Windows VPS Connection Methods: mstsc, RD Gateway, RemoteApp, and WinRM/SSH Requirements

Four different transports can connect you to a Windows VPS, and they have almost nothing in common beyond the TCP stack. mstsc is the familiar one, but it breaks the moment the target sits behind CGNAT or you need to publish a single application rather than a desktop. RD Gateway solves that with RPC-over-HTTPS on 443. RemoteApp removes the full desktop entirely. WinRM and OpenSSH serve a different audience: automation that never wants a GUI.

Each method has its own port, authentication model, and prerequisite set, and mixing them up is why “the server is unreachable” tickets drag on for hours. The table below is the short version; the sections after it explain what each transport needs before it will accept your credentials. What the hosting image enables by default varies by plan, and the Windows VPS plan comparison lists what each tier actually ships with.

Port and authentication matrix

Method	Port(s)	Auth	Requires
mstsc (RDP)	3389/TCP, 3389/UDP optional	NLA via CredSSP	TermService, RDP-Tcp listener
RD Gateway	443/TCP	HTTPS + NLA	RD Gateway role, valid certificate
RemoteApp	443 via Gateway or 3389	NLA, RDS CAL	RDS Session Host, published app
WinRM	5985/HTTP, 5986/HTTPS	Negotiate, Kerberos, Cert, Basic	WinRM listener, TrustedHosts
OpenSSH	22/TCP	Key or password	OpenSSH Server feature

mstsc: what the client actually negotiates

The client connects over TCP 3389, negotiates X.224, and then CredSSP if NLA is required. UDP 3389 is attempted concurrently and improves responsiveness on lossy links but is not mandatory; disabling UDP client-side fixes a specific class of reconnect stalls after Wi-Fi roaming. The .rdp file matters as much as the address: enablecredsspsupport:i:0 and authentication level:i:2 change what the server sees during negotiation.

On the server, read the listener settings directly from HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp: PortNumber, SecurityLayer (2 = TLS), and UserAuthentication (1 = NLA required). If a provider NAT is in front of the instance, the listener can be perfectly healthy while the port mapping is stale, so every test must originate outside the VPS network.

RD Gateway: RDP over 443 without exposing 3389

RD Gateway wraps the RDP stream inside HTTPS using the RPC-over-HTTP transport, so the only inbound port required is 443. The client requests /rpc/rpcproxy.dll on the gateway, which then opens the RDP connection to the target on your behalf. Authentication happens twice — once to the gateway and once to the target — both under NLA by default.

Prerequisites are a server certificate whose subject matches the gateway FQDN, the role installed with Install-WindowsFeature RDS-Gateway -IncludeManagementTools, and a connection authorization policy that permits the user group. A certificate name mismatch produces an immediate client rejection with nothing useful in the server log, which is the single most common misconfiguration on this transport.

RemoteApp: no desktop, just the application

RemoteApp publishes one executable so the user sees a window that behaves as if it were local while it runs remotely. Underneath it is still RDP; what changes is that the shell is replaced by the application entry point. Publishing requires the RDS-RD-Server feature, a published application definition, and RDS client access licences beyond a 120-day grace period. On a single VPS used by one or two administrators, the grace period is normally enough.

Publish with New-RDRemoteApp -CollectionName "QuickSessionCollection" -DisplayName "Navision" -FilePath "C:\Apps\nav.exe" -CommandLineSetting DoNotAllow. Where no RD Web feed is deployed, connect with mstsc /v:rdg.example.com /app:program:C:\Apps\nav.exe. The DoNotAllow flag is not optional: without it a user can pass switches that disable a safety check inside the app, and you will find out weeks later.

WinRM: PowerShell remoting and configuration management

WinRM is a SOAP listener over HTTP or HTTPS, not a screen-sharing protocol. Enable it server-side with Enable-PSRemoting -Force -SkipNetworkProfileCheck, which creates a 5985 listener restricted to the local subnet. From a remote network you must switch to 5986 with a TLS listener, or add the client to TrustedHosts, which weakens authentication to NTLM and should be limited to lab use.

Verify with Test-WSMan -ComputerName 203.0.113.10 -UseSSL -Port 5986. A 5985 listener that answers locally but not remotely almost always means the Windows firewall rule WINRM-HTTP-In-TCP is scoped to the domain profile while the VPS network is classified Public. Set the profile explicitly rather than disabling the firewall.

OpenSSH: the transport most admins forget exists

Windows Server 2019 and later ship an OpenSSH Server feature that makes port 22 usable for scp, sftp, and remote ssh sessions. Install with Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0, then set Start-Service sshd and Set-Service sshd -StartupType Automatic. The default shell is cmd.exe unless you change the registry DefaultShell value under HKLM:\SOFTWARE\OpenSSH.

For administrators who script against a Windows VPS, SSH keys plus WinRM covers nearly everything: SSH for file transfer and ad-hoc commands, WinRM for PowerShell session state. RDP is then reserved for the cases where you genuinely need a GUI, and you can close 3389 to the internet entirely without losing the ability to manage the box.

Choosing the minimum exposed surface

A practical posture is: one management port on a non-public path (RD Gateway on 443 or WireGuard), WinRM 5986 bound to the private interface, SSH on 22 restricted by source IP, and RDP never reachable from the internet. Every transport above then has a single accountable entry point, and the firewall rules fit on one screen.

Before committing to a transport that needs a public 443, confirm the plan includes a public IPv4 and does not sit behind carrier-grade NAT — the cheapest tiers sometimes do. The current options, including which ones expose a dedicated public IP, are on the provider comparison table.