Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering how is it possible for Team Viewer to establish the remote desktop connection over the internet even if the user has not enabled the 3389 port ?

I am searching over the internet but didn't find the satisfied answer to my question ? How does it even possible to establish RDP over the internet since it is only possible across the network ?

Does Team Viewer use Reverse Connection technique ? Is it possible to establish the RDP connection with someone who is outside the network ?

share|improve this question
What makes you think it uses RDP? AFAIK, it uses its own protocol. – Bruno Apr 29 '12 at 10:49
@Bruno RFB, iirc – tylerl May 14 '12 at 4:57
Please see the solution of your questions at: – Winston Jul 6 at 18:11
up vote 13 down vote accepted

To elaborate on ewanm89's post, TeamViewer does use UDP pinholeing.

UDP is a stateless protocol. This means packets are fired off at their target with no verification (at the protocol level) that they were received or even reached the destination. Firewalls are designed to look for UDP packets and record the source and destination as well as the timestamp. If they see an inbound packet that matches an outbound packet they will generally allow the packet through even without a specific rule being placed in the firewall's access list. This can be locked down on enterprise grade devices, but in general 90% of the firewalls out there will allow return traffic.

In order to pin hole your machine (viewer) has a TCP connection back to the main TeamViewer server. The target machine (client) also has a TCP connection to the main TeamViewer Server. When you hit connect your machine tells the main server its intention. The main server then gives you the IP address of the client machine. Your machine then begins firing UDP packets at the client. The client is signaled that you intend to connect and is given your IP. The client also starts firing UDP packets at you.

This causes both firewalls (yours and the clients) to allow the traffic, thus "punching holes" in the firewall.

Of course TeamViewer adds some security by doing a pin/password check before the main server sends the IP info to both parties but you get the idea.

share|improve this answer

Teamviewer run proxy servers, both sides connect to the server and then the server relays from one to the other (though it can do direct connections if possible and it can also do UDP NAT holepunching).

share|improve this answer

Team Viewer uses their own servers as a bridge to connect two clients. It appears to be a packaged software solution. It is NOT. It is a HOSTED solution exactly the same way as LogMeIn does.

If you look for truly on-premise secured connection, try VNC (software), Radmin (software), Bomgar (appliance) or RHUB (appliance).

share|improve this answer

Teamviewer should be installed on both machines and both should be connected to the internet , Teamviewero on the remote machine should have an IDLE connection to the Teamviewer Proxy Servers and waits for connections requests , After receiving it, a direct UDP connection will be established ,known that both machines must set and ID and Password before this process

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.