Windows Server·4 min lezen

Windows Firewall: Port and Rule Management

Configure Windows Firewall on Windows Server via PowerShell and GUI. Open ports, block connections and manage rules.

Windows Server includes Windows Defender Firewall built-in. It's active by default and blocks all inbound connections not explicitly allowed.

Essential PowerShell Commands

Firewall Status

powershell

# View status of profiles (Domain, Private, Public)
Get-NetFirewallProfile | Select Name, Enabled, DefaultInboundAction

# Typical output:
# Name     Enabled DefaultInboundAction
# ----     ------- --------------------
# Domain   True    Block
# Private  True    Block
# Public   True    Block

Open a Port

powershell

# Single TCP port (es. web server)
New-NetFirewallRule -DisplayName "HTTP 80" `
  -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow

# UDP port (es. game server)
New-NetFirewallRule -DisplayName "Rust Server" `
  -Direction Inbound -Protocol UDP -LocalPort 28015 -Action Allow

# Port range
New-NetFirewallRule -DisplayName "Game Ports" `
  -Direction Inbound -Protocol TCP -LocalPort 27015-27020 -Action Allow

# Both TCP and UDP
New-NetFirewallRule -DisplayName "DNS" `
  -Direction Inbound -Protocol TCP -LocalPort 53 -Action Allow
New-NetFirewallRule -DisplayName "DNS UDP" `
  -Direction Inbound -Protocol UDP -LocalPort 53 -Action Allow

Common Ports to Open

powershell

# RDP (already open by default on Windows Server)
New-NetFirewallRule -DisplayName "RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow

# HTTP / HTTPS
New-NetFirewallRule -DisplayName "HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
New-NetFirewallRule -DisplayName "HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

# SQL Server
New-NetFirewallRule -DisplayName "SQL Server" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Allow

# FTP
New-NetFirewallRule -DisplayName "FTP" -Direction Inbound -Protocol TCP -LocalPort 21 -Action Allow
New-NetFirewallRule -DisplayName "FTP Passive" -Direction Inbound -Protocol TCP -LocalPort 49152-65535 -Action Allow

Manage Existing Rules

powershell

# List all active inbound rules
Get-NetFirewallRule -Direction Inbound -Enabled True | Select DisplayName, LocalPort, Protocol, Action

# Search rule by name
Get-NetFirewallRule -DisplayName "*HTTP*"

# Disable rule (without deleting)
Disable-NetFirewallRule -DisplayName "HTTP 80"

# Enable rule
Enable-NetFirewallRule -DisplayName "HTTP 80"

# Delete rule
Remove-NetFirewallRule -DisplayName "HTTP 80"

Limit Access by IP (Whitelist)

powershell

# Allow RDP only from your IP
New-NetFirewallRule -DisplayName "RDP office only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 3389 `
  -RemoteAddress "1.2.3.4" `
  -Action Allow

# Block everything else on RDP
New-NetFirewallRule -DisplayName "Block RDP others" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 3389 `
  -Action Block

# Multiple IPs or subnets:
-RemoteAddress "1.2.3.4","192.168.1.0/24","10.0.0.0/8"

Unlike iptables, Windows Firewall evaluates Block rules first, then Allow rules. A Block rule always takes precedence over Allow for same port/IP.

Block a Suspicious IP

powershell

# Block inbound connections from specific IP
New-NetFirewallRule -DisplayName "Block Suspicious IP" `
  -Direction Inbound `
  -RemoteAddress "1.2.3.4" `
  -Action Block

# Also block outbound to that IP
New-NetFirewallRule -DisplayName "Block Outbound Suspicious IP" `
  -Direction Outbound `
  -RemoteAddress "1.2.3.4" `
  -Action Block

Disable Firewall (test only)

powershell

# Disable all profiles: DON'T use in production
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

# Re-enable
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

Disabling firewall on an internet-exposed server is dangerous. Do it only temporarily for diagnostics and re-enable immediately after.

GUI: Windows Defender Firewall with Advanced Security

Open with Win+R → wf.msc

Structure:

To create manual rule: right-click Inbound Rules → New Rule → Port → specify port → Allow.

Inbound Rules: incoming connections
Outbound Rules: outgoing connections
Connection Security Rules: IPsec

Export and Import Rules

powershell

# Export all rules to XML file
netsh advfirewall export "C:\firewall-backup.wfw"

# Import (overwrites all rules!)
netsh advfirewall import "C:\firewall-backup.wfw"

Firewall Logs

powershell

# Enable logging for blocked connections
Set-NetFirewallProfile -Profile Public -LogBlocked True -LogFileName "C:\Windows\System32\LogFiles\Firewall\pfirewall.log"

# View log
Get-Content "C:\Windows\System32\LogFiles\Firewall\pfirewall.log" -Tail 30

The log shows source IP, destination, port and action (DROP/ALLOW) for each packet.

Windows VPS: Performance Tweaks

Optimizations and tweaks to improve Windows Server VPS performance

4 min lezen

Windows Server

Change Language to English on Windows Server

How to set English as primary language on Windows Server VPS

2 min lezen

Windows Server

RDP: Access, Port, Multi-User and Issues

Complete guide to Remote Desktop on Windows Server - connection, port change, multiple simultaneous users and troubleshooting

4 min lezen

Terug naar Documentatie

DeluxHost, opgericht in 2023, biedt hoogwaardige hostingoplossingen voor diverse digitale behoeften. Wij bieden gedeelde hosting, VPS en dedicated servers met geavanceerde beveiliging en wereldwijde datacenters.

Alle systemen operationeel

Animaties inschakelen