Enable ICMP Ping Response on Windows Server 2012 R2–2022

To enable ICMP ping response for Windows Server, allow inbound echo-request traffic in Windows Defender Firewall. This guide covers Windows Server 2012 R2, 2016, 2019, and 2022, and takes about five minutes when you have administrator access.

You will allow only ping traffic, not a TCP or UDP port. Afterward, a separate computer can check whether the server is reachable with an IPv4 or IPv6 echo request.

Prerequisites

• A VPS running Windows Server 2012 R2, 2016, 2019, or 2022 with Windows Defender Firewall enabled.
• An RDP session, VNC console, or other local access, plus a local administrator account that can open an elevated PowerShell window.
• The server’s public IP address and another computer or monitoring host from which to send the ping.
• The firewall rule’s intended source scope: Any for public monitoring, or a specific monitoring address or CIDR range such as 203.0.113.0/24.
• No domain, application, extra disk space, or additional Windows role is required. For a Windows environment with administrator access, see VPSLake Windows RDP hosting.

Step 1: Check the network profile and existing rule

Windows evaluates firewall rules against network profiles, so inspect the active profile and the built-in echo rule before changing anything.

Open Windows PowerShell, select Run as administrator, and run:

Get-NetConnectionProfile | Format-Table InterfaceAlias,Name,NetworkCategory,IPv4Connectivity,IPv6Connectivity
Get-NetFirewallProfile | Format-Table Name,Enabled,DefaultInboundAction,DefaultOutboundAction
Get-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -ErrorAction SilentlyContinue | Format-Table DisplayName,Enabled,Profile,Direction,Action

An internet-facing VPS commonly reports Public, but use the value returned by your server. The firewall should remain enabled and its inbound default should normally be Block:

InterfaceAlias NetworkCategory IPv4Connectivity
-------------- --------------- ----------------
Ethernet       Public          Internet

Name    Enabled DefaultInboundAction DefaultOutboundAction
----    ------- -------------------- ---------------------
Public  True    Block                Allow

If the final command returns no rule, continue to Step 3 and create a focused rule instead of enabling the entire file-and-printer-sharing group.

Step 2: Enable the built-in ICMP echo rule

The built-in rule is preferable because it already matches echo requests and does not expose unrelated SMB or printer-sharing traffic.

For IPv4 ping, run this in the same elevated window:

Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"
Get-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" | Format-Table DisplayName,Enabled,Profile,Direction,Action

The enable command normally prints nothing. The check should show an inbound allow rule:

DisplayName                                      Enabled Profile Direction Action
-----------                                      ------- ------- --------- ------
File and Printer Sharing (Echo Request - ICMPv4-In) True    Any     Inbound  Allow

For IPv6, enable the separate rule only if the server has working IPv6 and you need IPv6 monitoring:

Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv6-In)"

IPv4 and IPv6 are separate protocols. Enabling the first rule does not make an IPv6 address answer, and enabling ICMP does not open RDP, HTTP, or another service.

Microsoft documents the cmdlet and its targeted-rule behavior in the Enable-NetFirewallRule reference.

Step 3: Create a narrow rule when the built-in rule is unavailable

Removed rules, localized Windows installations, or customized firewall policy can make the English display name unavailable. A custom rule allows only IPv4 echo requests, which use ICMP type 8.

Run the following as administrator:

New-NetFirewallRule -DisplayName "Allow ICMPv4 Echo Requests" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -Action Allow -Profile Any -RemoteAddress Any -Description "Permit inbound IPv4 ping checks"
Get-NetFirewallRule -DisplayName "Allow ICMPv4 Echo Requests" | Format-Table DisplayName,Enabled,Profile,Direction,Action

Expected output includes True, Any, Inbound, and Allow. To limit ping to a monitoring network, replace Any with your approved CIDR range before running the first command:

$MonitoringRange = "MONITORING_CIDR"
New-NetFirewallRule -DisplayName "Allow ICMPv4 Echo Requests - Monitoring" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -Action Allow -Profile Any -RemoteAddress $MonitoringRange

MONITORING_CIDR is a placeholder such as 203.0.113.0/24; replace it with the real range. Do not create both the unrestricted and restricted rules unless you intentionally want both scopes.

An equivalent built-in Windows command is available when PowerShell rule creation is not convenient:

netsh advfirewall firewall add rule name="Allow ICMPv4 Echo Requests" protocol=icmpv4:8,any dir=in action=allow profile=any

The Microsoft netsh advfirewall guide documents this ICMP rule format.

Step 4: Enable the rule in the firewall console

The graphical console is useful when you need to review profiles and restrict the source range visually.

Open Server Manager → Tools → Windows Defender Firewall with Advanced Security. You can also press Windows key + R, enter wf.msc, and select OK.

1. Select Inbound Rules.
2. Find File and Printer Sharing (Echo Request – ICMPv4-In), right-click it, and choose Enable Rule. If it is missing, choose Action → New Rule.
3. For a new rule, choose Custom, keep All programs, and set Protocol type to ICMPv4.
4. Select Customize beside the ICMP settings, choose Specific ICMP types, select Echo Request, and select OK.
5. On Scope, leave the remote address as Any IP address for public monitoring, or add the approved monitoring address or subnet.
6. Select Allow the connection, choose the active profile from Step 1, name the rule Allow ICMPv4 Echo Requests, and select Finish.

Do not enable every rule in the File and Printer Sharing group just to support ping. That group can include rules for services that should not be internet-facing.

Verify the ICMP response

First confirm the selected rule is enabled on the server:

Get-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -ErrorAction SilentlyContinue | Format-List DisplayName,Enabled,Profile,Direction,Action
Get-NetFirewallRule -DisplayName "Allow ICMPv4 Echo Requests" -ErrorAction SilentlyContinue | Format-List DisplayName,Enabled,Profile,Direction,Action

From a different Windows computer, replace SERVER_IP with the server’s public IPv4 address:

ping.exe -4 -n 4 SERVER_IP

Success looks like four replies and no packet loss:

Reply from SERVER_IP: bytes=32 time=25ms TTL=123
Reply from SERVER_IP: bytes=32 time=24ms TTL=123
Reply from SERVER_IP: bytes=32 time=25ms TTL=123
Reply from SERVER_IP: bytes=32 time=24ms TTL=123

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

The latency and TTL will differ. Test from another network when possible; running ping on the server itself does not prove that an external packet can pass through the provider’s perimeter firewall.

Troubleshooting

Request timed out

The rule may still be disabled, may be scoped to the wrong profile or source address, or may be blocked before it reaches Windows. Recheck the rule output, confirm the test uses the server’s public IP, and inspect the VPS control panel’s firewall or security-group settings.

Enable-NetFirewallRule cannot find the rule

The rule may have been removed, or its display name may be localized. Search for likely echo rules with:

Get-NetFirewallRule | Where-Object { $_.DisplayName -match "Echo Request|ICMPv4" } | Format-Table DisplayName,Enabled,Profile,Direction,Action

If no suitable rule appears, use the custom New-NetFirewallRule command in Step 3. It does not depend on the built-in English rule name.

Ping works locally but not from the internet

A local test can avoid the public route, NAT, or upstream filtering. Check the provider-level firewall, any network security group, and the source restriction on the Windows rule; then test again from a separate network.

IPv4 works but IPv6 does not

ICMPv6 needs its own inbound echo rule, and the server must have a routed IPv6 address. Enable the ICMPv6 built-in rule in Step 2 or create a custom rule with Protocol type → ICMPv6 and Echo Request in the firewall console.

Hardening

• Restrict Remote IP address to your monitoring systems when public ping is not needed.
• Keep Windows Defender Firewall enabled and allow only echo requests, rather than all ICMP types.
• Treat a successful ping as a reachability signal, not proof that RDP or an application is healthy.
• If Group Policy manages the firewall, make the equivalent change in the domain policy so a refresh does not remove the local rule.

FAQ

Does ICMP use a port?

No. ICMP operates at the network layer and does not use TCP or UDP ports. The firewall rule matches echo-request packets by protocol and type, leaving port-based rules unchanged.

Is allowing ping a security risk?

It exposes whether the address answers a basic network probe and can add a small amount of scan or flood traffic. Limiting the rule to known monitoring addresses is the safer choice when public reachability checks are unnecessary.

Why does enabling File and Printer Sharing not expose SMB?

The procedure enables only the rule whose name ends in Echo Request - ICMPv4-In. Do not enable the whole rule group, because other entries may permit file sharing, printer discovery, or related traffic.

Can ping prove that RDP is working?

No. Ping tests ICMP reachability only. RDP still needs the Remote Desktop service, its TCP firewall rule, a listening port, valid credentials, and any required provider-level access.