Every SFTP server listens on TCP port 22, and your firewall has to let the right people reach it - and nobody else. This page draws the line between a LAN setup, which is easy and safe, and internet exposure, which needs real conditions first.
The script's install adds the firewall rule for you, and inside a home or office network that is the end of the story. The trouble starts with one extra step people take casually: forwarding port 22 on the router so the server is reachable from the internet. Automated scanners probe port 22 on every public IP address, around the clock, looking for exactly this. Here is how to think about each level of exposure honestly.
Open PowerShell as administrator and run Get-NetFirewallRule -Name *sshd* to see the OpenSSH rule, and netstat -an | findstr :22 to confirm the server is listening - you should see TCP 0.0.0.0:22 in the LISTENING state. A listening port with no firewall rule is unreachable; a firewall rule with nothing listening is harmless. Both halves must exist for anyone to connect, which is also why deleting the rule is a quick emergency off switch.
If everyone who uses this server is on your own network - same office, same home - do not touch the router. No port forwarding is required for LAN access, and adding one only creates exposure you get nothing for. The Windows firewall rule the install made is sufficient, and you can tighten it further by scoping it to your subnet, as covered in the hardening guide. The moment a setup guide tells a LAN user to open ports on the router, it is giving dangerous advice.
Changing the public port to something like 2222 reduces log noise but adds no real security - scanners find open ports wherever they are. Treat it as tidiness, never as protection.
For most small offices the better design is: no forwarded port at all. Staff first connect to the network through a VPN - the router's built-in VPN, a WireGuard or Tailscale-style mesh VPN, or a proper remote-access product - and then use SFTP as if they were sitting in the office. The SFTP server stays invisible to the internet, the VPN handles the strong authentication once, and every internal service benefits. Port forwarding is the shortcut; the VPN is the structure.
See the complete SFTP server setup on screen, step by step, in the Technical Anshu video.
Watch Full VideoNo. Port forwarding is only for reaching the server from outside your network. Everyone on the same LAN reaches it through the Windows firewall rule alone, with no router changes.
It cuts down automated log noise, because the laziest bots only try 22. It does not hide the server from a real scan. Key-only login and updates are the measures that actually protect it.
Failed attempts in the log are the normal background noise of an internet-facing SSH port. A successful login by an account you do not recognise is the emergency - which is why key-only login and the log-checking habit matter.