How to Open a Port in Windows Firewall and Check It Is Open

Updated: 10 October 2026 · Applies to: Windows Defender Firewall on Windows Server 2016 to 2025 and Windows 10 and 11 (steps and commands from Microsoft’s documentation); port checks from Linux tested on Ubuntu 26.04

To open a port in Windows, add an inbound firewall rule. In PowerShell (run as administrator): New-NetFirewallRule -DisplayName "Allow TCP 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow. Then check from another computer with Test-NetConnection -ComputerName SERVER -Port 8080: TcpTestSucceeded : True means the port is open. Turning the whole firewall off is almost never the right fix.

What has to be true for a port to be open

A program listens on the port. A firewall rule alone does not open anything: if no service is running on port 8080, connections fail even with the rule in place.
Windows Defender Firewall allows it. According to Microsoft, the firewall drops incoming traffic that no rule allows.
Nothing in between blocks it. A PC behind a home or office router also needs port forwarding on the router (explained in opening port 25565 and port forwarding), and some networks and cloud platforms have their own firewall in front of the server.

Open a port with PowerShell

Start PowerShell with Run as administrator. These commands follow Microsoft’s documentation for New-NetFirewallRule:

New-NetFirewallRule -DisplayName "Web HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
New-NetFirewallRule -DisplayName "Game UDP 27015" -Direction Inbound -Protocol UDP -LocalPort 27015 -Action Allow
New-NetFirewallRule -DisplayName "App ports" -Direction Inbound -Protocol TCP -LocalPort 8080,5000-5020 -Action Allow

-Protocol must be TCP or UDP when you give a port number. A service that needs both gets two rules.
-LocalPort takes one port, a list or a range.
-Profile defaults to Any (Domain, Private and Public). Leave it like that on a server unless you have a reason to limit it.

For management ports, databases and Remote Desktop, allow only the addresses that need access:

New-NetFirewallRule -DisplayName "SQL Server from office" -Direction Inbound -Protocol TCP -LocalPort 1433 -RemoteAddress 203.0.113.5 -Action Allow
Set-NetFirewallRule -DisplayName "SQL Server from office" -RemoteAddress 203.0.113.5,198.51.100.0/24

A rule takes effect at once; no restart is needed.

Open a port in Command Prompt (netsh)

In an administrator Command Prompt, Microsoft’s equivalent is:

netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

Use protocol=UDP for a UDP port. The older netsh firewall commands are outdated; Microsoft recommends the netsh advfirewall form.

Open a port in the Windows Firewall window

According to Microsoft, the steps are:

Open Windows Defender Firewall with Advanced Security: search for it in the Start menu or run wf.msc. On Windows 10 and 11 you can also go to Windows Security › Firewall & network protection › Advanced settings.
Select Inbound Rules, then New Rule... in the Actions pane.
Choose Port and select Next.
Choose TCP or UDP, enter the number under Specific local ports (for example 8080 or 5000-5020) and select Next.
Choose Allow the connection and select Next.
Tick the network profiles (Domain, Private, Public) the rule applies to and select Next.
Give the rule a clear name and select Finish.

The Port type keeps the wizard short. To allow only certain IP addresses, choose Custom instead: Microsoft notes that it shows every wizard page, including Scope, where you enter the remote addresses. You can also change an existing rule later from its Properties.

Allow an app instead of a port: in Windows Security › Firewall & network protection › Allow an app through firewall › Change settings › Allow another app. Microsoft points out that a port stays open until you close it, while an allowed app opens the ports it needs only when it runs.

Check which ports are open (listening) on Windows

Run these on the Windows machine itself to see whether a program is listening:

netstat -ano | findstr :443
Get-NetTCPConnection -State Listen -LocalPort 443
Get-NetUDPEndpoint -LocalPort 27015

netstat -ano lists all connections and listening ports with numbers only and the process ID (PID). A line with LISTENING means a program waits on that port.
Get-NetTCPConnection -State Listen without -LocalPort lists every listening TCP port; the OwningProcess column is the PID.
Find the program behind a PID with Get-Process -Id PID, or netstat -anob in an administrator prompt, which also shows the executable name.

To see the firewall rules that cover a port, query the port filter as Microsoft’s examples do:

Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -eq 8080 } | Get-NetFirewallRule
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Check if a port is open from another computer

A listening port is only reachable if the firewall and the network let traffic through, so test from a different computer, ideally outside your network. The same goes for checking whether a port on your own IP address is reachable from the internet: a test from the machine itself does not cross the network path that visitors use.

From Windows (PowerShell):

Test-NetConnection -ComputerName 203.0.113.10 -Port 3389
Test-NetConnection -ComputerName 203.0.113.10 -Port 443 -InformationLevel Quiet

The first form ends with TcpTestSucceeded : True or False; with -InformationLevel Quiet you get only True or False. According to Microsoft, -Port tests TCP; there is no UDP test in this cmdlet.

From Linux or macOS with netcat. We ran these on Ubuntu 26.04 (netcat-openbsd 1.234); the addresses in the output are replaced with documentation addresses. -z only tests the connection, -v prints the result and -w 3 gives up after 3 seconds:

nc -zv -w 3 example.com 443
Connection to example.com (203.0.113.10) 443 port [tcp/https] succeeded!

nc -zv -w 3 198.51.100.20 3389
nc: connect to 198.51.100.20 port 3389 (tcp) failed: Connection refused

nc -zv -w 3 192.0.2.10 3389
nc: connect to 192.0.2.10 port 3389 (tcp) timed out: Operation now in progress

succeeded: the port is open.
Connection refused: the computer answered but nothing listens on that port (or a rule rejects it). Start the service or check its port.
timed out: no answer at all. A firewall is dropping the traffic, which is what Windows Defender Firewall does without an allow rule, or the address is wrong.

UDP ports cannot be checked reliably this way: UDP has no connection handshake, so an open port often sends no reply, which looks the same as a firewall dropping the packet. Test UDP services with their own client (for example a game client). More netcat examples: test port connectivity with nc.

Close the port again

Disable-NetFirewallRule -DisplayName "Web HTTPS"   # keep it, but inactive
Remove-NetFirewallRule -DisplayName "Web HTTPS"    # delete it
Remove-NetFirewallRule -DisplayName "Web*" -WhatIf # preview what a wildcard would delete
netsh advfirewall firewall delete rule name="Open Port 80"

Turning the firewall off (only for a short test)

Microsoft recommends not disabling Windows Firewall. If you must, for a short test, disable the profiles, not the service:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False   # off
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True    # back on

The Command Prompt form is netsh advfirewall set allprofiles state off (and state on). According to Microsoft, stopping the Windows Defender Firewall service (MpsSvc) is not supported and can break the Start menu, app installs and other features. If the port works with the firewall off but not with it on, your allow rule does not match (check the protocol, port and profile) or another rule blocks the port; fix that and turn the firewall back on. On an internet-facing server a disabled firewall exposes every listening service, including RPC on port 135 and file sharing on port 445.

Do not lock yourself out

Before tightening rules on a remote server, make sure the Remote Desktop rule stays enabled for your IP address (Enable-NetFirewallRule -DisplayGroup "Remote Desktop"), and keep console access from your VPS panel ready (VPS console through VNC). On a Windows VPS the Windows Firewall is yours to manage like on any other Windows Server.

Official documentation: Microsoft: manage Windows Firewall with the command line, New-NetFirewallRule and Test-NetConnection.

Ucartz services for this topic

Hire an expert: engineers per 15 minutes, per hour or per month, with no contract.
Server management: on-demand administration, hardening, migrations and monitoring.