Windows Defender Firewall protects every Windows Server and is on by default. The GUI (wf.msc) is fine for one rule, but PowerShell is faster, scriptable and repeatable — essential when you manage several servers. All commands below run in an elevated PowerShell window.

Check status and profiles

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction

Windows has three profiles — Domain, Private and Public — and applies the one matching the network type. A VPS’s internet-facing adapter is usually Public. Make sure the firewall is enabled:

Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

List rules

# Enabled inbound allow rules
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow |
  Sort-Object DisplayName | Format-Table DisplayName, Profile, Direction

# With ports (slower — joins port filters)
Get-NetFirewallRule -Direction Inbound -Enabled True |
  Get-NetFirewallPortFilter | Where-Object LocalPort -ne 'Any' |
  Format-Table @{n='Rule';e={(Get-NetFirewallRule -AssociatedNetFirewallPortFilter $_).DisplayName}}, Protocol, LocalPort

# Search by name
Get-NetFirewallRule -DisplayName "*Remote Desktop*" | Format-Table DisplayName, Enabled, Profile

Allow a port

New-NetFirewallRule -DisplayName "HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
New-NetFirewallRule -DisplayName "Web" -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Allow
New-NetFirewallRule -DisplayName "Game UDP" -Direction Inbound -Protocol UDP -LocalPort 27015-27030 -Action Allow

By default a new rule applies to all profiles (-Profile Any).

Allow only specific IP addresses

The most important pattern for admin services (RDP, SQL Server, remote management):

New-NetFirewallRule -DisplayName "SQL Server from app server" -Direction Inbound `
  -Protocol TCP -LocalPort 1433 -RemoteAddress 203.0.113.5 -Action Allow

Restrict an existing rule — for example Remote Desktop:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 198.51.100.25, 10.8.0.0/24

See protecting RDP from brute-force attacks.

Allow a program

New-NetFirewallRule -DisplayName "MyApp" -Direction Inbound `
  -Program "C:\Apps\MyApp\myapp.exe" -Action Allow

Program-based rules follow the application whatever port it uses — handy for trading platforms or game servers with dynamic ports.

Block traffic

New-NetFirewallRule -DisplayName "Block bad IP" -Direction Inbound -RemoteAddress 192.0.2.66 -Action Block
New-NetFirewallRule -DisplayName "Block outbound SMB" -Direction Outbound -Protocol TCP -RemotePort 445 -Action Block

Block rules win over allow rules in Windows Firewall, regardless of order.

Enable, disable, change, remove

Disable-NetFirewallRule -DisplayName "HTTPS"
Enable-NetFirewallRule -DisplayName "HTTPS"
Set-NetFirewallRule -DisplayName "HTTPS" -Profile Public
Remove-NetFirewallRule -DisplayName "HTTPS"

# Built-in groups, e.g. file sharing — disable on internet-facing servers
Disable-NetFirewallRule -DisplayGroup "File and Printer Sharing"

Allow ping (ICMP)

Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"
# or a dedicated rule
New-NetFirewallRule -DisplayName "Allow ICMPv4 Echo" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow

Rule display names are localised on non-English Windows; use -Name (the internal name) in scripts, e.g. FPS-ICMP4-ERQ-In.

Logging

Set-NetFirewallProfile -Profile Public -LogBlocked True -LogAllowed False `
  -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log" -LogMaxSizeKilobytes 16384
Get-Content "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log" -Tail 20

Useful to see what’s being blocked while troubleshooting a connection.

Back up and restore the configuration

netsh advfirewall export "C:\Backup\firewall.wfw"
netsh advfirewall import "C:\Backup\firewall.wfw"

Test from outside

Test-NetConnection 203.0.113.10 -Port 443

Run it from another machine. TcpTestSucceeded : True means the port is reachable and something is listening.

Don’t lock yourself out

Before changing RDP rules or default policies, make sure you can reach the VNC console in your VPS control panel — it works independently of the firewall. If you lock yourself out of RDP, log in there and run:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress Any

Related: Windows advanced firewall rules, changing the RDP port and Windows Server initial setup. Our Windows VPS plans include console access for exactly these situations.

  • Windows Server
  • Firewall
  • PowerShell