To enable ICMP on Windows Server 2012 R2 and 2016, turn on an inbound ICMPv4 echo-request rule in Windows Firewall. The server will then answer IPv4 ping requests without opening a TCP or UDP port, and the change usually takes about five minutes.
Prerequisites
- A VPS running Windows Server 2012 R2 or Windows Server 2016.
- An active RDP session or console connection, plus a local administrator account that can open an elevated PowerShell window.
- The server’s public IPv4 address and a separate computer from which you can run the ping test.
- Decide whether every source may ping the server or whether only a monitoring subnet such as
MONITORING_CIDRshould be allowed. No domain or application is required. - If you need a Windows environment for this task, use VPSLake Windows RDP hosting.
Step 1: Check the active network profile and existing rule
Windows applies firewall rules by network profile, so identify the connected profile and inspect the built-in echo-request rule before changing it.
Open Windows PowerShell as an administrator and run:
Get-NetConnectionProfile | Format-Table InterfaceAlias,NetworkCategory,IPv4Connectivity
Get-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -ErrorAction SilentlyContinue | Format-List DisplayName,Enabled,Profile,Direction,ActionThe first command normally reports Public on an internet-facing VPS. The second command may show the rule as disabled; if it returns nothing, use the custom-rule fallback in Step 3.
Example profile output:
InterfaceAlias NetworkCategory IPv4Connectivity
-------------- --------------- ----------------
Ethernet Public InternetDo not disable Windows Firewall to make ping work. The firewall should remain enabled so that unrelated inbound traffic stays blocked.
Step 2: Enable the built-in ICMPv4 echo rule
The built-in rule targets only ICMPv4 echo requests, so it enables ping without enabling the rest of the file-and-printer-sharing group.
In the same elevated PowerShell window, run:
Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"
Get-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" | Select-Object DisplayName,Enabled,Direction,Action,ProfileThe first command may produce no output. The follow-up check should show an enabled inbound allow rule:
DisplayName Enabled Direction Action Profile
----------- ------- --------- ------ -------
File and Printer Sharing (Echo Request - ICMPv4-In) True Inbound Allow AnyAny means the rule is available across profiles. If your output shows a narrower profile, it must include the active category from Step 1. Microsoft documents the cmdlet in the Enable-NetFirewallRule reference.
If the built-in rule is absent, do not enable the complete File and Printer Sharing group because that can expose SMB-related rules. Use the custom rule procedure in the next step instead.
Step 3: Enable ICMP through the firewall console
The graphical console lets you review the source scope and network profiles before allowing echo requests.
Open Server Manager → Tools → Windows Firewall with Advanced Security. Alternatively, press Windows key + R, enter wf.msc, and select OK.
- Select Inbound Rules.
- Find File and Printer Sharing (Echo Request – ICMPv4-In), right-click it, and choose Enable Rule.
- Right-click the rule, select Properties, and open the Scope tab if ping should be accepted only from a monitoring host or subnet. Add that source under Remote IP address instead of leaving it at Any IP address.
- Open the Advanced tab and confirm the rule applies to the active profile from Step 1. Select OK.
If the named rule does not exist, create a narrow replacement:
- In Inbound Rules, select Action → New Rule.
- Choose Custom, then Next. Keep All programs selected.
- On Protocol and Ports, set Protocol type to ICMPv4, select Customize, choose Specific ICMP types, select Echo Request, and select OK.
- On Scope, leave remote addresses at Any IP address for general ping monitoring, or enter
MONITORING_CIDRfor a restricted source range. - Select Allow the connection, choose only the required profile, and name the rule
Allow ICMPv4 Echo Requests.
Microsoft’s Windows Firewall rule guide describes the same custom-rule fields. ICMPv6 is separate; enabling this IPv4 rule will not make an IPv6 ping succeed.
Verify the ICMP response
Verify the rule on the server, then test from a different computer. Testing from the server itself can succeed even when an upstream firewall blocks public traffic.
On the server, confirm the rule is enabled:
Get-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" | Format-List DisplayName,Enabled,Direction,Action,ProfileFrom a separate Windows computer, replace SERVER_IP with the VPS’s public IPv4 address:
ping.exe -4 -n 4 SERVER_IPSuccessful output contains four replies, similar to this:
Reply from SERVER_IP: bytes=32 time=25ms TTL=123
Reply from SERVER_IP: bytes=32 time=24ms TTL=123
Reply from SERVER_IP: bytes=32 time=25ms TTL=123
Reply from SERVER_IP: bytes=32 time=24ms TTL=123The exact latency and TTL vary. The important result is that the replies arrive and the summary reports Lost = 0 (0% loss). If you need IPv6 monitoring, create and scope a separate ICMPv6 echo-request rule.
Troubleshooting
Request timed out
The rule may still be disabled, may not match the active profile, or an upstream VPS firewall may drop ICMP before it reaches Windows. Recheck Step 1 and Step 2, then inspect any provider-level firewall or security-group setting in addition to Windows Firewall.
Enable-NetFirewallRule returns no matching rule
The rule may have been removed, or a non-English installation may use a localized display name. Search for related rules without assuming the English name:
Get-NetFirewallRule | Where-Object { $_.DisplayName -like "*Echo Request*" -and $_.DisplayName -like "*ICMPv4*" } | Format-Table DisplayName,Enabled,Profile,Direction,ActionIf the search is empty, create the custom ICMPv4 rule in Step 3. On Windows Server 2012 R2 and 2016, you can also use this elevated fallback when you need a command-line rule:
netsh advfirewall firewall add rule name="Allow ICMPv4 Echo Requests" protocol=icmpv4:8,any dir=in action=allow profile=anyPing works on one profile but not another
The custom rule is probably limited to the wrong network category. Run Get-NetConnectionProfile, then edit the rule under Inbound Rules → rule Properties → Advanced → Profiles and select the category actually shown for the connected adapter.
The rule keeps becoming disabled
A domain Group Policy can replace local firewall settings after policy refresh. Run gpresult /r to see applied policy, and ask the domain administrator to enable the equivalent ICMPv4 inbound rule in Computer Configuration → Policies → Windows Settings → Security Settings → Windows Defender Firewall with Advanced Security.
Hardening
- Limit Remote IP address to known monitoring systems when public ping is unnecessary.
- Allow only ICMPv4 echo requests; do not enable the entire file-and-printer-sharing group just to support ping.
- Keep Windows Firewall enabled on every profile and check the provider-level firewall separately.
- Treat ping as an availability check, not proof that RDP, HTTP, or another application is reachable.
FAQ
Does enabling ICMP open a port?
No. ICMP is a network-layer protocol and does not use TCP or UDP ports. The rule allows echo-request packets and their replies, while your TCP and UDP firewall policy remains unchanged.
Why does IPv4 ping work but IPv6 ping fail?
The ICMPv4 and ICMPv6 rule families are separate. Create a second inbound custom rule using Protocol type → ICMPv6 and Specific ICMP types → Echo Request, then confirm that the VPS has working IPv6 connectivity.
Is it safe to allow ping from the whole internet?
It is usually less exposure than opening an application port, but it reveals that the address is reachable and can contribute to scan or flood traffic. For private monitoring, restrict the rule to the monitoring hosts or subnet; for public uptime checks, keep the scope broad only when that visibility is required.
Will this make RDP or a website reachable?
No. A successful ping proves only that an ICMP echo reply can return. RDP, HTTP, and other services still need a running listener, their own inbound firewall rules, and any required provider-level network access.
