Windows Defender Firewall filters network traffic on every Windows PC and server. On a Windows VPS it’s your first line of defence: it decides which ports are reachable from the internet. Understanding how rules, profiles and precedence work lets you open exactly what you need (RDP, a web server, a game server) and nothing more.

Profiles

Each network connection is assigned a profile, and rules can apply to one or more profiles:

Profile Used when
Domain The machine is joined to an Active Directory domain and can reach a domain controller
Private Trusted networks (home, office)
Public Untrusted networks. A VPS’s internet-facing adapter is usually Public

Check the active profile:

Get-NetConnectionProfile
Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction

By default, inbound traffic is blocked unless a rule allows it, and outbound traffic is allowed.

How rules are evaluated

  1. Block rules take precedence over allow rules, when both match.
  2. If no rule matches, the profile’s default action applies (inbound: block).
  3. More specific rules don’t override block rules: an explicit block always wins.

So the usual approach is: keep the default inbound block, and add narrow allow rules.

Create rules in the GUI

Open Windows Defender Firewall with Advanced Security (wf.msc):

  1. Inbound Rules → New Rule…
  2. Choose Port (or Program, if you want to allow an application on any port).
  3. TCP or UDP, and the specific port (e.g. 443, or 27015-27030).
  4. Allow the connection.
  5. Select profiles (on a VPS, usually Public, or all three).
  6. Name it clearly (“HTTPS in”, “Minecraft TCP 25565”).

Then open the rule’s Properties → Scope to restrict remote IP addresses, for example to your office IP for RDP.

Create rules with PowerShell

Faster, repeatable, and scriptable:

# Allow HTTPS from anywhere
New-NetFirewallRule -DisplayName "HTTPS in" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

# Allow RDP only from one IP
New-NetFirewallRule -DisplayName "RDP from office" -Direction Inbound -Protocol TCP -LocalPort 3389 `
  -RemoteAddress 203.0.113.25 -Action Allow

# Allow a UDP port range for a game server
New-NetFirewallRule -DisplayName "Game UDP" -Direction Inbound -Protocol UDP -LocalPort 27015-27030 -Action Allow

# Allow an application (any port it listens on)
New-NetFirewallRule -DisplayName "MyApp" -Direction Inbound -Program "C:\Apps\myapp.exe" -Action Allow

# Block an outbound destination
New-NetFirewallRule -DisplayName "Block bad host" -Direction Outbound -RemoteAddress 198.51.100.66 -Action Block

The legacy netsh advfirewall firewall add rule … syntax still works, but PowerShell is the modern way.

View, change and remove rules

Get-NetFirewallRule -Direction Inbound -Enabled True | Sort-Object DisplayName | Format-Table DisplayName, Action, Profile

# Ports and addresses of a rule
Get-NetFirewallRule -DisplayName "RDP from office" | Get-NetFirewallPortFilter
Get-NetFirewallRule -DisplayName "RDP from office" | Get-NetFirewallAddressFilter

Disable-NetFirewallRule -DisplayName "Game UDP"
Set-NetFirewallRule -DisplayName "RDP from office" -RemoteAddress 203.0.113.25,198.51.100.7
Remove-NetFirewallRule -DisplayName "MyApp"

Many built-in rules are grouped (e.g. “Remote Desktop”, “File and Printer Sharing”): enable a whole group with Enable-NetFirewallRule -DisplayGroup "Remote Desktop".

Secure RDP on a Windows VPS

RDP exposed to the whole internet is constantly attacked by password-guessing bots. Recommended:

  • restrict the RDP rule’s remote addresses to your own IPs;
  • use strong passwords and account lockout policies;
  • optionally change the RDP port (reduces noise, not a security fix). See changing the RDP port;
  • or use a VPN and allow RDP only from the VPN. See WireGuard VPN server.

Before restricting RDP, make sure you have another way in: the VNC console in your VPS control panel works even if a firewall rule locks you out.

Export, import and reset

netsh advfirewall export "C:\backup\firewall.wfw"
netsh advfirewall import "C:\backup\firewall.wfw"
netsh advfirewall reset      # back to defaults (careful on remote machines!)

Resetting on a remote server can cut your RDP session. Have console access ready.

Audit what’s open

# Which ports are listening?
Get-NetTCPConnection -State Listen | Sort-Object LocalPort | Format-Table LocalAddress, LocalPort, OwningProcess

# Which inbound allow rules are active?
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True |
  ForEach-Object { $p = $_ | Get-NetFirewallPortFilter; [pscustomobject]@{Name=$_.DisplayName; Proto=$p.Protocol; Port=$p.LocalPort} }

Compare the two lists, and disable rules for services you don’t run. Turn on logging to see what’s being blocked. See Windows Firewall logging.

Quick reference

Task PowerShell
Allow port New-NetFirewallRule -Direction Inbound -Protocol TCP -LocalPort N -Action Allow
Limit to IP -RemoteAddress x.x.x.x
Allow program -Program "C:\path\app.exe"
List rules Get-NetFirewallRule
Disable / remove Disable-NetFirewallRule, Remove-NetFirewallRule
Profiles Get-NetFirewallProfile
Backup netsh advfirewall export file.wfw

Related: allowing apps through Windows Firewall and Windows VPS hosting.

  • Windows
  • Firewall
  • Security