I have a situation where I provide access to a Windows server by forwarding the remote desktop port 3389 with ssh from my Mac to the "inside" of an otherwise inacessible network.

I can now connect with the Windows version of Remote Desktop, but the Mac version of Remote Desktop time out and do not provide access. This is even when using the IP-number as the host to connect to.

Any idea why this happens and how I can work around it?

  • This is still desirable due to changed software. Opening a bounty. Apr 12, 2013 at 8:21
  • Did you try with newer client, 2.1.2 ?
    – Ruskes
    Apr 12, 2013 at 14:12
  • Not yet. I have 2.1.0. Thanks, I'll try upgrading. Apr 12, 2013 at 14:19
  • I've kept a virtual box with windows installed for situations like this. Sadly, I'd love to make things work natively on the Mac - but when a client can not or will not give me a proper VPN - running the OS they poke holes (or worse rely on non-standard one-off behaviors) in their firewall is far less work for me in the end. After all - I'm running RDC to see windows so it matters little that I've that OS running locally too. Since you explicitly need the Mac client, can you ssh in to a VPN connection?
    – bmike
    Apr 14, 2013 at 13:11
  • What happens on the Mac if you simply telnet localhost:forwarded port? Does it work as expected? Sounds like there is a problem with your ssh tunnel.
    – d-b
    Apr 17, 2013 at 14:20

7 Answers 7


Don't forward local port 3389, various versions of Remote Desktop are too smart for their own good.

My usual steps involve forwarding local 3390 to remote 3389. Then, in MacRDC I use: localhost:3390 as the address to connect too.

I don't know if you're using anything to assist in the ssh connection setup, but from the command line, it would be something like:

ssh -L 3390: [email protected]

- 3390 is the local forwarding port on my box.
- is the remote windows host. and;
- 3389 is the Remote Desktop Port (obviously).

  • I had a go at this, but unfortunately going through port 3390 didn't work either :( I tried adding the host name of the windows server to /private/etc/hosts (aliased to to see if I could fool any "look for HOST" mechanism, but no. What Windows version is this against and what version of Remote Desktop for Mac? Feb 26, 2011 at 12:58
  • MacRDC 2.0.1, Windows RDC it's been so long I couldn't tell you. I seem to remember it happening with stock mstsc from Windows XP and forward. Feb 27, 2011 at 7:07
  • Your original comment means that localhost:3390 in the RDC window didn't work? And you tried myhost:3390 (with myhost aliased in the line in hosts file) as well, also to no avail? Feb 28, 2011 at 8:22
  • Also, do you get any output in your terminal window? Channel failures or anything of the sort? Any error messages external to the MacRDC app? Feb 28, 2011 at 8:23
  • I now had a look at this again, including the "myhost->localhost" hack, and it appears that it is not enough. The wheel spins in MacRDP trying to connect, but still times out. There is no messages in Console.app. I use a custom tool to port forward (no ssh access). I really wonder what it tries to do which fails. Apr 12, 2013 at 8:20

On your mac, perhaps try out this solution:

  • install sshuttle ( implements ssh tunnel/proxy, but also implements some routing changes ) ( https://github.com/apenwarr/sshuttle.git )
  • configure sshuttle to only route for the ip address of the windows box you want to reach:

    sshuttle --dns -r [email protected]

    Replace: with the ip address of the windows host. If there are a number of hosts you need to access and they are in the same subnet, you can just change the /32 to something wider, say /24.

  • Fire up your Mac RDP client and attempt to access the IP address of the Windows machine. Perhaps can use the hostname if you are also forwarding DNS queries to the box you are using as a bridge.

This is a variation of the -D3389 method, but employs the socks proxy features of ssh.

  • 1
    Impressive...good job.
    – Ruskes
    Apr 18, 2013 at 21:57
  • Five years on, still the best solution for this problem.
    – Hassan
    Mar 10, 2018 at 19:23
  • 11 years, still the best solution :)
    – Amin Adha
    Jan 2 at 3:29

The Windows Remote Desktop implements more authentication and encryption algorithms specific to Windows. This happened to us often, in fact we're forced to use Windows Remote Desktop by our network administrators as we're using authentication methods OSX doesn't implement. Let's cross fingers and hope Microsoft releases a match for the Windows-grade Remote Desktop asap.

  • Do you have any suggestions for me to look for to make MacRDP not time out? Apr 12, 2013 at 14:18
  • If it times out, no connection can be established at all. Either way, as Windows succeeds in the connection, my guess is authentication or encryption! :)
    – 19h
    Apr 12, 2013 at 14:53

Did you try to disable requirement for "Network Level Authentication" from "Control Panel -> System -> Allow Remote Access" on the target machine?

Native Level Authentication

  • He's able to connect with a Windows RDP installation.. so, yes he did that already :)
    – 19h
    Apr 13, 2013 at 11:37
  • 1
    The version 2.1.1 has added support for NLA - see macupdate.com/app/mac/8431/microsoft-remote-desktop-connection: Verifies the identity of the Windows-based computer before establishing a Remote Desktop connection. You can select this option when you connect to a computer that is running Windows Vista or Windows 7. Network Level Authentication is more secure than authentication options in earlier versions of Windows. If you disable this requirement (we speak about the very last checkbox) he should be able to login with 2.1.0 client through SSL tunnel.
    – brablc
    Apr 13, 2013 at 13:49
  • Sorry, didn't see you wanted to point out the NTLM part of the shot. Maybe worth a try!
    – 19h
    Apr 13, 2013 at 23:13
  • I'm actually not sure that NLA is related to NTLM. NLA just tries to verify credentials before bringing a login screen to the user. This eliminates one attack vector. But his Windows is behind a firewall so he does not need to consider this.
    – brablc
    Apr 14, 2013 at 0:19

The OSX Microsoft Remote Desktop client does not seem to support the default authentication method used by Windows 7+

The solution is to do the following on the Windows machine:

  • Start -> Edit Group Policy
  • Computer configuration

    • Administrative Templates

      • Windows Components

        • Remote Desktop Services
        • Remote Desktop Session Host

          • Security

            1. Change 'Require use of specific for remote desktop (RDP) connections' to Enabled and choose RDP from the dropdown.

            2. Change 'Require user authentication for remote connections by using Network Level Authentications' to Disabled

Now you should be able to connect using the OSX Remote Desktop Client without any problems through the SSH tunnel.

  • I also ran into this problem when trying to create an SSH tunnel to a Windows machine. It worked fine when doing it using Putty on Windows. Creating the exact same tunnel on OSX however, simply timed out after a while. If the tunnel wasn't setup at all, the Remote Desktop Client would fail immediately, so I knew it was getting some kind of connection.
    – Joakim
    Mar 7, 2014 at 16:38

Try CoRD: enter link description here

I've found it works better than the official RDP client and tends to handle imperfect setups smoother.

Update to this answer from the CoRD site

2020-04-13: This project is defunct. Most people will be happy with Microsoft's clients. There's also an excellent free and open source project called FreeRDP that has great protocol support for multiple platforms. A sincere thanks to everyone who used CoRD over the years, reported bugs, donated, or contributed code - Dorian

  • I am using CoRD now, but it has a few wrinkles, and I'd rather use the official client. Apr 16, 2013 at 9:10

Forwarding to port 3389 is bound to give you trouble. The system will recognize what you're trying to do and basically short circuit itself. This is the drawback of DIY Remote Desktop, imho.

  • 1
    Then why does it work with Windows Remote Desktop but not the Mac version of Remote Desktop (from Microsoft too)? Mar 15, 2011 at 22:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .