Windows Defender Firewall controls which network connections are allowed to and from your server. Properly configuring it is one of the most important steps in securing a new Windows VPS.
Prerequisites
- Windows Server VPS with Administrator access
Checking Firewall Status
Get-NetFirewallProfile | Select Name, EnabledViewing Existing Rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq "True"} | Select DisplayName, Direction, ActionAllowing a Specific Port (e.g. a Web Application on 8080)
New-NetFirewallRule -DisplayName "Allow App Port 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action AllowAllowing HTTP and HTTPS (for IIS)
New-NetFirewallRule -DisplayName "Allow HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action AllowRestricting a Rule to Specific Source IPs
New-NetFirewallRule -DisplayName "Restrict RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.10 -Action AllowBlocking a Port
New-NetFirewallRule -DisplayName "Block Port 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action BlockBlocking SMB (port 445) from the public internet is strongly recommended unless you specifically require external file sharing access.
Removing a Rule
Remove-NetFirewallRule -DisplayName "Allow App Port 8080"Using the GUI Instead
- Open Windows Defender Firewall with Advanced Security
- Select Inbound Rules → New Rule
- Choose Port, specify TCP/UDP and the port number
- Choose Allow the connection
- Apply to all profiles or specific ones (Domain, Private, Public)
- Give it a descriptive name and finish
Recommended Baseline Configuration for a New VPS
| Port | Service | Recommendation |
|---|---|---|
| 3389 (or custom) | RDP | Allow, restricted to trusted IPs |
| 80 / 443 | HTTP/HTTPS | Allow if hosting a website |
| 445 | SMB | Block from public internet |
| 1433 | SQL Server | Block from public internet, restrict to app servers only |
Common Errors
Rule added but connection still blocked — confirm the rule applies to the correct firewall profile (Public profile is typically active on a VPS, not Private/Domain).
Locked out of RDP after a firewall change — use your VPS provider's console access to review and correct firewall rules via PowerShell.
Best Practices
- Deny by default, allow explicitly only what's needed
- Restrict administrative ports (RDP, SQL Server) to specific trusted IPs
- Review firewall rules after installing any new service
FAQ
Is Windows Firewall enough on its own?
It's an essential layer, but should be combined with NLA for RDP, strong passwords, and regular updates — not relied on as the sole security measure.
Related Articles
- How to Secure RDP on a Windows VPS
- How to Install IIS on a Windows VPS
- Windows Server Security Checklist for a New VPS
