I manage a Windows Server 2022 VPS that is currently reachable through RDP over its public IP. I installed WireGuard and changed the Windows Firewall rules so RDP works through the WireGuard address, but the server is still accessible through its public address. I want to remove public RDP access entirely while keeping RDP available over the WireGuard tunnel. What firewall or VPS-provider settings should I check, and what is the safest way to configure this without locking myself out?
4 Answers
The safest setup is layered: use the provider firewall to deny public RDP, then configure Windows Firewall to allow RDP only from the WireGuard subnet. Keep an out-of-band console or recovery option enabled, because a bad WireGuard or firewall change can otherwise leave you locked out of the VPS.
If the provider has no firewall controls, Windows Firewall can still do the job. Confirm that the RDP rule is bound to the WireGuard interface or VPN address range, and add a higher-priority deny rule for public traffic to port 3389. Also verify that the VPS is not exposing another RDP-related rule or a different listening port.
Check whether your VPS provider offers an external or upstream firewall. Ideally, block inbound TCP 3389 there and allow it only from the WireGuard network or your specific VPN peer addresses. That prevents unwanted traffic from reaching the server at all, even if the Windows rules are accidentally changed.
On Windows, create an explicit inbound block rule for TCP 3389 that applies to the Public profile, or restrict the existing RDP allow rule to the WireGuard interface and address range. Make sure the rule is scoped to the VPN subnet rather than allowing any local or public interface. Test it from an outside network before closing your current session.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures