termalRemote desktop · behind NAT
RDP behind NAT or a firewall — with port 3389 closed.
Forwarding port 3389 to the internet is a classic way to get a machine compromised. Instead, install a Termalin Connector on the Windows PC or server you want to reach, or on any box on its network. The Connector dials out, so nothing listens and no port is forwarded — and the desktop opens over RDP or VNC in the browser or the app. This is how you access a PC behind NAT without a VPN.
Outbound only · port 3389 stays closed · Pro or Team (14-day trial)
01 / the problem
Why not just forward 3389.
Opening port 3389 — or forwarding it on the router — puts an RDP login screen on the public internet. Within hours it is found by scanners, and from then on it takes a steady stream of password-guessing. CGNAT and a strict firewall often make it impossible anyway. The Connector sidesteps all of it: nothing on your machine ever accepts an inbound connection.
02 / how it works
The machine dials out. Nothing dials in.
- ▸Outbound only. The Connector opens a connection to termal.in and holds it; it never listens, so there is no port to forward or scan.
- ▸Private side only. On this path the target address is a private one on the Connector’s own network — never a public address.
- ▸Browser or app. The desktop opens in a browser tab at termal.in/account, or in the desktop app. Nothing to install on the machine you’re sitting at (for the browser).
03 / two setups
Two ways to place the Connector.
On the Windows machine itself. Install the Connector on the PC or server you want to reach. In the cabinet click Get install command → Windows and run the one line it gives you in PowerShell (it asks for administrator rights itself):
irm https://termal.in/i/<token>.ps1 | iex
The target is then 127.0.0.1, and because the desktop is on the Connector’s own machine you also get the Files button beside it — browse that PC’s drives over the same link, with no extra setup.
On another box on the same network. If you’d rather not touch the PC — or it’s not Windows — put the Connector on any Linux machine or Mac on the LAN (a Raspberry Pi, a NAS, a VPS on the same private network):
curl -fsSL https://termal.in/i/<token> | sudo sh
Then point the desktop at the PC’s private address — 10.x, 192.168.x or 172.16–31.x. The Connector dials it on the local network. The install link is single-use and valid for an hour.
04 / on the Windows side
Windows settings to check.
- ▸Remote Desktop on. Settings → System → Remote Desktop (on a server, Server Manager → Local Server).
- ▸Your user allowed. The account must be an administrator or be listed under Remote Desktop Users.
- ▸Network Level Authentication can stay on (the default) — it keeps the password out of the clear. Use a local account or NTLM; Kerberos isn’t reachable through the relay.
- ▸No blank passwords. A local account with a blank password can’t sign in over RDP — that’s a Windows policy, not a Termalin limit.
05 / VNC too
VNC desktops, the same way.
A Linux desktop or any other VNC server on 5900–5999 works over the same Connector. The VNC password check runs between you and the server — termal.in never sees the password — and, unlike a direct VNC connection, the screen and keystrokes stay inside the Connector’s tunnel instead of crossing the internet in the clear. Any RFB 3.3–3.8 server with a VNC password or no authentication is supported (TigerVNC, TightVNC, UltraVNC, RealVNC with a VNC password).
06 / compared
Versus a VPN, an SSH tunnel or RD Gateway.
| Approach | Opens a port? | On your side | Best when |
|---|---|---|---|
| Forward 3389 | Yes — on the internet | Router change | Never, really |
SSH tunnel (ssh -L 3389) | SSH port, or none behind NAT | An SSH entry point + a client | You already have SSH in |
| Mesh VPN | No (outbound) | VPN client on every device | You want a full private network |
| RD Gateway | 443, plus AD | Windows Server infrastructure | A large managed Windows fleet |
| Termalin Connector | No — outbound only | One line on the machine; browser or app | One or a few desktops, fast |
The Connector path needs a Pro or Team plan. If you run a big Active Directory estate, RD Gateway with Kerberos and central policy is the heavier tool for that job; Termalin is the quick, keyless way to reach a handful of machines.
Questions
Does the Connector open any port?
No. It makes an outbound connection to termal.in and never listens on a port — so there is nothing to forward on the router and nothing for scanners to find. That is what lets it work behind NAT, CGNAT and a strict firewall.
Is port 22 opened on Windows when I install it?
No. When the installer adds the OpenSSH Server, sshd listens on 127.0.0.1 and ::1 only and its inbound firewall rule stays off, so port 22 is not open to the network. An OpenSSH Server that was already there is left exactly as it was. The Connector reaches sshd over its own outbound tunnel.
Which plan do I need?
Reaching a desktop through a Connector is a Pro or Team feature (the 14-day trial counts): up to 4 desktops open at once on Pro, 10 on Team.
Can I use the desktop app instead of the browser?
Yes. The Termalin desktop app (0.1.48 or newer, on Windows, macOS or Linux) opens the same desktop through the same Connector. A desktop reachable directly is free in the app; through a Connector it is the same Pro/Team feature.
What about a desktop with a public IP?
Then you don’t need a Connector — the browser or the app can dial it directly. A Connector is for a machine behind NAT or a firewall, with no public address and no port forwarded.
Reach the desktop, leave 3389 shut.
One line installs the Connector. It dials out, nothing listens, and the Windows or VNC desktop opens in the browser or the app.
Pro or Team · 14-day trial · Windows Server over SSH · the Connector