How to Open a Port in Windows Firewall

There are three ways to open a port in Windows Firewall: the graphical “Inbound Rules” wizard, the netsh advfirewall command, or the modern PowerShell command New-NetFirewallRule. On servers PowerShell is the most convenient — one line creates the rule. All three options are below.

Method 1. The graphical interface

1. Press Win + R, type wf.msc, press Enter — “Windows Defender Firewall with Advanced Security” opens.
2. On the left choose Inbound Rules, then New Rule on the right.
3. Rule type — Port → Next.
4. Choose TCP (or UDP), enter the port, for example 443 → Next.
5. Allow the connection → Next.
6. Tick the profiles (Domain, Private, Public) → Next.
7. Give the rule a name, for example “Open 443 HTTPS” → Finish.

Method 2. PowerShell (recommended)

Open PowerShell as Administrator.

Open a TCP port

New-NetFirewallRule -DisplayName "Open 443 HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

Open a UDP port

New-NetFirewallRule -DisplayName "Open 53 DNS" -Direction Inbound -Protocol UDP -LocalPort 53 -Action Allow

Open a range or several ports

New-NetFirewallRule -DisplayName "Open App Ports" -Direction Inbound -Protocol TCP -LocalPort 8000-8010 -Action Allow

Allow a port from one IP only

New-NetFirewallRule -DisplayName "SQL from office" -Direction Inbound -Protocol TCP -LocalPort 1433 -RemoteAddress 203.0.113.5 -Action Allow

Method 3. netsh (the classic command)

It works on every Windows Server version, including the older ones:

netsh advfirewall firewall add rule name="Open 443 HTTPS" dir=in action=allow protocol=TCP localport=443

Managing rules in PowerShell

Inspect the rule you created:

Get-NetFirewallRule -DisplayName "Open 443 HTTPS"

Delete the rule:

Remove-NetFirewallRule -DisplayName "Open 443 HTTPS"

New-NetFirewallRule parameters

Listing all rules and profiles

To see only the enabled allow rules for inbound traffic:

Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True |
    Select-Object DisplayName, Profile

Check the overall firewall state per profile:

Get-NetFirewallProfile | Format-Table Name, Enabled

On a public-facing server the Public profile is normally the active one, so your new rules must apply to it.

Disabling a rule temporarily

Sometimes a rule should be switched off rather than deleted — during troubleshooting, for instance:

Disable-NetFirewallRule -DisplayName "Open 443 HTTPS"
Enable-NetFirewallRule -DisplayName "Open 443 HTTPS"

That way the rule is preserved and comes back without recreating it.

Verifying reachability

Locally, confirm the service is listening on the port:

Get-NetTCPConnection -LocalPort 443 -State Listen

From outside, test from another host:

Test-NetConnection -ComputerName 203.0.113.10 -Port 443

Frequently asked questions

The rule exists but the port is unreachable from outside — why? Either no service is listening on the port, or the provider’s external firewall (the security group in the VPS panel) blocks it. Check Get-NetTCPConnection and the network rules in the control panel.

netsh or New-NetFirewallRule — which should I use? On current Windows Server versions use PowerShell (New-NetFirewallRule) — it is more flexible. Keep netsh for compatibility with older systems.

What are the Domain, Private and Public profiles? They are rule sets for different network types. A public-facing server runs the Public profile, so make sure your rule covers it.

How do I open access for a program instead of a port? Create a program-based rule: New-NetFirewallRule -Program "C:\app\srv.exe" -Direction Inbound -Action Allow.

Do I need to restart the firewall after changes? No, rules take effect immediately after they are created.

Need a Windows server with full control over the firewall? Deploy a Windows VPS in the VPS hosting section or order server administration.