Cantech Cloud

Category: Support

  • How to Use UFW Firewall on Linux

    1. Overview

    UFW (Uncomplicated Firewall) is a simple command-line tool used to manage firewall rules on Linux systems, primarily Ubuntu and Debian-based distributions.

    UFW is installed by default on most Ubuntu Server installations, but it is not enabled by default. You must enable it manually after configuring the required firewall rules.

    This guide explains how to install, configure, and manage UFW.

    2. Prerequisites

    Before you begin, ensure that you have:

    • A Linux server running Ubuntu or Debian.
    • Root or sudo privileges.
    • SSH access already configured if you are managing the server remotely.

    3. Verify That UFW Is Installed

    Check whether UFW is installed:

    Bash
    which ufw

    If UFW is not installed, install it using:

    Bash
    sudo apt install ufw -y

    4. Check the UFW Status

    View the current firewall status:

    Bash
    sudo ufw status

    5. Configure Default Firewall Policies

    It is recommended to configure the default firewall policies before enabling UFW.
    Block all incoming connections:

    Bash
    sudo ufw default deny incoming

    Allow all outgoing connections:

    Bash
    sudo ufw default allow outgoing

    This configuration blocks all incoming traffic while allowing all outgoing traffic.

    6. Allow Required Services

    Before enabling UFW, allow any services that require network access.

    Allow SSH
    For the default SSH port:

    Bash
    sudo ufw allow ssh

    If SSH uses a custom port (for example, 2222):

    Bash
    sudo ufw allow 2222/tcp

    Note: Allow SSH before enabling UFW to avoid losing remote access.

    Allow HTTP and HTTPS

    Bash
    sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

    Allow MySQL

    Bash
    sudo ufw allow 3306/tcp

    Allow Traffic from a Specific IP Address

    Bash
    sudo ufw allow from 192.168.xx.xx

    7. Enable UFW

    Before enabling the firewall, verify that SSH access has been allowed.

    Check the current rules:

    Bash
    sudo ufw status

    Ensure that one of the following rules is present:

    • OpenSSH
    • 22/tcp
    • Your custom SSH port (for example, 2222/tcp)

    Important: If SSH is not allowed before enabling UFW, you may lose remote access to the server.
    Enable the firewall:

    Bash
    sudo ufw enable

    Display the current firewall configuration:

    Bash
    sudo ufw status verbose

    8. Enable UFW Logging

    Enable logging for monitoring and troubleshooting:

    Bash
    sudo ufw logging on

    9. Verify IPv6 Support

    If IPv6 is enabled on the server, verify that UFW is configured to manage IPv6 traffic.
    Check the UFW configuration:

    Bash
    sudo grep IPV6 /etc/default/ufw

    If IPv6 support is disabled in UFW, services may still be accessible over IPv6 even when IPv4 access is restricted.

    10. Cloud Security Groups and UFW

    Cloud Security Groups operate at the network level, while UFW operates inside the Linux operating system.

    • Cloud Security Groups determine whether traffic can reach the Virtual Machine.
    • UFW determines whether traffic is allowed or blocked inside the Virtual Machine.

    How They Work Together

    • If a port is blocked by the Cloud Security Group, traffic will not reach the Virtual Machine, even if UFW allows it.
    • If a port is allowed by the Cloud Security Group, UFW can still block access inside the Virtual Machine.

    Best Practice

    For improved security, use both:

    • Cloud Security Groups as the first layer of protection.
    • UFW as the second layer inside the server.

    11. View Firewall Rules with Numbers

    Display all configured firewall rules with line numbers:

    Bash
    sudo ufw status numbered

    This makes it easier to identify and remove specific rules.

    12. Remove a Firewall Rule

    First, display the numbered rules:

    Bash
    sudo ufw status numbered

    Remove a rule by specifying its number:

    Bash
    sudo ufw delete <rule_number>

    Example:

    Bash
    sudo ufw delete 3

  • How to Set a Password on a Linux Virtual Machine

    1. Overview

    This guide explains how to set or reset the password of a newly created or existing Linux Virtual Machine (VM).

    2. Set or Reset the Password

    Step 1: Log In to the Cloud Dashboard

    Sign in to the Cloud dashboard using your account credentials.

    Step 2: Select the Virtual Machine

    Navigate to the list of Virtual Machines and select the Linux VM for which you want to set or reset the password.

    Step 3: Open the Console

    Click the Console drop-down menu.

    Console

    Step 4: Log In to the Virtual Machine

    Log in to the Virtual Machine using the existing password.

    If you do not have a password, refer to the appropriate article to set the initial password before continuing.

    Console

    Step 5: Change the Password

    Run the following command to set a new password:

    Bash
    passwd <username>

    For most Linux images, the default user is root.
    Example:

    Bash
    passwd root

    After entering and confirming the new password, use the updated credentials for future logins.

    Console root

    3. Password Requirements

    When creating a new password, follow these guidelines:

    • Minimum length of 12–16 characters.
    • Include uppercase letters, lowercase letters, numbers, and special characters (such as @, #, $).
    • Avoid common or easily guessed words.
    • Do not reuse previously used passwords.

    Following these guidelines helps improve the security of your Virtual Machine and reduces the risk of unauthorized access.

  • How to Set the Password for a Newly Created Virtual Machine from the Advance Panel

    1. Overview

    This guide explains how to set or reset the login password for a Virtual Machine (VM) using the Cloud Advance panel.

    You can use this feature to:

    • Set the initial password for a newly created VM.
    • Reset a forgotten password.
    • Update the existing password for security purposes.

    2. Prerequisites

    Before setting or resetting the password, ensure that:

    • The Virtual Machine is in the Running state.

    Note: The password cannot be set or reset if the VM is powered off. Start the VM before proceeding.

    3. Set the VM Password

    Step 1: Open the Virtual Machine

    1. Log in to the Cloud Advance panel.
    2. From the left navigation menu, select Virtual Machines.
    3. Click the name of the Virtual Machine.
    4. Click Set Password.

    PasswordNote: If the Set Password option is unavailable or disabled, the QEMU Guest Agent may not be installed or running.

    4. QEMU Guest Agent Requirement

    The Set Password feature requires the QEMU Guest Agent to be installed and running inside the Virtual Machine.

    This feature works automatically on standard operating system images such as:

    • Ubuntu
    • Debian
    • CentOS

    It may not be available on Virtual Machines created from custom ISO images.

    5. Enter or Generate a Password

    You can choose either of the following options:

    • Click Generate Password to automatically create a strong password.
    • Enter a new password manually.

    6. Apply the Password

    1. Click Set.
    2. Wait for the confirmation message indicating that the password has been updated successfully.

     

    Set

    7. Default User Accounts

    The password is applied to the default operating system user.
    Operating System         Default User
    Ubuntu                                 root
    Debian                                  root
    CentOS / Rocky Linux root
    Windows                             Administrator

    8. Password Requirements

    The new password must meet the following requirements:

    • Minimum length of 12–16 characters.
    • Include uppercase letters, lowercase letters, numbers, and special characters (such as @, #, $).
    • Avoid common or easily guessed words.
    • Do not reuse previously used passwords.

    Following these guidelines helps improve the security of your Virtual Machine.

    9. Verify the New Password

    After setting or resetting the password, verify that you can log in successfully.

    Windows Virtual Machines

    Note: Before connecting through RDP, ensure that port 3389 is allowed in the Cloud Security Group. If port 3389 is blocked, the RDP connection will fail even if the password has been updated successfully.

    1. Open a new Remote Desktop (RDP) connection.
    2. Connect to the VM using its IP address.
    3. Enter the Administrator username and the new password.
    4. Verify that the login is successful.

    Linux Virtual Machines

    Note: Before connecting through SSH, ensure that port 22 is allowed in the Cloud Security Group. If port 22 is blocked, the SSH connection will fail even if the password has been updated successfully.

    Open a terminal and connect to the VM using SSH:

    Bash
    ssh username@<VM_IP>

    Enter the username and the new password to verify that the login is successful.

  • How to Secure the SSH Port in Linux

    1. Overview

    Securing SSH access helps protect your Linux server from unauthorized access and automated attacks.

    This guide explains how to secure the SSH service on Ubuntu and AlmaLinux, including operating system-specific commands where required.

    2. Change the Default SSH Port

    Changing the default SSH port (22) can help reduce automated scanning and attack attempts.

    Step 1: Edit the SSH Configuration

    Open the SSH configuration file:

    Bash
    sudo nano /etc/ssh/sshd_config

    Locate the following line:

    Port 22

    Change it to a different port number, for example:

    Port 24357

    Note: Choose a port number between 1024 and 65535.

    Step 2: Restart the SSH Service

    Ubuntu

    Bash
    sudo systemctl restart ssh

    AlmaLinux

    Bash
    sudo systemctl restart sshd

    3. Update Firewall Rules

    Allow the new SSH port through the firewall before restarting the SSH service.

    Ubuntu (UFW)

    Bash
    sudo ufw allow 24357/tcp
sudo ufw enable

    AlmaLinux (firewalld)

    Bash
    sudo firewall-cmd –permanent –add-port=24357/tcp
sudo firewall-cmd –reload

    4. Disable Root Login

    Disabling direct root login provides an additional layer of security.

    Open the SSH configuration file:

    Bash
    sudo nano /etc/ssh/sshd_config

    Add or update the following setting:

    PermitRootLogin no

    Restart the SSH service after saving the changes.

    5. Use SSH Key Authentication

    SSH key authentication is more secure than password-based authentication.

    Option A: Use the SSH Key Pair Generated During VM Creation

    When creating the Virtual Machine, select the option to generate a new SSH key pair.

    A .pem file (for example, MYSSHKey.pem) will be downloaded to your local computer.

    Set the correct file permission:

    Bash
    chmod 400 MYSSHKey.pem

    Navigate to the directory containing the key:

    Bash
    cd Downloads/

    Connect to the server using the SSH key:

    Bash
    ssh -i MYSSHKey.pem root@your-server-ip -p 24357

    Note: No password is required when using the .pem file provided during VM creation.

    Option B: Generate an SSH Key Pair on Your Local Machine

    Generate a new SSH key pair:

    Bash
    ssh-keygen -t rsa -b 4096

    The keys are created in the following locations:
    Public key: ~/.ssh/id_rsa.pub
    Private key: ~/.ssh/id_rsa
    Note: Do not share your private key.

    Copy the Public Key to the Server

    Run:

    Command Prompt
    ssh-copy-id -p 24357 root@your-server-ip

    Enter the user’s password when prompted.
    Alternatively, copy the contents of:

    ~/.ssh/id_rsa.pub

    to:

    ~/.ssh/authorized_keys

    on the remote server.

    Set the Correct Permissions

    Bash
    chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

    Disable Password Authentication

    Edit the SSH configuration file:

    Bash
    sudo nano /etc/ssh/sshd_config

    Update the following settings:

    PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

    Restart the SSH service after saving the configuration.

    6. Install and Configure Fail2Ban

    Fail2Ban helps protect the server from brute-force login attempts.

    Install Fail2Ban

    Ubuntu

    Bash
    sudo apt install fail2ban

    AlmaLinux

    Bash
    sudo dnf install epel-release -y
sudo dnf install fail2ban -y

    Enable and Start the Service

    Bash
    sudo systemctl enable fail2ban –now

    Configure Fail2Ban (Optional)

    Create or edit the following configuration file:

    Bash
    /etc/fail2ban/jail.local

    Enable the SSH jail as required.

  • How to Reset the Password of a Windows Virtual Machine

    1. Overview

    This guide explains how to reset the Administrator password of a Windows Virtual Machine (VM) using the Cloud dashboard.

    2. Prerequisites

    Before resetting the password, ensure that:

    • You have access to the Cloud dashboard.
    • The Windows Virtual Machine is in the Running state.

    Note: Password reset is available only when the VM is powered on. If the VM is stopped, start it before proceeding.

    3. Reset the Windows VM Password

    Step 1: Log In to the Cloud Dashboard

    Sign in to the Cloud dashboard using your account credentials.

    Step 2: Open the Virtual Machines List

    1. Navigate to the list of Virtual Machines.
    2. Select the Windows VM for which you want to reset the password.

    Dashboard

    Step 3: Open the Action Menu

    From the VM details page, click the Action drop-down menu.

    Select Set Password.

    Step 4: Enter a New Password

    Enter a new password for the Windows VM.

    Step 5: Apply the Password

    Click Set to apply the new password.

    The password for the Administrator account will be updated.

    4. Password Requirements

    The new password must meet the following requirements:

    • Minimum length of 12–16 characters.
    • Include uppercase letters, lowercase letters, numbers, and special characters (such as @, #, $).
    • Avoid common or easily guessed words.
    • Do not reuse previously used passwords.

    Following these guidelines helps improve the security of your virtual machine.

    5. Verify the New Password

    After resetting the password, verify that you can log in successfully.

    For Windows Virtual Machines:

    Note: Before connecting through RDP, ensure that port 3389 is allowed in your Cloud Security Group. If port 3389 is blocked, the RDP connection will fail even if the password has been reset successfully.

    1. Open a new Remote Desktop (RDP) connection to the VM’s IP address.
    2. Enter the Administrator username and the new password.
    3. Confirm that you can successfully log in.

    6. Troubleshooting

    Unable to Connect Through RDP After Password Reset

    If the password reset is successful but the RDP connection fails, verify the following:

    • Firewall / Security Group: Ensure TCP port 3389 is allowed for your IP address in the Cloud Security Group.
    • VM Status: Confirm that the VM is still in the Running state.
    • Username: Verify that you are signing in with the Administrator account.

     

  • How to Delete an Old Virtual Machine and Create a New Virtual Machine with the Same IP Address

    1. Overview

    This guide explains how to delete an existing Virtual Machine (VM) and create a new VM using the same IP address.

    2. Delete the Existing Virtual Machine

    1. Log in to the Cloud dashboard.
    2. Navigate to Infrastructure → Virtual Machines.
    3. Locate the VM that is using the IP address you want to reuse.
    4. Open the Actions menu (⋯).
    5. Click Delete.

    Dashboard

    3. Create a New Virtual Machine

    1. Start the process to create a new Virtual Machine.
    2. During the configuration, go to Network Interfaces.
    3. Click Edit.

    Network

    4. Assign the Existing IP Address

    In the Edit Network window:

    1. Clear the Auto option.
    2. Enter the IP address of the deleted VM in the Primary IP field.
    3. Click Save.

    Network

    5. Result

    The new Virtual Machine will be created using the same IP address that was assigned to the previous VM.

  • How to Copy Files Over SSH Using rsync

    1. Overview

    This guide explains how to securely copy files from one server to another using rsync over SSH.

    Using rsync over SSH is a secure and efficient method for transferring and synchronizing files. It is commonly used for backups, data migration, and scheduled file synchronization.

    2. Prerequisites

    Before you begin, ensure that:

    • SSH access is enabled on both servers.
    • rsync is installed on both servers.
    • You have root or sudo privileges.

    3. Install rsync

    If rsync is not already installed, install it on both the source and destination servers.

    Debian / Ubuntu

    Bash
    apt install rsync -y

    CentOS / RHEL / AlmaLinux

    Bash
    yum install rsync -y

    4. Configure SSH Key-Based Authentication

    To avoid entering the SSH password for every rsync operation, configure SSH key-based authentication from the source server to the destination server.

    Step 1: Generate an SSH Key Pair

    On the source server, run:

    Bash
    ssh-keygen -t rsa -b 4096 -C “rsync-ssh-key”
    • Press Enter to accept the default location (/root/.ssh/id_rsa).
    • Leave the passphrase empty if passwordless authentication is required.

    Step 2: Copy the Public Key to the Destination Server

    Run the following command:

    Bash
    ssh-copy-id root@destination-vm

    This copies the public key (id_rsa.pub) to the destination server and adds it to the ~/.ssh/authorized_keys file.

    Step 3: Verify the SSH Connection

    Test the SSH login:

    ssh root@destination-vm

    If the configuration is successful, you should be able to log in without entering a password.

    5. Copy Files Using rsync

    Use the following command to copy files over SSH:

    Bash
    rsync -avz -e ssh /path/to/source-directory/ root@destination-vm:/path/to/destination-directory/

    Command Options :
    -a
    Archive mode. Preserves file permissions, timestamps, and symbolic links.

    -v
    Displays detailed output during the transfer.

    -z
    Compresses data during transfer.

    -e ssh
    Uses SSH as the transport protocol.

    6. Example: Copy a Directory

    To copy the contents of /var/www/html to /var/www/backup on the destination server:

    Bash
    rsync -avz -e ssh /var/www/html/ root@destination-vm:/var/www/backup/

    Note: A trailing slash (/) on the source directory copies only the contents of the directory. Without the trailing slash, the entire directory is copied.

    7. Perform a Dry Run

    To preview the files that will be transferred without making any changes, run:

    Bash
    rsync -avz –dry-run -e ssh /var/www/html/ root@destination-vm:/var/www/backup/

    8. Automate rsync Using Cron

    Open the crontab editor:

    Bash
    crontab -e

    Example: Run the rsync command every day at 2:00 AM.

    Bash
    0 2 * * * rsync -avz -e ssh /var/www/html/ root@destination-vm:/var/www/backup/ >> /var/log/rsync.log 2>&1

    9. Troubleshooting

    Permission Denied

    Verify that SSH key-based authentication is configured correctly and that the SSH key permissions are correct.

    Connection Refused

    Ensure that the SSH service is running on the destination server.

    Path Errors

    Verify that the source and destination directories exist before running the command.

    10. Conclusion

    Using rsync with SSH provides a secure and efficient way to transfer files between servers. It is well suited for backups, data migration, and automated file synchronization while preserving file attributes during the transfer.

  • How to Connect to a Virtual Machine Using MobaXterm

    1. Overview

    MobaXterm is an SSH client for Windows that allows you to securely connect to and manage a Virtual Machine (VM) from a remote system.

    This guide explains how to connect to a VM using SSH with MobaXterm.

    2. Prerequisites

    Before connecting to the VM, ensure you have:

    • The VM’s IP address or hostname.
    • A valid username (such as root or another user with SSH access).
    • The SSH password.
    • MobaXterm installed on your Windows computer.

    3. Connect to the Virtual Machine

    Step 1: Open MobaXterm

    Launch MobaXterm on your Windows computer.

    Step 2: Create a New Session

    Click the Session button in the upper-left corner of the application.

     

    MobaXterm

    Step 3: Select the Session Type

    Choose SSH from the available session types.

    SSH

    Step 4: Enter the Connection Details

    • In the Remote host field, enter the VM’s IP address or hostname.
    • Leave the port set to 22, unless your server uses a different SSH port.
    • Select Specify username and enter the appropriate username (for example, root or ubuntu).
    • Click OK.

    MobaXterm will prompt you to enter the SSH password.

    After entering the correct password, the SSH session will be established and you will be connected to the virtual machine.

  • How to Change the MTU Value for a Virtual Machine

    1. Overview

    MTU (Maximum Transmission Unit) is the largest packet size, measured in bytes, that a network interface can send in a single frame without fragmentation.

    The default MTU on most Ethernet networks is 1500 bytes.

    A larger MTU, such as 9000 bytes (Jumbo Frames), is commonly used in high-performance environments, including storage networks, virtualization platforms, and cloud infrastructure.

    2. Why Use MTU 9000?

    Using an MTU of 9000 allows more data to be transmitted in each packet, reducing the total number of packets required.

    Benefits include:

    • Lower CPU usage due to fewer packets being processed.
    • Higher network throughput.
    • Improved performance for data-intensive workloads such as backups, virtual machine migrations, and databases.

    3. Why Applications May Not Work with MTU 9000

    For MTU 9000 to work correctly, every device in the network path must support Jumbo Frames.

    If any device, such as a switch, router, firewall, or VPN, only supports an MTU of 1500, larger packets may be dropped or fragmented.

    Example:
    Server A (MTU 9000) → Switch (MTU 9000) → Router/VPN (MTU 1500) → Server B

    In this case, the router cannot process 9000-byte packets, which may result in:

    • Connection failures
    • Packet loss
    • Network timeouts
    • Application issues, especially with databases, SSH, APIs, or web applications

    4. Why Use MTU 1500?

    • An MTU of 1500 is the standard value supported by virtually all network devices.
    • If an application works with MTU 1500 but fails with MTU 9000, it usually indicates an MTU mismatch somewhere in the network path.
    • Using MTU 1500 provides stable and reliable connectivity, although it may offer slightly lower performance than Jumbo Frames.

    5. Check the Current Network Interface

    Before changing the MTU, identify the active network interface.

    Run either of the following commands:

    Bash
    ip link show

    or

    Bash
    nmcli device status

    Example output:

    2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
link/ether 52:54:00:ab:cd:ef brd ff:ff:ff:ff:ff:ff

    In this example:

    • Interface: enp1s0
    • Current MTU: 9000

    6. Change MTU Permanently on Ubuntu 24.x

    Step 1: Back Up the Netplan Configuration

    Bash
    sudo cp /etc/netplan/50-cloud-init.yaml /etc/netplan/50-cloud-init.yaml.bak

    Step 2: Edit the Netplan Configuration

    Open the configuration file:

    Bash
    sudo nano /etc/netplan/50-cloud-init.yaml

    Update the interface configuration to include the required MTU value:

    Bash
    network:
version: 2
ethernets:
enp1s0:
dhcp4: true
dhcp6: true
optional: true
mtu: 1500

    Step 3: Apply the Changes

    Bash
    sudo netplan apply

    Step 4: Verify the MTU

    Bash
    ip link show enp1s0 | grep mtu

    7. Change MTU Permanently on AlmaLinux

    Step 1: Back Up the NetworkManager Connection Profile

    View the active connection:

    Bash
    nmcli connection show –active

    Create a backup of the connection profile:

    Bash
    sudo cp “/etc/NetworkManager/system-connections/<profile-name>.nmconnection” “/etc/NetworkManager/system-connections/<profile-name>.nmconnection.bak”

    Step 2: Configure the MTU

    Set the MTU value permanently:

    Bash
    sudo nmcli connection modify <profile-name> 802-3-ethernet.mtu 1500

    Step 3: Restart the Network Connection

    Restart the connection:

    Bash
    sudo nmcli connection down <profile-name> && sudo nmcli connection up <profile-name>

    Or restart the NetworkManager service:

    Bash
    sudo systemctl restart NetworkManager

    Step 4: Verify the MTU

    Bash
    ip link show <interface-name> | grep mtu

    8. Temporary MTU Change (Ubuntu and AlmaLinux)

    To test a different MTU without making a permanent change, run:

    Bash
    sudo ip link set dev <interface-name> mtu 1500

    This change is temporary and will be lost after the system is restarted.

    9. Change the MTU on Windows Server Using PowerShell

    Purpose

    This procedure explains how to view and modify the MTU on a Windows Server using PowerShell.

    Prerequisites

    Before making changes:

    • Ensure you have administrative privileges.
    • Identify the network interface you want to modify.

    Step 1: Check the Current MTU

    Open PowerShell as Administrator.

    Run:

    PowerShell
    Get-NetIPInterface

    Review the InterfaceAlias and NlMtu values for the network interface.

    Example:

    ifIndex InterfaceAlias AddressFamily NlMtu(Bytes)
——- ————– ————- ————
5 Ethernet Instance 0 IPv4 9000
5 Ethernet Instance 0 IPv6 1500

    Step 2: Change the MTU

    To change the MTU for IPv4:

    Bash
    Set-NetIPInterface -InterfaceAlias “Ethernet Instance 0” -NlMtu 1500

    To change the MTU for IPv6:

    Bash
    Set-NetIPInterface -InterfaceAlias “Ethernet Instance 0” -AddressFamily IPv6 -NlMtu 1500

    Step 3: Verify the MTU

    Run:

    Bash
    Get-NetIPInterface | Select-Object InterfaceAlias, AddressFamily, NlMtu

    Example output:

    InterfaceAlias AddressFamily NlMtu
————– ————- —–
Ethernet Instance 0 IPv4 1500
Ethernet Instance 0 IPv6 1500

    Step 4: Restart the Network Adapter (Optional)

    To apply the changes immediately:

    Bash
    Restart-NetAdapter -Name “Ethernet Instance 0”

    Step 5: Verify the MTU is Persistent

    Confirm that the MTU value has been saved to the persistent configuration:

    Bash
    Get-NetIPInterface -InterfaceAlias “Ethernet Instance 0” -PolicyStore PersistentStore

    This verifies that the MTU configuration will remain in effect after the server is restarted.

  • How to Change the Default RDP Port

    1. Overview

    RDP (Remote Desktop Protocol) is a Microsoft protocol that allows you to remotely access and control a Windows computer over a network or the internet.

    By default, RDP uses port 3389.

    When you connect using the Remote Desktop Connection (mstsc.exe) application, your keyboard, mouse, and screen are transmitted to the remote computer, allowing you to control it through a graphical interface.

    2. Enable RDP on a New Windows Server VM

    Step 1: Enable Remote Desktop

    1. Open Start → Settings → System → Remote Desktop.
    2. Turn Enable Remote Desktop to On.
    3. Click Confirm when prompted.

    RDP

    Step 2: Allow RDP Through Windows Firewall

    1. Open Windows Defender Firewall.
    2. Click Allow an app or feature through Windows Defender Firewall.
    3. Make sure Remote Desktop is enabled for the required network profiles (Private and/or Public).

    Step 3: Configure User Access

    1. Right-click This PC and select Properties.
    2. Click Remote Settings.
    3. Under Remote Desktop, click Select Users.
    4. Add the user accounts that should be allowed to connect through RDP.

    3. Change the Default RDP Port

    Step 1: Open Registry Editor

    1. Press Windows + R.
    2. Type regedit and press Enter.
    3. If prompted by User Account Control (UAC), click Yes.

    Step 2: Locate the RDP Port Setting

    Navigate to the following registry path:
    HKEY_LOCAL_MACHINE
    └─ System
    └─ CurrentControlSet
    └─ Control
    └─ Terminal Server
    └─ WinStations
    └─ RDP-Tcp

    Step 3: Change the Port Number

    1. In the right pane, locate PortNumber.
    2. Double-click PortNumber.
    3. Select Decimal under Base.
    4. Enter the new port number (for example, 3390 or 5000).
    5. Click OK.

    Tip: Choose a port number between 1025 and 65535 that is not already in use.

    Step 4: Allow the New Port Through Windows Firewall

    1. Open Windows Defender Firewall with Advanced Security.
    2. Select Inbound Rules.
    3. Click New Rule.
    4. Select Port, then click Next.
    5. Choose TCP and enter the new port number.
    6. Click Next.
    7. Select Allow the connection.
    8. Click Next.
    9. Select the required network profiles (Domain, Private, and/or Public).
    10. Click Next.
    11. Enter a name for the rule (for example, Custom RDP Port).
    12. Click Finish.

    Step 5: Apply the Changes

    Restart the server.

    Or restart the Remote Desktop service using Command Prompt with administrative privileges:

    Command Prompt
    net stop termservice
net start termservice

    Tip: Record the new RDP port number and verify that you can connect successfully before ending your current remote session. This helps prevent accidental loss of access to the server.