Open a port in Windows Server Firewall (GUI, PowerShell and netsh) — and test it

Short answer: run one PowerShell command as Administrator on the server, then test from your own computer. Add -RemoteAddress with your IP to open the port for you alone instead of the whole internet. A firewall rule only lets traffic through to a program that is actually listening, so check that as well.

New-NetFirewallRule -DisplayName "App 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow

# is anything listening on 8080?
netstat -ano | findstr :8080

New-NetFirewallRule -DisplayName "App 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -RemoteAddress 198.51.100.7 -Action Allow

Create one of the two rules, not both. Replace 8080 with your port, 198.51.100.7 with your own public IP, and 203.0.113.10 below with the server’s address.

Test-NetConnection 203.0.113.10 -Port 8080
# ...
# TcpTestSucceeded : True

The same works on Windows Server 2025, 2022, 2019 and 2016, and on Windows 10 and 11. The sections below cover the GUI, netsh, ping, cleaning up rules and what to check when the port still looks closed.

How do I open a port in the Windows Firewall GUI?

1. 1Open the advanced firewall console

   Press Win + R, type wf.msc and press Enter. That opens Windows Defender Firewall with Advanced Security. The simpler “Allow an app through firewall” page in the Control Panel cannot open ports.

2. 2Create an inbound rule

   Click Inbound Rules on the left, then New Rule… on the right. Choose Port and click Next.

3. 3Enter protocol and port

   Pick TCP or UDP and enter the port under Specific local ports: a single port (8080), a list (80, 443) or a range (27015-27030). A service that needs both protocols needs two rules.

4. 4Allow, for all profiles

   Select Allow the connection, leave Domain, Private and Public ticked, then give the rule a name you will recognise later, such as “App 8080”, and click Finish.

To limit the rule to certain addresses afterwards, open it, go to the Scope tab, choose These IP addresses under Remote IP address and add yours.

How do I open a port with PowerShell?

New-NetFirewallRule is the scriptable equivalent of the wizard and the method Microsoft recommends. Run PowerShell as Administrator:

# one TCP port
New-NetFirewallRule -DisplayName "App 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow

# several ports in one rule
New-NetFirewallRule -DisplayName "Web 80 443" -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Allow

# a UDP range, e.g. for a game server
New-NetFirewallRule -DisplayName "Game UDP" -Direction Inbound -Protocol UDP -LocalPort 27015-27030 -Action Allow

-LocalPort is the port on the server. -RemotePort is the port on the client’s side, which is random, and using it by mistake is a common reason a rule “does nothing”.

Game servers on Windows need rules like the UDP one above. The gaming VPS page lists the default ports of nine game servers, Enshrouded and ARK: Survival Ascended among them.

Which firewall profile does a VPS use?

Windows sorts every network into Domain, Private or Public, and each rule applies to one or more of them. A server’s internet-facing adapter is usually Public:

Get-NetConnectionProfile | Format-Table InterfaceAlias, NetworkCategory

New-NetFirewallRule uses -Profile Any unless you say otherwise, so its rules apply everywhere. Rules created by installers or by the “Windows Defender Firewall has blocked some features of this app” pop-up are sometimes limited to the Private or Domain profile and then never match on a Public adapter. Set-NetFirewallRule -DisplayName "App 8080" -Profile Any fixes such a rule.

Is the Windows Firewall on by default?

Yes. On Windows Server it is enabled for all three profiles and blocks unsolicited inbound traffic unless a rule allows it. Enabling Remote Desktop switches on the matching rules, which is why RDP works on a fresh server while everything else stays closed:

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction
# "NotConfigured" means the built-in default: Block for inbound, Allow for outbound

Outbound traffic is allowed by default, so a server that only needs to be reached needs inbound rules alone. You need an outbound allow rule only after switching the outbound default to Block, and then it filters on -RemotePort, the port on the other end:

New-NetFirewallRule -DisplayName "Out HTTPS" -Direction Outbound -Protocol TCP -RemotePort 443 -Action Allow

What is the netsh equivalent?

netsh advfirewall still works in Command Prompt, batch files and old scripts:

netsh advfirewall firewall add rule name="App 8080" dir=in action=allow protocol=TCP localport=8080

rem limited to one address
netsh advfirewall firewall add rule name="App 8080" dir=in action=allow protocol=TCP localport=8080 remoteip=198.51.100.7

netsh advfirewall firewall show rule name="App 8080"
netsh advfirewall firewall delete rule name="App 8080"

How do I allow a port only from my IP address?

Add -RemoteAddress. It takes single addresses, CIDR ranges and the keyword LocalSubnet, and you can change an existing rule the same way:

New-NetFirewallRule -DisplayName "DB 5432 office" -Direction Inbound -Protocol TCP -LocalPort 5432 -RemoteAddress 198.51.100.7 -Action Allow

# change an existing rule; several addresses and ranges are fine
Set-NetFirewallRule -DisplayName "App 8080" -RemoteAddress 198.51.100.7, 192.0.2.0/24

To see which address the server will see, run curl.exe -4 https://ifconfig.me on your own PC or open the What is my IP page there. Do not add a separate “block everyone” rule next to the allow rule: in Windows Firewall a block rule beats an allow rule, so it would lock you out too. Narrow the allow rule instead, and make sure no other rule opens the same port to everyone.

How do I allow ping on Windows Server 2025, 2022 and 2019?

Windows Server answers ping only when an inbound rule allows ICMP echo requests, and by default none does on a public network. Create explicit rules:

New-NetFirewallRule -DisplayName "Allow ping ICMPv4" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -Action Allow
New-NetFirewallRule -DisplayName "Allow ping ICMPv6" -Direction Inbound -Protocol ICMPv6 -IcmpType 128 -Action Allow

The netsh version of the IPv4 rule, for Command Prompt or a batch file:

netsh advfirewall firewall add rule name="Allow ping ICMPv4" protocol=icmpv4:8,any dir=in action=allow

Windows also ships a ready-made rule you can switch on instead: Enable-NetFirewallRule -Name FPS-ICMP4-ERQ-In, shown in the GUI as File and Printer Sharing (Echo Request - ICMPv4-In). Check its Scope tab afterwards: depending on the profile it can be limited to the local subnet, and then pings from the internet still fail. Add -RemoteAddress to the explicit rules above if only your monitoring service should get an answer.

Should I use a port rule or a program rule?

• Port rule — opens a fixed port for whichever program listens on it. Predictable and easy to audit. The right choice for web servers, databases and anything else with a well-known, fixed port.
• Program rule — allows whatever ports one executable opens. Useful for software that picks its ports at runtime. Point it at the exact .exe:

New-NetFirewallRule -DisplayName "MyApp" -Direction Inbound -Program "C:\Apps\MyApp\myapp.exe" -Action Allow

# tightest: this program, this port only
New-NetFirewallRule -DisplayName "MyApp 8080" -Direction Inbound -Program "C:\Apps\MyApp\myapp.exe" -Protocol TCP -LocalPort 8080 -Action Allow

How do I list, disable or delete firewall rules?

# one rule and its port and address filters
Get-NetFirewallRule -DisplayName "App 8080" | Format-List DisplayName, Enabled, Direction, Action, Profile
Get-NetFirewallRule -DisplayName "App 8080" | Get-NetFirewallPortFilter
Get-NetFirewallRule -DisplayName "App 8080" | Get-NetFirewallAddressFilter

# every rule that mentions port 8080 (takes a few seconds)
Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -contains '8080' } |
    Get-NetFirewallRule | Format-Table DisplayName, Enabled, Direction, Action, Profile

# switch off, switch on, remove
Disable-NetFirewallRule -DisplayName "App 8080"
Enable-NetFirewallRule  -DisplayName "App 8080"
Remove-NetFirewallRule  -DisplayName "App 8080"

Disable a rule first if you are unsure; a disabled rule can be switched back on, a removed one has to be rebuilt.

How do I “ping” a port?

You cannot: ping uses ICMP, which has no ports. What you want is a TCP connection test, and it has to run from outside the server. A test from the server to its own address never passes through the inbound rules, so it proves nothing about the firewall.

Test-NetConnection 203.0.113.10 -Port 8080

WARNING: Ping to 203.0.113.10 failed with status: TimedOut

ComputerName     : 203.0.113.10
RemoteAddress    : 203.0.113.10
RemotePort       : 8080
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.1.20
TcpTestSucceeded : True

Read TcpTestSucceeded and nothing else. Test-NetConnection pings first, and the ping warning only means ICMP is blocked, which is normal; the port can be open anyway. In PowerShell 7, Test-Connection 203.0.113.10 -TcpPort 8080 prints just True or False.

nc -zv 203.0.113.10 8080

Connection to 203.0.113.10 8080 port [tcp/http-alt] succeeded!

If you have nmap installed, nmap -p 8080 203.0.113.10 tells the three cases apart: open means the rule works and something listens, closed means the port is reachable but nothing listens on it, and filtered means a firewall drops the packets.

The old Telnet client works too: install it with Install-WindowsFeature Telnet-Client on Windows Server or dism /online /Enable-Feature /FeatureName:TelnetClient on Windows 10 and 11, then run telnet 203.0.113.10 8080. A blank window means the port is open. None of these tools can test UDP reliably; for a UDP port, test with the application itself.

No second machine at hand? Open the open port checker in a browser on the server itself. It connects from our side of the internet to the address the page sees you from — the server’s own public IPv4 address — so the test does pass through the inbound rules.

Why is the port still closed although the rule exists?

• Nothing is listening. netstat -ano | findstr :8080 must show a LISTENING line. If it does not, start the service; the firewall is not the problem. nmap reports this case as closed.
• The program only listens on localhost. 127.0.0.1:8080 in netstat means it accepts connections from the server itself only. Configure it to listen on 0.0.0.0 or the server’s IP.
• The rule does not match. Wrong profile, disabled, Outbound instead of Inbound, UDP instead of TCP, or -RemotePort instead of -LocalPort. The Get-NetFirewallRule commands above show all of it.
• A block rule wins. Clicking Cancel on the “blocked some features” pop-up can leave block rules for that program behind, and blocks beat allows. List them with Get-NetFirewallRule -Direction Inbound -Action Block -Enabled True.
• The application has its own switch. SQL Server Express, for example, ships with TCP/IP disabled and on a dynamic port until you change both in SQL Server Configuration Manager.
• Something upstream filters. A provider firewall or security group in front of the server needs the same port opened.

On a VMHeaven Windows VPS, DDoS protection filters attack traffic at the network level before it reaches the server, but it does not decide which ports your server offers; that is the Windows Firewall’s job and yours. If a rule ever cuts off your RDP session, the VNC console in the panel still reaches the desktop, so you can undo it there. Every Windows RDP server comes with the same console.

Frequently asked