I manage a Windows Server 2022 VPS that currently accepts Remote Desktop connections over its public IP. I installed WireGuard and changed the Windows Firewall rules so RDP works through the WireGuard address, but the server is still reachable through its public address. How can I make RDP available exclusively over WireGuard and block port 3389 from the public internet?
4 Answers
Check whether your VPS provider offers an external security group or network firewall. Blocking TCP 3389 there is preferable because unwanted traffic never reaches the server. Keep the Windows Firewall restriction as a second layer, and make sure you have console or out-of-band access in case a WireGuard rule locks you out.
Create an explicit Windows Firewall block rule for TCP 3389 with the profile or interface set to Public. Better yet, scope the allow rule so it applies only to the WireGuard network or WireGuard adapter, then block all other inbound RDP traffic. Test this from an external connection before closing your current session.
There are two separate places to check: the VPS provider's network firewall and the server's own Windows Firewall. The provider should deny inbound TCP 3389 from the internet, while Windows should allow RDP only from the WireGuard subnet or interface. Simply having WireGuard installed, or leaving an unrestricted RDP allow rule in place, does not remove public access.
Be careful not to rely only on hiding or unpublishing the port. Explicitly restrict the RDP rule to the WireGuard address range and add a deny rule for other networks. Before applying it, confirm that your WireGuard client can reach the server's WireGuard IP and that you have a separate recovery path if the tunnel configuration is wrong.
The provider may have enabled a firewall rule specifically for initial access. Ask whether it can be removed or limited to a trusted source IP, but keep an alternative console connection available before changing it.