are the complete steps for both internal and external RDP setups.

Step-by-Step Guide to Enable RDP in Sophos Firewall

Step 1: Login to Sophos Firewall

1. Open: https://<firewall-ip>:4444

2. Login as admin.

Step 2: Create Service Definition (if missing)

Go to System → Hosts and Services → Services → Add

• Name: RDP

• Type: TCP

• Destination Port: 3389

• Source Port: 1:65535

• Click Save.

?️ Case 1: Internal RDP (LAN to LAN)

If you want RDP between internal systems:

1. Go to Rules and Policies → Firewall Rules → Add Rule

2. Source Zone: LAN

3. Destination Zone: LAN

4. Source Network: PC/Network needing access

5. Destination Network: Target server (e.g., 192.168.1.10)

6. Service: RDP

7. Action: Allow

8. Click Save → Enable Rule

You can now RDP directly within your LAN.

? Case 2: External RDP (WAN to LAN)

If you need to access RDP from the Internet, you must create DNAT and a WAN-to-LAN rule.

Step 2.1: Create NAT Rule

Go to Rules and Policies → NAT Rules → Add NAT Rule

• Original Source: Any

• Original Destination: WAN IP

• Translated Destination: Internal Server IP (e.g. 192.168.1.10)

• Service: RDP (TCP 3389)

• Save.

Step 2.2: Create Firewall Rule

Go to Rules and Policies → Add Rule

• Source Zone: WAN

• Destination Zone: LAN

• Source Network: Any (or specific IP for safety)

• Destination Network: Internal Server IP

• Service: RDP

• Action: Allow

• Save & Move rule to top.

Step 3: Test RDP

From outside:

mstsc → your_public_IP

From inside:

mstsc → 192.168.1.10

If connection succeeds, your RDP port (3389) is open and allowed.

Security Tips

• Restrict RDP access by IP address.

• Use VPN (SSL/IPSec) instead of exposing port 3389.

• Change RDP port to a non-default number.

• Keep Windows firewall and passwords secure.

Conclusion

Sophos Firewall makes it easy to enable and control RDP connections using simple firewall and NAT rules. For best security, always limit access to trusted IPs or route through a VPN.