Skip to main content
To open a port in Windows Firewall, run PowerShell as Administrator and create an inbound allow rule, for example New-NetFirewallRule -DisplayName "Web TCP 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow. Use -Protocol UDP for UDP ports. The rule takes effect at once, without a restart, on Windows Server 2019, 2022 and 2025 and on Windows 10 and 11.

​
Before you start

  • Sign in as an administrator over Remote Desktop and open PowerShell as Administrator (right-click Start > Terminal (Admin)).
  • Know the port number and whether the program uses TCP, UDP or both. The program’s documentation says which.
  • A firewall decides which network connections reach your server. Windows Firewall blocks unrequested inbound connections by default, so each service that should be reachable from the internet needs an inbound allow rule.

​
How to open a port with PowerShell

1

Create the rule

For a single TCP port:
For a UDP port, or several ports and a range in one rule:
2

Open both TCP and UDP if needed

One rule can only have one protocol. If a program needs the same port on TCP and UDP, create two rules.
3

Confirm the rule exists

Enabled should be True and Action Allow.
Without -Profile, the rule applies to all network profiles (Domain, Private and Public). That is usually right for a server on the internet, because its network is normally classed as Public.

​
Allow a port only from certain IP addresses

Ports for admin tools, databases or remote access should not be open to everyone. Add -RemoteAddress:
-RemoteAddress takes single addresses (203.0.113.25), CIDR ranges (198.51.100.0/24), ranges (198.51.100.10-198.51.100.20) and IPv6 (2001:db8::/64).
Don’t open database ports (1433, 3306, 5432) or management ports to Any. Limit them to your own IP addresses, or connect through a VPN.

​
How to open a port with netsh

Add remoteip=198.51.100.0/24 to limit the source addresses. Windows prints Ok. on success.

​
How to open a port in the Windows Firewall console (GUI)

1

Open the console

Press Win+R, type wf.msc and press Enter to open Windows Defender Firewall with Advanced Security (Windows Firewall with Advanced Security in newer releases).
2

Start a new inbound rule

Click Inbound Rules, then Action > New Rule.
3

Choose the port

Choose Port as the rule type (or Custom for more options) and click Next. Select TCP or UDP, choose Specific local ports, enter 8080 (or 80, 443, or 27015-27016) and click Next.
4

Allow and name it

Select Allow the connection, keep all profiles ticked, give the rule a clear name and click Finish.
To limit the source IPs later, open the rule’s Properties > Scope tab and add addresses under Remote IP address.

​
How to check it worked

First check that a program is actually listening on the port:
No output means nothing is listening: start the program first, because an open firewall port with nothing behind it still refuses connections. Then test from another computer (TCP only):
UDP can’t be tested this way; test with the program itself (for example, join the game server). More ways to test are in check if a port is open from outside.

​
How to close the port again

Or keep the rule but turn it off with Disable-NetFirewallRule -DisplayName "Web TCP 8080". With netsh: netsh advfirewall firewall delete rule name="Web TCP 8080".

​
Frequently asked questions

​
Do I need to restart Windows after adding a rule?

No. Firewall rules apply as soon as they are created. Restart only the program if it was started while the port was blocked and gave up.

​
The rule exists but the port is still closed. Why?

Check that the program listens on the port (Get-NetTCPConnection), that it listens on all addresses rather than only 127.0.0.1, that no Block rule matches the port (Get-NetFirewallRule -Action Block), and that any DDoS filter in front of the server allows the port.

​
Should I turn the firewall off to test?

No. A server with the firewall off exposes every listening service. Add a specific allow rule instead and remove it when you are done.

​
How do I see all the ports I have opened?

Get-NetFirewallRule -Enabled True -Direction Inbound -Action Allow | Format-Table DisplayName lists every enabled inbound allow rule, including the built-in ones.

​
Which port does Remote Desktop use?

TCP 3389 by default. To change it, see change the RDP port.

VPS and dedicated server guides

Every guide in this section.

Check if a port is open

Test from outside the server.

Allow ping (ICMP)

Let the server answer ping.

Protect RDP from brute force

Limit Remote Desktop by IP.

Run a game server on Windows

SteamCMD and firewall rules.
Checked against Microsoft Learn: New-NetFirewallRule, netsh advfirewall, Get-NetTCPConnection and Test-NetConnection on 4 November 2026. Steps were not tested on a live Windows server for this page; menu names can differ slightly between Windows versions.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026