Open a port in Windows Firewall

View as Markdown

Open an incoming TCP port in Windows Firewall on a Windows node, and, if you need it, block an outgoing one. Windows Firewall checks the traffic coming in to the node and going out of it, and blocks what no rule allows. On a public network, it blocks every connection attempt that the node did not ask for. To let a program or a service accept connections, you add a rule that allows its port.

Windows Firewall works alongside the node’s security group: a connection gets through only when both let it. E2E recommends relying on security groups alone, as the two sets of rules can conflict. To check whether a conflict is the cause of a problem, use Allow All Traffic on the node’s Security Group tab while you look. Allow All Traffic attaches a security group that opens every port. Detach it as soon as you have found the conflict. See Security Group.

Firewall is a different product: an appliance your traffic passes through, not rules inside one node. See Firewall.

Before you begin

You need:

A Windows node, and you are signed in to it over Remote Desktop as an administrator. See Connect to a Windows node.
The port number you want to open or block, and whether it uses TCP or UDP.

Open Windows Defender Firewall with Advanced Security

The rules live in Windows Defender Firewall with Advanced Security. On older Windows versions it is called Windows Firewall with Advanced Security. Open it in either of these ways:

Press Win+R, type WF.msc, and press Enter.
In Control Panel, switch to large icons, click Windows Defender Firewall, and then click Advanced settings on the left.

The window has many settings. Change only the settings these steps name. A wrong setting can cut off connections to the node, including your own Remote Desktop session.

Open an incoming port

In the left pane, right-click Inbound Rules and choose New Rule…. The new rule wizard opens on Rule Type. On each of its pages, make the choice the next step gives, then click Next to go on.
On Rule Type, choose Port.
On Protocol and Ports, choose TCP and Specific local ports, and type the port you are opening, such as 3306. The field also takes a list or a range, such as 80, 443, 5000-5010.
On Action, choose Allow the connection.
On Profile, choose when the rule applies. Windows turns on all three by default:
- Domain applies when the computer joins its corporate domain.
- Private applies on a private network location, such as a home or work place.
- Public applies on a public network location.
Each profile matches a kind of network: a laptop, for example, is on a private network at home, the company domain at work, and a public network at a cafe. A node in E2E’s cloud stays on one network, so leave all three turned on unless you know the rule should apply on only one kind.
On Name, type a name for the rule, such as Mysql, and, under Description (optional), a note on why you made it. Click Finish to create the rule.

The rule appears in the Inbound Rules list, and the port accepts connections.

Block an outgoing port

In the left pane, select Outbound Rules, then click New Rule… in the right pane. The New Outbound Rule Wizard opens on Rule Type. On each of its pages, make the choice in the step below, then click Next to go on.
On Rule Type, choose Port.
On Protocol and Ports, choose TCP or UDP, the protocol to block, and Specific remote ports, and type the port, such as 5000. An outbound rule names the port on the other end, the one the node connects out to.
On Action, choose Block the connection.
On Profile, choose when the rule applies: Domain, Private, and Public, all turned on by default. To apply it on only one kind of network, turn on only that one. If you are not sure, leave all three turned on.
On Name, type a name that makes the rule easy to find later, such as Block suspicious ports. Windows creates many rules with long names of its own, so a clear name helps yours stand out. Under Description (optional), add a note on why you made it. Click Finish.

Check the rules

Your rule is listed under Inbound Rules or Outbound Rules. To change it later, double-click it. For example, you can choose the users the rule applies to, or block only one protocol, such as TCP.

To check an incoming rule, connect to the port from another computer. The connection succeeds when both Windows Firewall and the node’s security group allow the port.

The node now accepts connections on the port you opened and blocks the outgoing port you chose. Next, allow the same incoming port in the node’s security group; see Security Group. For help with a port that does not answer, see Troubleshooting node networking and connectivity.