Accessing a Windows machine remotely via SSH from outside your local network requires enabling the built-in OpenSSH server, configuring port forwarding on your router, and ensuring proper firewall rules are in place. This guide outlines the PowerShell commands needed to activate the service and secure external access without relying on third-party software.
Enabling OpenSSH Server on Windows 10 and 11
Modern versions of Windows include OpenSSH capabilities as optional features rather than pre-installed services. To gain remote access, you must first install the server component. Unlike older server operating systems that used Install-WindowsFeature, Windows 10 and 11 use the Add-WindowsCapability cmdlet. This distinction is critical because using incorrect commands can lead to installation failures or non-functional services.
Open PowerShell with administrative privileges by right-clicking the Start menu icon and selecting "Terminal (Admin)" or "Windows PowerShell (Admin)." Execute the following command to install the OpenSSH Server:
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0Once the installation completes, verify that the feature was added successfully. You can check the status by running Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'. The output should show both the client and server capabilities with a state of "Installed." If the state remains "NotPresent," ensure your internet connection is active and retry the installation command.
Configuring the SSH Service and Firewall
After installation, the SSH service does not start automatically. You need to start the service and configure it to launch at boot time. Use the following commands to achieve this:
Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'By default, Windows Defender Firewall may block incoming connections on port 22. While some configurations allow traffic by default, explicitly creating an inbound rule ensures reliability. Run this command to add the necessary firewall exception:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22If you have changed the default SSH port for security reasons, replace 22 with your custom port number in both the service startup configuration and the firewall rule. It is also advisable to modify the sshd_config file located at C:\ProgramData\ssh\sshd_config if you wish to restrict root login or change authentication methods, though the default settings are generally sufficient for basic access.
Setting Up Port Forwarding on Your Router
External access requires your home router to direct incoming traffic to your specific Windows machine. This process is known as port forwarding. You must first assign a static IP address to your Windows computer to prevent its local IP from changing after reboots. You can do this via the Network Adapter settings in Control Panel or by reserving the IP in your router's DHCP settings.
Navigate to your router's administration page, typically accessible via 192.168.1.1 or 192.168.0.1 in a web browser. Look for a section labeled "Port Forwarding," "Virtual Servers," or "NAT." Create a new rule with the following parameters:
- Service Name: SSH
- External Port: 22 (or your custom port)
- Internal Port: 22
- Internal IP Address: The static IP of your Windows PC
- Protocol: TCP
Save the settings and restart the router if necessary. This step bridges the gap between the public internet and your private local network, allowing external requests to reach your SSH daemon.
Connecting from Outside the Network
To connect from an external location, you need the public IP address of your home network. Visit a site like whatismyipaddress.com from a device connected to the same Wi-Fi to find this address. Alternatively, if your ISP assigns dynamic IPs, consider setting up a Dynamic DNS (DDNS) service to map a domain name to your changing IP address.
From any remote machine, open a terminal and use the standard SSH syntax. Replace username with your Windows user account name and public_ip with your home network's public IP:
ssh username@public_ipYou will be prompted for your Windows password. If you encounter connection timeouts, verify that your router's port forwarding is active and that no other firewall software (such as third-party antivirus suites) is blocking the connection. For enhanced security, consider generating SSH keys and disabling password authentication in the sshd_config file, allowing only key-based logins.
Frequently Asked Questions
Why does my SSH connection time out even after port forwarding?
This is often caused by your ISP blocking port 22 or a secondary firewall on your router interfering with the rule. Try changing the external port to something unusual like 2222 in your router settings and update your SSH command to ssh -p 2222 user@ip. If it works, your ISP is likely filtering standard ports.
Can I use SSH on Windows Home edition?
Yes, Windows Home editions support the OpenSSH server just like Pro or Enterprise versions. The installation commands and configuration steps remain identical, provided you have administrative privileges to run PowerShell as an administrator.
Is it safe to expose my Windows PC directly to the internet via SSH?
Exposing SSH directly carries risks such as brute-force attacks. It is safer to use key-based authentication exclusively, disable password login, and consider using a reverse proxy or a tunneling service like Tailscale if you want to avoid opening router ports entirely.
What happens if my public IP address changes?
If your ISP uses dynamic IP addressing, your connection will break when the IP changes. To solve this, configure a Dynamic DNS (DDNS) service on your router or use a tool like Dynu to update a hostname automatically whenever your IP changes.
How do I reset the SSH server if it stops working?
If the service becomes unresponsive, restart it using PowerShell with Restart-Service sshd. If issues persist, check the event viewer under Applications and Services Logs > OpenSSH for detailed error messages regarding configuration syntax or permission errors.