Connect to a Windows VPS with RDP Without Exposure

RDP is how you administer a Windows VPS, and it is also the protocol bots scan first after they find a Windows fingerprint on a public IPv4. A default listener on TCP 3389, reachable from the whole internet, with a password that has ever been reused, is not a remote-admin plan. You can still use RDP every day. You just should not publish it the way a home lab publishes it.

Network Level Authentication, a firewall remote-address scope, a strong unique password or better a restricted local admin group, and an optional tunnel through a host you already trust will take you from "internet-wide RDP" to "only my office can even complete a TCP handshake". L3/L4 DDoS filtering on the path helps against volumetric noise. It does not replace a closed 3389.

What a blind RDP listener actually exposes

When Windows Server 2022 boots on a public IPv4, Remote Desktop is often already enabled so you can log in from the panel password. That is convenient for first boot. It is also a credential-guessing surface. Attackers do not need a zero-day. They need 3389 open, NLA optional or misconfigured, and an account named Administrator with a weak password.

NLA forces the client to authenticate before a full desktop session is built. That cuts a class of pre-auth attacks and stops idle session spam from consuming as much CPU. NLA is not a firewall. Anyone who can reach 3389 can still try passwords. The firewall has to drop those packets before they become logon events.

Lock the listener before you do anything else

On first login, confirm NLA, confirm the RDP firewall rule, and immediately scope that rule to your current public IP. Keep a second path ready: the provider console, or a second RDP session that is already open, so a typo in -RemoteAddress does not lock you out.

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Get-NetFirewallAddressFilter
$MyIp = (Invoke-RestMethod -Uri 'https://ifconfig.me/ip').Trim()
Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress $MyIp
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Get-NetFirewallAddressFilter | Format-Table

Replace the one-IP scope with a small set if you have a static office prefix and a backup home prefix. Do not add 0.0.0.0/0 "just for today". Today becomes next quarter. If your ISP rotates IPv4, use a tunnel instead of opening the world.

Tunnel RDP when you have no static IP

If your workstation IP changes, stop trying to chase it in firewall rules. Run an SSH tunnel through a Linux jump host you already lock down with keys, and keep 3389 bound to localhost on that jump, or keep Windows firewall allowing only the jump host IPv4.

From a workstation with OpenSSH:

ssh -N -L 13389:WINDOWS_VPS_IP:3389 jumpuser@JUMP_HOST_IP

Then point mstsc at 127.0.0.1:13389. The Windows VPS firewall should list only JUMP_HOST_IP as a remote address for the Remote Desktop group. Your laptop never talks to 3389 on the public IPv4. The jump host sees SSH. The VPS sees RDP from one address.

A VPN into a small private network is the same idea with more moving parts. RD Gateway is the Windows-native version of that idea and is worth it when several operators share one Windows estate. For a single VPS, IP scope plus an SSH tunnel is enough.

Client hygiene that actually matters

Use the built-in Remote Desktop client, require the certificate warning to make sense (the default self-signed cert will warn; replace it later), and never save the password in a shared mstsc .rdp file on disk. Disable clipboard and drive redirection if you are connecting from a workstation you do not fully trust. RestrictedAdmin mode reduces credential exposure on the target when the client supports it.

Local accounts used for RDP should not be the same password as the panel, mail, or Git host. Rename is optional; uniqueness and length are not. Add a dedicated admin user, confirm it can log in, then stop using a well-known account name for daily RDP. Account lockout policy belongs here too: a public 3389 with no lockout is a password-spraying lab you are hosting for someone else.

Do not confuse console with RDP

The VPS console in the provider panel is a hypervisor-level keyboard and screen. It still works when the guest firewall is wrong. Use it as the lockout recovery path. Test every firewall change with a new RDP connection while an old session or the console is still open. If the new connection fails, revert from the session you still have.

Takeaway

Enable RDP, force NLA, scope the firewall to addresses you control, and tunnel when those addresses move. Keep the provider console as the recovery path and never debug firewall rules by closing your only session. Spin up a Windows VPS on Netbay in Lucknow, restrict 3389 to your IP, and follow this sequence on a fresh public IPv4 at netbayhosts.in.