Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
When you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Ask a Windows VPS host “do you block any ports” and you will usually get a one-line answer that is technically true and practically useless. The real posture is three layers stacked: what the hypervisor or edge firewall drops before packets ever reach your NIC, what the host’s upstream network filters on abuse grounds, and what your own Windows Firewall profiles allow inside the guest. A port can be open at layer three and still be dead at layer two of that stack, and the reverse happens too.
On a typical KVM Windows instance, the guest sees a clean NIC with a public address and no hint of upstream filtering. Test port 445 from an external host and it times out; run Test-NetConnection -ComputerName localhost -Port 445 inside and it succeeds. That gap is the first thing to characterise before you file a ticket claiming the provider “broke SMB”.
If you are still choosing a host, the port posture is one of the few things worth asking about in writing before you buy — see how providers describe their network policy on this Windows VPS hosting comparison, and note which ones publish an explicit blocked-port list rather than a vague “DDoS protected” badge.
Where the two blocklists live
Host-level filtering is applied to traffic before it enters your virtual network, usually on a routing appliance or a DDoS scrubbing tier. It is invisible from inside the guest, survives a full OS reinstall, and cannot be overridden by any Windows Firewall rule. Guest-level filtering is the Windows Firewall itself, evaluated per profile (Domain, Private, Public) with the public profile active on a VPS by default.
That asymmetry explains why the lists differ. A host blocks a port because of abuse economics: SMB reflection, RDP brute-force amplification, WSD discovery floods. It blocks globally, for every customer, at line rate. Your guest firewall blocks per-rule with logging and scope, and you can reopen anything you like — provided the host did not already drop it upstream.
Default posture for the ports that matter
| Port | Service | Typical host posture | Guest default (Public) | Safe exposure rule |
|---|---|---|---|---|
| 135 | RPC endpoint mapper | Blocked inbound | Blocked | Never expose; use VPN |
| 139 | NetBIOS session | Blocked inbound | Blocked | Disable NetBIOS over TCP/IP |
| 445 | SMB | Blocked inbound on most hosts | Blocked | Never public; VPN or site-to-site |
| 3389 | RDP | Open (it is the product) | Allowed by rule | Restrict source IP, or RD Gateway |
| 5985 | WinRM HTTP | Sometimes blocked | Blocked | Do not enable; use 5986 |
| 5986 | WinRM HTTPS | Rarely blocked | Blocked | Allow from management subnet only |
The 3389 row is the one that varies most. Some hosts leave it wide open and sell you “RDP protection” as a separate firewall; others silently null-route 3389 for the first ten minutes after provisioning to stop credential-stuffing bots hitting a fresh image with the default Administrator password. If RDP is unreachable right after build and works later, that is not a bug.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Ask a Windows VPS host “do you block any ports” and you will usually get a one-line answer that is technically true and practically useless. The real posture is three layers stacked: what the hypervisor or edge firewall drops before packets ever reach your NIC, what the host’s upstream network filters on abuse grounds, and what your own Windows Firewall profiles allow inside the guest. A port can be open at layer three and still be dead at layer two of that stack, and the reverse happens too.
On a typical KVM Windows instance, the guest sees a clean NIC with a public address and no hint of upstream filtering. Test port 445 from an external host and it times out; run Test-NetConnection -ComputerName localhost -Port 445 inside and it succeeds. That gap is the first thing to characterise before you file a ticket claiming the provider “broke SMB”.
If you are still choosing a host, the port posture is one of the few things worth asking about in writing before you buy — see how providers describe their network policy on this Windows VPS hosting comparison, and note which ones publish an explicit blocked-port list rather than a vague “DDoS protected” badge.
Where the two blocklists live
Host-level filtering is applied to traffic before it enters your virtual network, usually on a routing appliance or a DDoS scrubbing tier. It is invisible from inside the guest, survives a full OS reinstall, and cannot be overridden by any Windows Firewall rule. Guest-level filtering is the Windows Firewall itself, evaluated per profile (Domain, Private, Public) with the public profile active on a VPS by default.
That asymmetry explains why the lists differ. A host blocks a port because of abuse economics: SMB reflection, RDP brute-force amplification, WSD discovery floods. It blocks globally, for every customer, at line rate. Your guest firewall blocks per-rule with logging and scope, and you can reopen anything you like — provided the host did not already drop it upstream.
Default posture for the ports that matter
| Port | Service | Typical host posture | Guest default (Public) | Safe exposure rule |
|---|---|---|---|---|
| 135 | RPC endpoint mapper | Blocked inbound | Blocked | Never expose; use VPN |
| 139 | NetBIOS session | Blocked inbound | Blocked | Disable NetBIOS over TCP/IP |
| 445 | SMB | Blocked inbound on most hosts | Blocked | Never public; VPN or site-to-site |
| 3389 | RDP | Open (it is the product) | Allowed by rule | Restrict source IP, or RD Gateway |
| 5985 | WinRM HTTP | Sometimes blocked | Blocked | Do not enable; use 5986 |
| 5986 | WinRM HTTPS | Rarely blocked | Blocked | Allow from management subnet only |
The 3389 row is the one that varies most. Some hosts leave it wide open and sell you “RDP protection” as a separate firewall; others silently null-route 3389 for the first ten minutes after provisioning to stop credential-stuffing bots hitting a fresh image with the default Administrator password. If RDP is unreachable right after build and works later, that is not a bug.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
When you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Ask a Windows VPS host “do you block any ports” and you will usually get a one-line answer that is technically true and practically useless. The real posture is three layers stacked: what the hypervisor or edge firewall drops before packets ever reach your NIC, what the host’s upstream network filters on abuse grounds, and what your own Windows Firewall profiles allow inside the guest. A port can be open at layer three and still be dead at layer two of that stack, and the reverse happens too.
On a typical KVM Windows instance, the guest sees a clean NIC with a public address and no hint of upstream filtering. Test port 445 from an external host and it times out; run Test-NetConnection -ComputerName localhost -Port 445 inside and it succeeds. That gap is the first thing to characterise before you file a ticket claiming the provider “broke SMB”.
If you are still choosing a host, the port posture is one of the few things worth asking about in writing before you buy — see how providers describe their network policy on this Windows VPS hosting comparison, and note which ones publish an explicit blocked-port list rather than a vague “DDoS protected” badge.
Where the two blocklists live
Host-level filtering is applied to traffic before it enters your virtual network, usually on a routing appliance or a DDoS scrubbing tier. It is invisible from inside the guest, survives a full OS reinstall, and cannot be overridden by any Windows Firewall rule. Guest-level filtering is the Windows Firewall itself, evaluated per profile (Domain, Private, Public) with the public profile active on a VPS by default.
That asymmetry explains why the lists differ. A host blocks a port because of abuse economics: SMB reflection, RDP brute-force amplification, WSD discovery floods. It blocks globally, for every customer, at line rate. Your guest firewall blocks per-rule with logging and scope, and you can reopen anything you like — provided the host did not already drop it upstream.
Default posture for the ports that matter
| Port | Service | Typical host posture | Guest default (Public) | Safe exposure rule |
|---|---|---|---|---|
| 135 | RPC endpoint mapper | Blocked inbound | Blocked | Never expose; use VPN |
| 139 | NetBIOS session | Blocked inbound | Blocked | Disable NetBIOS over TCP/IP |
| 445 | SMB | Blocked inbound on most hosts | Blocked | Never public; VPN or site-to-site |
| 3389 | RDP | Open (it is the product) | Allowed by rule | Restrict source IP, or RD Gateway |
| 5985 | WinRM HTTP | Sometimes blocked | Blocked | Do not enable; use 5986 |
| 5986 | WinRM HTTPS | Rarely blocked | Blocked | Allow from management subnet only |
The 3389 row is the one that varies most. Some hosts leave it wide open and sell you “RDP protection” as a separate firewall; others silently null-route 3389 for the first ten minutes after provisioning to stop credential-stuffing bots hitting a fresh image with the default Administrator password. If RDP is unreachable right after build and works later, that is not a bug.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Ask a Windows VPS host “do you block any ports” and you will usually get a one-line answer that is technically true and practically useless. The real posture is three layers stacked: what the hypervisor or edge firewall drops before packets ever reach your NIC, what the host’s upstream network filters on abuse grounds, and what your own Windows Firewall profiles allow inside the guest. A port can be open at layer three and still be dead at layer two of that stack, and the reverse happens too.
On a typical KVM Windows instance, the guest sees a clean NIC with a public address and no hint of upstream filtering. Test port 445 from an external host and it times out; run Test-NetConnection -ComputerName localhost -Port 445 inside and it succeeds. That gap is the first thing to characterise before you file a ticket claiming the provider “broke SMB”.
If you are still choosing a host, the port posture is one of the few things worth asking about in writing before you buy — see how providers describe their network policy on this Windows VPS hosting comparison, and note which ones publish an explicit blocked-port list rather than a vague “DDoS protected” badge.
Where the two blocklists live
Host-level filtering is applied to traffic before it enters your virtual network, usually on a routing appliance or a DDoS scrubbing tier. It is invisible from inside the guest, survives a full OS reinstall, and cannot be overridden by any Windows Firewall rule. Guest-level filtering is the Windows Firewall itself, evaluated per profile (Domain, Private, Public) with the public profile active on a VPS by default.
That asymmetry explains why the lists differ. A host blocks a port because of abuse economics: SMB reflection, RDP brute-force amplification, WSD discovery floods. It blocks globally, for every customer, at line rate. Your guest firewall blocks per-rule with logging and scope, and you can reopen anything you like — provided the host did not already drop it upstream.
Default posture for the ports that matter
| Port | Service | Typical host posture | Guest default (Public) | Safe exposure rule |
|---|---|---|---|---|
| 135 | RPC endpoint mapper | Blocked inbound | Blocked | Never expose; use VPN |
| 139 | NetBIOS session | Blocked inbound | Blocked | Disable NetBIOS over TCP/IP |
| 445 | SMB | Blocked inbound on most hosts | Blocked | Never public; VPN or site-to-site |
| 3389 | RDP | Open (it is the product) | Allowed by rule | Restrict source IP, or RD Gateway |
| 5985 | WinRM HTTP | Sometimes blocked | Blocked | Do not enable; use 5986 |
| 5986 | WinRM HTTPS | Rarely blocked | Blocked | Allow from management subnet only |
The 3389 row is the one that varies most. Some hosts leave it wide open and sell you “RDP protection” as a separate firewall; others silently null-route 3389 for the first ten minutes after provisioning to stop credential-stuffing bots hitting a fresh image with the default Administrator password. If RDP is unreachable right after build and works later, that is not a bug.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Ask a Windows VPS host “do you block any ports” and you will usually get a one-line answer that is technically true and practically useless. The real posture is three layers stacked: what the hypervisor or edge firewall drops before packets ever reach your NIC, what the host’s upstream network filters on abuse grounds, and what your own Windows Firewall profiles allow inside the guest. A port can be open at layer three and still be dead at layer two of that stack, and the reverse happens too.
On a typical KVM Windows instance, the guest sees a clean NIC with a public address and no hint of upstream filtering. Test port 445 from an external host and it times out; run Test-NetConnection -ComputerName localhost -Port 445 inside and it succeeds. That gap is the first thing to characterise before you file a ticket claiming the provider “broke SMB”.
If you are still choosing a host, the port posture is one of the few things worth asking about in writing before you buy — see how providers describe their network policy on this Windows VPS hosting comparison, and note which ones publish an explicit blocked-port list rather than a vague “DDoS protected” badge.
Where the two blocklists live
Host-level filtering is applied to traffic before it enters your virtual network, usually on a routing appliance or a DDoS scrubbing tier. It is invisible from inside the guest, survives a full OS reinstall, and cannot be overridden by any Windows Firewall rule. Guest-level filtering is the Windows Firewall itself, evaluated per profile (Domain, Private, Public) with the public profile active on a VPS by default.
That asymmetry explains why the lists differ. A host blocks a port because of abuse economics: SMB reflection, RDP brute-force amplification, WSD discovery floods. It blocks globally, for every customer, at line rate. Your guest firewall blocks per-rule with logging and scope, and you can reopen anything you like — provided the host did not already drop it upstream.
Default posture for the ports that matter
| Port | Service | Typical host posture | Guest default (Public) | Safe exposure rule |
|---|---|---|---|---|
| 135 | RPC endpoint mapper | Blocked inbound | Blocked | Never expose; use VPN |
| 139 | NetBIOS session | Blocked inbound | Blocked | Disable NetBIOS over TCP/IP |
| 445 | SMB | Blocked inbound on most hosts | Blocked | Never public; VPN or site-to-site |
| 3389 | RDP | Open (it is the product) | Allowed by rule | Restrict source IP, or RD Gateway |
| 5985 | WinRM HTTP | Sometimes blocked | Blocked | Do not enable; use 5986 |
| 5986 | WinRM HTTPS | Rarely blocked | Blocked | Allow from management subnet only |
The 3389 row is the one that varies most. Some hosts leave it wide open and sell you “RDP protection” as a separate firewall; others silently null-route 3389 for the first ten minutes after provisioning to stop credential-stuffing bots hitting a fresh image with the default Administrator password. If RDP is unreachable right after build and works later, that is not a bug.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
When you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Ask a Windows VPS host “do you block any ports” and you will usually get a one-line answer that is technically true and practically useless. The real posture is three layers stacked: what the hypervisor or edge firewall drops before packets ever reach your NIC, what the host’s upstream network filters on abuse grounds, and what your own Windows Firewall profiles allow inside the guest. A port can be open at layer three and still be dead at layer two of that stack, and the reverse happens too.
On a typical KVM Windows instance, the guest sees a clean NIC with a public address and no hint of upstream filtering. Test port 445 from an external host and it times out; run Test-NetConnection -ComputerName localhost -Port 445 inside and it succeeds. That gap is the first thing to characterise before you file a ticket claiming the provider “broke SMB”.
If you are still choosing a host, the port posture is one of the few things worth asking about in writing before you buy — see how providers describe their network policy on this Windows VPS hosting comparison, and note which ones publish an explicit blocked-port list rather than a vague “DDoS protected” badge.
Where the two blocklists live
Host-level filtering is applied to traffic before it enters your virtual network, usually on a routing appliance or a DDoS scrubbing tier. It is invisible from inside the guest, survives a full OS reinstall, and cannot be overridden by any Windows Firewall rule. Guest-level filtering is the Windows Firewall itself, evaluated per profile (Domain, Private, Public) with the public profile active on a VPS by default.
That asymmetry explains why the lists differ. A host blocks a port because of abuse economics: SMB reflection, RDP brute-force amplification, WSD discovery floods. It blocks globally, for every customer, at line rate. Your guest firewall blocks per-rule with logging and scope, and you can reopen anything you like — provided the host did not already drop it upstream.
Default posture for the ports that matter
| Port | Service | Typical host posture | Guest default (Public) | Safe exposure rule |
|---|---|---|---|---|
| 135 | RPC endpoint mapper | Blocked inbound | Blocked | Never expose; use VPN |
| 139 | NetBIOS session | Blocked inbound | Blocked | Disable NetBIOS over TCP/IP |
| 445 | SMB | Blocked inbound on most hosts | Blocked | Never public; VPN or site-to-site |
| 3389 | RDP | Open (it is the product) | Allowed by rule | Restrict source IP, or RD Gateway |
| 5985 | WinRM HTTP | Sometimes blocked | Blocked | Do not enable; use 5986 |
| 5986 | WinRM HTTPS | Rarely blocked | Blocked | Allow from management subnet only |
The 3389 row is the one that varies most. Some hosts leave it wide open and sell you “RDP protection” as a separate firewall; others silently null-route 3389 for the first ten minutes after provisioning to stop credential-stuffing bots hitting a fresh image with the default Administrator password. If RDP is unreachable right after build and works later, that is not a bug.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
When you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.
Ask a Windows VPS host “do you block any ports” and you will usually get a one-line answer that is technically true and practically useless. The real posture is three layers stacked: what the hypervisor or edge firewall drops before packets ever reach your NIC, what the host’s upstream network filters on abuse grounds, and what your own Windows Firewall profiles allow inside the guest. A port can be open at layer three and still be dead at layer two of that stack, and the reverse happens too.
On a typical KVM Windows instance, the guest sees a clean NIC with a public address and no hint of upstream filtering. Test port 445 from an external host and it times out; run Test-NetConnection -ComputerName localhost -Port 445 inside and it succeeds. That gap is the first thing to characterise before you file a ticket claiming the provider “broke SMB”.
If you are still choosing a host, the port posture is one of the few things worth asking about in writing before you buy — see how providers describe their network policy on this Windows VPS hosting comparison, and note which ones publish an explicit blocked-port list rather than a vague “DDoS protected” badge.
Where the two blocklists live
Host-level filtering is applied to traffic before it enters your virtual network, usually on a routing appliance or a DDoS scrubbing tier. It is invisible from inside the guest, survives a full OS reinstall, and cannot be overridden by any Windows Firewall rule. Guest-level filtering is the Windows Firewall itself, evaluated per profile (Domain, Private, Public) with the public profile active on a VPS by default.
That asymmetry explains why the lists differ. A host blocks a port because of abuse economics: SMB reflection, RDP brute-force amplification, WSD discovery floods. It blocks globally, for every customer, at line rate. Your guest firewall blocks per-rule with logging and scope, and you can reopen anything you like — provided the host did not already drop it upstream.
Default posture for the ports that matter
| Port | Service | Typical host posture | Guest default (Public) | Safe exposure rule |
|---|---|---|---|---|
| 135 | RPC endpoint mapper | Blocked inbound | Blocked | Never expose; use VPN |
| 139 | NetBIOS session | Blocked inbound | Blocked | Disable NetBIOS over TCP/IP |
| 445 | SMB | Blocked inbound on most hosts | Blocked | Never public; VPN or site-to-site |
| 3389 | RDP | Open (it is the product) | Allowed by rule | Restrict source IP, or RD Gateway |
| 5985 | WinRM HTTP | Sometimes blocked | Blocked | Do not enable; use 5986 |
| 5986 | WinRM HTTPS | Rarely blocked | Blocked | Allow from management subnet only |
The 3389 row is the one that varies most. Some hosts leave it wide open and sell you “RDP protection” as a separate firewall; others silently null-route 3389 for the first ten minutes after provisioning to stop credential-stuffing bots hitting a fresh image with the default Administrator password. If RDP is unreachable right after build and works later, that is not a bug.
Testing from outside without guessing
Never test from the machine you are trying to reach. A loopback connection goes through the Windows filter but skips every upstream hop, so it proves nothing about host filtering. Use a second VPS, a home connection, or an external port checker that reports timeout versus refused — the distinction is the whole diagnosis.
A timeout means packets are dropped silently, which points at an upstream firewall or a DROP rule. A connection refused means the packet arrived and the guest’s TCP stack answered with RST, which means no listener is bound even though the port is reachable. If you get refused, the host is not your problem; the service is.
# from an external Windows box
Test-NetConnection 203.0.113.10 -Port 445 -InformationLevel Detailed
# what the guest firewall actually says
Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction
Get-NetFirewallRule -Direction Inbound -Enabled True |
Get-NetFirewallPortFilter | Select Protocol,LocalPortWhen you legitimately need an unusual port open
Some workloads genuinely need inbound 1433 for SQL, 8080 for a self-hosted agent, or a custom TCP range for a game server. Most hosts will unblock a port on request if you explain the service and accept the abuse policy; a few will only allow it behind their network firewall product at extra cost. Ask before you build, not after.
Where the host refuses, the standard workaround is to tunnel over an allowed port. SSH on 443, WireGuard on UDP 51820 if permitted, or an outbound-only reverse tunnel from an agent inside the guest. This keeps your exposure surface identical to every other tenant’s, which is exactly what the host wants.
Locking down 3389 properly
Enable Network Level Authentication, then add a firewall scope rule so only your management addresses reach 3389. A single New-NetFirewallRule with -RemoteAddress set to your office range cuts brute-force attempts from tens of thousands a day to zero, and the Security log stops filling with 4625 events.
Set the account lockout threshold to 10 attempts and reset counter to 15 minutes, and check the log weekly with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}. If the count rises after a firewall change, the change did not apply to the profile in use — verify with Get-NetConnectionProfile that the NIC is not sitting on the Domain profile unexpectedly.
Ports to close inside the guest as well
Even with a host blocklist, close 135, 139, 445 and 5355 inside the guest. Disable LLMNR and NetBIOS, and set the firewall’s public profile default inbound action to Block. That way a future migration to a host with a weaker edge does not silently expose SMB on day one.
Audit with netstat -ano | findstr LISTENING after every software install. Anything bound to 0.0.0.0 that you did not expect is a decision someone made for you. Bind services to 127.0.0.1 where they only serve local callers, and let IIS or the tunnel terminate the public side.
What to ask a provider before signing
Four questions: is inbound 445 blocked at the edge, is there any inbound rate limit on 3389, can ports be unblocked on request, and is the blocklist documented. A provider that answers all four in the sales conversation is one whose network you can reason about at 2 a.m. when something stops answering.
If the answer is “we block nothing, you handle it”, that is a valid posture too — it just means your Windows Firewall is the only line of defence, and the rules on it need to be treated like production code. Back them up with netsh advfirewall export and diff them after every change. Whether you are picking a plan or defending one, the Windows VPS provider notes cover how each host documents its network edge.