diff --git a/CHANGELOG.md b/CHANGELOG.md
index 55dc2e208..a06d93b0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,8 @@ BUG FIXES:
       crash. [GH-3827]
   - guests/windows: Private networks with static IPs work when there
       is more than one. [GH-3818]
+  - guests/windows: Don't look up a forwarded port for WinRM if we're
+      not accessing the local host. [GH-3861]
   - providers/docker: Never do graceful shutdown, always use
       `docker stop`. [GH-3798]
   - providers/docker: Better error messaging when SSH is not ready
diff --git a/plugins/communicators/winrm/communicator.rb b/plugins/communicators/winrm/communicator.rb
index bfabd2fb1..839061e26 100644
--- a/plugins/communicators/winrm/communicator.rb
+++ b/plugins/communicators/winrm/communicator.rb
@@ -107,7 +107,8 @@ module VagrantPlugins
       # about this machine.
       def create_shell
         host_address = Helper.winrm_address(@machine)
-        host_port    = Helper.winrm_port(@machine)
+        host_port    = Helper.winrm_port(
+          @machine, host_address == "127.0.0.1")
 
         WinRMShell.new(
           host_address,
diff --git a/plugins/communicators/winrm/helper.rb b/plugins/communicators/winrm/helper.rb
index 4ce47ab2b..91349153f 100644
--- a/plugins/communicators/winrm/helper.rb
+++ b/plugins/communicators/winrm/helper.rb
@@ -22,9 +22,13 @@ module VagrantPlugins
       #
       # @param [Vagrant::Machine] machine
       # @return [Integer]
-      def self.winrm_port(machine)
+      def self.winrm_port(machine, local=true)
         host_port = machine.config.winrm.port
         if machine.config.winrm.guest_port
+          # If we're not requesting a local port, return
+          # the guest port directly.
+          return machine.config.winrm.guest_port if !local
+
           # Search by guest port if we can. We use a provider capability
           # if we have it. Otherwise, we just scan the Vagrantfile defined
           # ports.