To gain SSH access to a Windows computer from outside the local network, you must enable and start the built-in OpenSSH Server service using PowerShell, then configure your router for port forwarding. This approach eliminates the need for third-party clients like Posh-SSH for server functionality and relies on standard Windows networking components. By combining the native
OpenSSH server with dynamic DNS or static IP routing, you establish a secure remote management channel that is both reliable and easy to maintain without complex software dependencies.
Installing and Configuring the OpenSSH Server
The first step involves ensuring that the Windows machine has the necessary server components installed. While many modern versions of Windows 10 and 11 include the client by default, the server component often requires explicit installation via PowerShell. You should run the following command with administrative privileges to install the OpenSSH Server feature:
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Once the installation completes, you need to verify that the service is present and set it to start automatically. The service name in Windows is simply
sshd, not
OpenSSH-server. Using the correct service name is critical for managing the daemon effectively. Execute these commands to start the service and configure its startup type:
Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'
If the service fails to start, check the event viewer or the logs located in
C:\ProgramData\ssh\logs for specific error messages. Common issues include firewall blocks or incorrect permissions on the
authorized_keys file if you are using key-based authentication. For password authentication, ensure that the
sshd_config file in
C:\ProgramData\ssh\ allows password logins, which is usually enabled by default.
Configuring Firewall Rules
Windows Defender Firewall may block incoming SSH connections by default. You need to create an inbound rule to allow traffic on port 22. This can be done quickly via PowerShell using the
New-NetFirewallRule cmdlet. This command creates a rule that permits TCP traffic on port 22 from any source to the local machine.
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
After creating the rule, you can verify its existence by running
Get-NetFirewallRule | Where-Object DisplayName -eq "OpenSSH Server (sshd)". If the rule exists and is enabled, your local firewall is no longer the bottleneck. It is important to note that this rule applies to the public profile, but you should also ensure it is active for private and domain profiles if your network classification changes.
Setting Up Network Access and Port Forwarding
With the server running and the firewall open, the next challenge is accessing the machine from an external network. Home routers typically use NAT (Network Address Translation), which hides your internal IP address from the internet. To bridge this gap, you must configure port forwarding on your router.
Log into your router's administration panel and locate the Port Forwarding or Virtual Server section. Create a new rule that forwards external port 22 to the internal IP address of your Windows computer on port 22. For example, if your PC's local IP is
192.168.1.50, the rule should map external port 22 to
192.168.1.50:22.
Since most residential ISPs assign dynamic public IP addresses that change periodically, relying on a static IP is rarely feasible. Instead, use a Dynamic DNS (DDNS) service such as No-IP or DynDNS. Configure your router to update the DDNS provider whenever the public IP changes, or use a PowerShell script to push updates manually. This allows you to connect using a consistent hostname rather than remembering changing IP numbers.
For those interested in optimizing their shell environment before connecting, consider reviewing how to
configure powershell for OpenSSH instead of cmd to enhance productivity once connected.
Connecting Remotely
From any external device, you can now initiate an SSH connection. Use the standard
ssh command followed by your username and the DDNS hostname or public IP address. The syntax is straightforward:
ssh [email protected]
Do not use flags like
-P for port specification in the standard Windows OpenSSH client; the port is specified after the host using a colon, like
ssh user@host -p 22, though port 22 is the default. Once connected, you will have full command-line access to your Windows machine. For advanced security practices, such as generating proper keys or managing configurations, refer to guides on
gaining SSH access outside home networks to understand best practices for key management and security hardening.
Frequently Asked Questions
What if I get a connection timeout?
A timeout usually indicates that the packet is being dropped somewhere between your location and the Windows machine. Check your router's port forwarding rules to ensure they point to the correct local IP and that the service is actually listening on port 22. Additionally, verify that your ISP does not block port 22, as some providers restrict common server ports for residential accounts.
Is it safe to expose SSH directly to the internet?
Exposing SSH directly carries risks, including brute-force attacks. To mitigate this, use strong passwords or, preferably, SSH key authentication. You can also change the external port to something non-standard, like 2222, and forward it to internal port 22, which helps reduce automated scanning noise.
How do I find my Windows machine's local IP address?
You can find the local IP by opening PowerShell and running
ipconfig. Look for the IPv4 Address under your active network adapter, typically starting with
192.168.x.x or
10.x.x.x. Ensure this address is static within your router's DHCP settings to prevent it from changing after a reboot.
Can I use PowerShell remoting instead of SSH?
PowerShell Remoting uses WinRM over port 5985 (HTTP) or 5986 (HTTPS). While powerful, it is generally designed for internal corporate networks due to its complexity in traversing firewalls and NAT. SSH is preferred for external access because it is standardized, encrypted by default, and easier to configure across different operating systems.