I am trying to get a remote PowerShell session to a Windows Server 2016 deployed on Azure via its public IP address (initially I was trying to configure Server management tools gateway, however I can't get it working even between two identical, freshly deployed servers).
I have two servers (target
10.0.0.4 and source
10.0.0.5) connected to the same subnet and I can connect from the source to the target on local network (
PS C:\> Set-Item WSMan:\localhost\Client\TrustedHosts -Value "10.0.0.4" -Concatenate -Force PS C:\> Enter-PSSession -ComputerName 10.0.0.4 -Credential (Get-Credential) cmdlet Get-Credential at command pipeline position 1 Supply values for the following parameters: Credential [10.0.0.4]: PS C:\Users\techraf\Documents> exit
If I however try to use the target's public IP address the connection gets refused:
PS C:\> Set-Item WSMan:\localhost\Client\TrustedHosts -Value "220.127.116.11" -Concatenate -Force PS C:\> Enter-PSSession -ComputerName 18.104.22.168 -Credential (Get-Credential) cmdlet Get-Credential at command pipeline position 1 Supply values for the following parameters: Credential Enter-PSSession : Connecting to remote server 22.214.171.124 failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic. At line:1 char:1 + Enter-PSSession -ComputerName 126.96.36.199 -Credential (Get-Credentia ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (188.8.131.52:String) [Enter-PSSession], PSRemotingTransportException + FullyQualifiedErrorId : CreateRemoteRunspaceFailed
Prior to trying I have:
- created an inbound rule in the NSG for TCP ports 5985 and 5986 (for the whole internet)
- disabled (completely, for a test) Windows firewall on the target system
I also checked the target ports with
nmap from the source machine, and while 5985 is open, 5986 is closed (including connection on
Is there anything else required to make it work?