When a program can’t accept connections (a game server nobody can join, a web server that works locally but not from outside, a database other machines can’t reach), Windows Firewall is often the reason. A firewall exception (an allow rule) lets traffic reach a specific app or port. Here’s how to add one safely, from the simplest method to the most precise.

App exception vs port exception

Type What it allows Use when
App (program) exception The program, on whatever ports it listens on The app picks ports dynamically, or uses several
Port exception A specific TCP/UDP port, for any program You know the exact port (web 80/443, RDP 3389, game ports)

App exceptions are convenient. Port exceptions are more predictable, and easier to audit.

Method 1: Windows Security (allow an app)

  1. Open Windows Security → Firewall & network protection.
  2. Click Allow an app through firewall.
  3. Click Change settings (admin rights needed).
  4. Find the app and tick Private and/or Public. If it’s not listed, click Allow another app… and browse to the .exe.
  5. Click OK.

On Windows Server the same dialog is in Control Panel → Windows Defender Firewall → Allow an app or feature through Windows Defender Firewall.

Private vs Public: on a laptop, allowing only Private means the app is reachable at home but not on café Wi-Fi. On a VPS, the network is usually classified as Public, so tick Public there.

When an app first listens on the network, Windows often shows a pop-up asking whether to allow it. Choosing “Allow” creates the same kind of exception.

Method 2: Advanced Security (open a port)

  1. Run wf.msc.
  2. Inbound Rules → New Rule… → Port.
  3. TCP or UDP, Specific local ports (e.g. 8080 or 25565).
  4. Allow the connection.
  5. Choose profiles, give it a name, and finish.

For better security, open the rule’s Properties → Scope, and limit Remote IP addresses to the machines that need access. See Windows Firewall rules for how rule precedence works.

Method 3: PowerShell

# Port exception
New-NetFirewallRule -DisplayName "Web 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow

# App exception
New-NetFirewallRule -DisplayName "Game Server" -Direction Inbound -Program "C:\Games\server.exe" -Action Allow

# TCP and UDP for the same port (two rules)
New-NetFirewallRule -DisplayName "App TCP 7777" -Direction Inbound -Protocol TCP -LocalPort 7777 -Action Allow
New-NetFirewallRule -DisplayName "App UDP 7777" -Direction Inbound -Protocol UDP -LocalPort 7777 -Action Allow

# Only from one network
New-NetFirewallRule -DisplayName "SQL from app server" -Direction Inbound -Protocol TCP -LocalPort 1433 `
  -RemoteAddress 10.0.0.0/24 -Action Allow

Run PowerShell as Administrator.

Method 4: netsh (older systems and scripts)

netsh advfirewall firewall add rule name="Web 8080" dir=in action=allow protocol=TCP localport=8080
netsh advfirewall firewall add rule name="Game Server" dir=in action=allow program="C:\Games\server.exe" enable=yes
netsh advfirewall firewall delete rule name="Web 8080"

Enable built-in exceptions

Windows ships disabled rule groups for common features. Enable them instead of writing your own:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing"
Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"   # allow ping

Test that it works

  1. Confirm the app is actually listening:
Get-NetTCPConnection -State Listen -LocalPort 8080

If it listens only on 127.0.0.1, change the app’s bind address. The firewall isn’t the problem.

  1. Test from another machine:
Test-NetConnection your-server-ip -Port 8080

From Linux or macOS: nc -zv your-server-ip 8080. For UDP, test with the application itself.

  1. Still blocked? Check for a block rule matching the same traffic (block wins over allow), a third-party antivirus firewall, your router (for home PCs, port forwarding), or your hosting provider’s network firewall.

Remove exceptions you don’t need

Every open port is a potential entry point. Review periodically:

Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True | Format-Table DisplayName, Profile
Remove-NetFirewallRule -DisplayName "Web 8080"

Don’t disable Windows Firewall entirely to “fix” connectivity. Add the specific exception instead.

Common ports

Service Port
HTTP / HTTPS TCP 80 / 443
RDP TCP 3389 (and UDP 3389)
SQL Server TCP 1433
MySQL TCP 3306
Minecraft Java TCP 25565
SMB file sharing TCP 445 (never expose to the internet)

Quick reference

Goal Fastest way
Allow an app Windows Security → Allow an app through firewall
Open a port New-NetFirewallRule … -LocalPort N -Action Allow
Limit to IPs -RemoteAddress or rule Scope tab
Test Test-NetConnection host -Port N
Audit Get-NetFirewallRule -Direction Inbound -Action Allow

Related: Windows Firewall logging and Windows VPS.

  • Windows
  • Firewall
  • Networking