Manage Windows Defender Firewall on Windows Server with PowerShell

Every Windows Server and Windows VPS ships with Windows Defender Firewall. It decides which inbound ports are reachable, including Remote Desktop on port 3389. Managing it well keeps RDP away from password-guessing bots while letting your applications work.

Before you start

• An administrator account on the server. See connect with RDP.
• Your current public IP from the IP checker.
• Open PowerShell as Administrator for the commands below.

Check profiles and status

Windows has three profiles: Domain, Private and Public. A VPS network is usually Public.

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

All profiles should be Enabled: True with inbound set to Block. The GUI is at Server Manager → Tools → Windows Defender Firewall with Advanced Security.

Allow a port

Open TCP 8080 for a web app:

New-NetFirewallRule -DisplayName "App 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow -Profile Any

To allow a program rather than a port, use -Program "C:\Apps\app.exe"; see block or allow applications.

Limit RDP to your IP

1. Restrict the built-in RDP rules to your address (comma-separate several IPs):
   Copy

   Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.10

2. Connect from a new RDP window before closing the current one.

Changing the RDP port is covered step by step in change the RDP port safely; always create the firewall rule for the new port before changing the port in the registry.

List, disable and remove rules

• List enabled inbound allow rules:
  Copy

  Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Select-Object DisplayName, Profile

• See the port behind a rule:
  Copy

  Get-NetFirewallRule -DisplayName "App 8080" | Get-NetFirewallPortFilter

• Disable without deleting: Disable-NetFirewallRule -DisplayName "App 8080"
• Delete: Remove-NetFirewallRule -DisplayName "App 8080"

Log dropped connections

Set-NetFirewallProfile -Profile Public -LogBlocked True -LogFileName "%systemroot%\system32\LogFiles\Firewall\pfirewall.log"

The log shows which IPs and ports are being dropped, useful when an app does not connect.

Troubleshooting

• Port allowed but unreachable: confirm the app listens with netstat -ano | findstr :8080 and check your provider firewall. See check that RDP is listening.
• Many failed RDP logins: add an account lockout policy; see account lockout policy.

Next steps

• Secure RDP on Windows Server
• Restore RDP port 3389
• What is a firewall?