When you first log into a Windows VPS over Remote Desktop, the port map is effectively your server’s front door. Providers ship Windows Server with RDP listening on TCP 3389, a handful of system services bound to loopback, and a firewall that is enabled by default. Everything else is a decision you make. The difference between a server that gets probed by thousands of bots within an hour of deployment and one that stays quiet is almost always a deliberate port policy, not luck. This guide walks through which ports should be open, which should stay closed, and how to lock down RDP specifically.
What Is Open on a Fresh Windows VPS?
A stock Windows Server image opens only a handful of inbound ports. RDP on 3389 is the obvious one — it has to be, or you could never get in. Beyond that, most providers allow ICMP echo requests (ping) so you can confirm the machine is reachable, and some control panels add their own management ports. If you want an exact answer for your own box, run netstat -an | findstr LISTENING from an elevated PowerShell session and compare the output against the table below.
| Port | Service | Default State | Recommendation |
|---|---|---|---|
| 3389/TCP | RDP (Remote Desktop) | Open | Keep, but harden (see below) |
| 80/TCP, 443/TCP | HTTP/HTTPS (IIS) | Closed until installed | Open when hosting web apps |
| 1433/TCP | SQL Server | Closed | Restrict to app servers or VPN only |
| 445/TCP, 139/TCP | SMB / NetBIOS | Closed by firewall | Keep closed on public interfaces |
| ICMP | Ping | Usually allowed | Optional; disable if you prefer stealth |
Which Ports Your Workloads Actually Need
Open ports in proportion to what the server does, nothing more. A Windows VPS running IIS for a .NET application needs 80 and 443 inbound, plus 3389 for administration. A SQL Server instance serving an external application should not expose 1433 to the whole internet — bind it to a private network, restrict it by source IP, or front it with a VPN. Game servers, custom VoIP software, and monitoring agents each add their own port, and each one is a new attack surface you are responsible for defending. The general rule: if a port is not in active use, it should be closed in Windows Defender Firewall.
Locking Down RDP: The Highest-Value Changes
RDP is the single most attacked service on any Windows VPS because it is the guaranteed way in. The default posture — port 3389 open to the world with only a password protecting it — is precisely what brute-force botnets look for. These four changes eliminate most of the risk:
- Enable Network Level Authentication (NLA): requires authentication before a full RDP session is established, which blocks most unauthenticated scans and cuts resource consumption from connection floods.
- Set an account lockout policy: in Local Security Policy, configure a threshold of 5 failed attempts with a 15-minute lockout. This single setting defeats credential-stuffing scripts that hammer the login prompt.
- Change the default port: moving RDP from 3389 to a high, non-standard port (e.g. 54389) in the registry is not real security, but it filters out the vast majority of automated scans that only probe 3389.
- Restrict by source IP: if your team connects from a static office IP or a VPN endpoint, add an inbound firewall rule that only permits RDP from those addresses and blocks everything else.
For multi-user teams, consider putting an RD Gateway or a VPN in front of RDP so that port 3389 is not exposed publicly at all. That architecture is more work up front, but it turns your administration channel into a controlled, auditable entry point instead of an open door. If you are comparing providers to host this setup, our Windows VPS comparison table lists which hosts include RD Gateway support, network firewalls, and DDoS protection as standard features.
SMB and Other Services: Close Them on Public Interfaces
Windows file sharing (SMB on 445) is the service behind the most damaging Windows exploits of the last decade, including WannaCry and EternalBlue. Windows Server’s default firewall blocks SMB from external interfaces, and that default should stay. If you need file transfers between your VPS and your workstation, use SFTP, a VPN, or an encrypted tunnel rather than opening 445. The same logic applies to 135 (RPC), 139 (NetBIOS), and 389 (LDAP) — each is a legitimate service that becomes a liability the moment it is reachable from the public internet.
Provider-Level Filtering and Network Firewalls
Port policy does not end at the guest OS. Most Windows VPS providers offer an additional network-level firewall or security group in their control panel, which filters traffic before it ever reaches your server’s NIC. Layering a network allowlist on top of the guest firewall is strictly better than relying on the OS alone: even a fully compromised or misconfigured Windows firewall cannot expose a port that the provider’s edge already blocks. Check whether your host supports IP allowlists, and if it does, put your RDP and management ports behind them.
Verifying Your Final Port Map
After making changes, verify from the outside rather than trusting the local view. Services like canyouseeme.org or a simple Test-NetConnection from a second machine confirm which ports are actually reachable. Inside the server, Get-NetFirewallRule in PowerShell lists every active rule so you can audit the exceptions you have created. A clean final state looks like this: only 80/443 (if hosting), 3389 (hardened or moved), and your monitoring agent ports open from the internet.
Getting the port policy right matters more than which provider you pick — but the provider determines how much network-level protection you get for free. Budget hosts like InterServer (Windows VPS from $0.01 for the first month with code TRYINTERSERVER) include a basic firewall, while higher-tier options such as Vultr add configurable firewall groups on every instance. For a side-by-side view of network security features across hosts, compare Windows VPS plans on our comparison table before you commit.
