--- title: "Open a port in Windows Firewall" description: "Open an incoming TCP port in Windows Firewall on a Windows node, and block an outgoing port, with a firewall rule for each." content_type: "how-to" product: "node" platform: "MyAccount" url: "/myaccount/node/how-to/open-a-port-in-windows-firewall/" topic: ["access-and-security"] --- # Open a port in Windows Firewall Open an incoming TCP port in Windows Firewall on a Windows node, and, if you need it, block an outgoing one. Windows Firewall checks the traffic coming in to the node and going out of it, and blocks what no rule allows. On a public network, it blocks every connection attempt that the node did not ask for. To let a program or a service accept connections, you add a rule that allows its port. Windows Firewall works alongside the node's security group: a connection gets through only when both let it. E2E recommends relying on security groups alone, as the two sets of rules can conflict. To check whether a conflict is the cause of a problem, use **Allow All Traffic** on the node's **Security Group** tab while you look. **Allow All Traffic** attaches a security group that opens every port. Detach it as soon as you have found the conflict. See [Security Group](/myaccount/security-group/). Firewall is a different product: an appliance your traffic passes through, not rules inside one node. See [Firewall](/myaccount/firewall/). ## Before you begin You need: - A Windows node, and you are signed in to it over Remote Desktop as an administrator. See [Connect to a Windows node](/myaccount/node/how-to/connect-to-a-windows-node/). - The port number you want to open or block, and whether it uses TCP or UDP. ## Open Windows Defender Firewall with Advanced Security The rules live in **Windows Defender Firewall with Advanced Security**. On older Windows versions it is called **Windows Firewall with Advanced Security**. Open it in either of these ways: - Press Win+R, type `WF.msc`, and press Enter. - In **Control Panel**, switch to large icons, click **Windows Defender Firewall**, and then click **Advanced settings** on the left. The window has many settings. Change only the settings these steps name. A wrong setting can cut off connections to the node, including your own Remote Desktop session. ## Open an incoming port 1. In the left pane, right-click **Inbound Rules** and choose **New Rule...**. The new rule wizard opens on **Rule Type**. On each of its pages, make the choice the next step gives, then click **Next** to go on. 2. On **Rule Type**, choose **Port**. 3. On **Protocol and Ports**, choose **TCP** and **Specific local ports**, and type the port you are opening, such as `3306`. The field also takes a list or a range, such as `80, 443, 5000-5010`. 4. On **Action**, choose **Allow the connection**. 5. On **Profile**, choose when the rule applies. Windows turns on all three by default: - **Domain** applies when the computer joins its corporate domain. - **Private** applies on a private network location, such as a home or work place. - **Public** applies on a public network location. Each profile matches a kind of network: a laptop, for example, is on a private network at home, the company domain at work, and a public network at a cafe. A node in E2E's cloud stays on one network, so leave all three turned on unless you know the rule should apply on only one kind. 6. On **Name**, type a name for the rule, such as `Mysql`, and, under **Description (optional)**, a note on why you made it. Click **Finish** to create the rule. The rule appears in the **Inbound Rules** list, and the port accepts connections. ## Block an outgoing port 1. In the left pane, select **Outbound Rules**, then click **New Rule...** in the right pane. The **New Outbound Rule Wizard** opens on **Rule Type**. On each of its pages, make the choice in the step below, then click **Next** to go on. 2. On **Rule Type**, choose **Port**. 3. On **Protocol and Ports**, choose **TCP** or **UDP**, the protocol to block, and **Specific remote ports**, and type the port, such as `5000`. An outbound rule names the port on the other end, the one the node connects out to. 4. On **Action**, choose **Block the connection**. 5. On **Profile**, choose when the rule applies: **Domain**, **Private**, and **Public**, all turned on by default. To apply it on only one kind of network, turn on only that one. If you are not sure, leave all three turned on. 6. On **Name**, type a name that makes the rule easy to find later, such as `Block suspicious ports`. Windows creates many rules with long names of its own, so a clear name helps yours stand out. Under **Description (optional)**, add a note on why you made it. Click **Finish**. ## Check the rules Your rule is listed under **Inbound Rules** or **Outbound Rules**. To change it later, double-click it. For example, you can choose the users the rule applies to, or block only one protocol, such as TCP. To check an incoming rule, connect to the port from another computer. The connection succeeds when both Windows Firewall and the node's security group allow the port. The node now accepts connections on the port you opened and blocks the outgoing port you chose. Next, allow the same incoming port in the node's security group; see [Security Group](/myaccount/security-group/). For help with a port that does not answer, see [Troubleshooting node networking and connectivity](/myaccount/node/troubleshooting/networking-and-connectivity/).