How to Open a Port on Windows Server 2022

To open port on Windows Server 2022, create an inbound Windows Defender Firewall rule for the application’s exact protocol and port. This guide takes about ten minutes and shows how to confirm that the service is listening and reachable from another computer.

Prerequisites

• A Windows Server 2022 VPS with the application or service you want to expose.
• An active RDP session and a local administrator account, or permission to open an elevated PowerShell window.
• The port number and protocol used by the service. TCP and UDP are different traffic types and require separate rules.
• A second computer or network from which you can test the server’s public IP address or DNS name.
• A Windows environment with administrator access is available through VPSLake Windows RDP hosting.

Step 1: Confirm the service and port

The firewall only permits or rejects traffic; it cannot make an application listen on a port, so check the service before adding an exception.

Open Windows PowerShell → Run as administrator. Replace 8443 with the port your application uses, then check both common protocols:

$Port = 8443
Get-NetTCPConnection -LocalPort $Port -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,State,OwningProcess
Get-NetUDPEndpoint -LocalPort $Port -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,OwningProcess

A TCP result with State set to Listen, or a UDP endpoint, confirms that a process has claimed the port. No output means the application is stopped, configured for another port, or bound only after startup.

Example TCP output:

LocalAddress LocalPort State  OwningProcess
------------ --------- ------ -------------
0.0.0.0      8443      Listen 4120

If the service is not listening yet, start it or correct its application settings before testing the firewall. A listener on 127.0.0.1 accepts local traffic only; a network service normally needs to bind to the server address or all interfaces.

Step 2: Check the active network profile

Windows applies a firewall rule only when its assigned profile matches the profile in use, so identify that profile before creating the rule.

Get-NetConnectionProfile | Select-Object InterfaceAlias,Name,NetworkCategory,IPv4Connectivity
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction

For an internet-facing VPS, the connected adapter is commonly Public, but use the value returned by your server. The firewall should be enabled and the default inbound action should normally be Block:

Name    Enabled DefaultInboundAction
----    ------- --------------------
Domain  True    Block
Private True    Block
Public  True    Block

Do not disable Windows Defender Firewall to make a connection work. If NetworkCategory is DomainAuthenticated, use Domain as the rule profile in the next step.

Step 3: Create the inbound rule with PowerShell

PowerShell creates a named rule that you can inspect, audit, or remove later. The example allows TCP port 8443 on the active profile; change the variables to match your service.

$Port = 8443
$Protocol = 'TCP'
$RuleName = "Allow $Protocol $Port - Application"
$Profile = Get-NetConnectionProfile | Select-Object -First 1 -ExpandProperty NetworkCategory
if ($Profile -eq 'DomainAuthenticated') { $Profile = 'Domain' }
New-NetFirewallRule -DisplayName $RuleName -Direction Inbound -Action Allow -Protocol $Protocol -LocalPort $Port -Profile $Profile -RemoteAddress Any -Description "Inbound access for the application on $Protocol port $Port"

The command should return an enabled inbound allow rule. The New-NetFirewallRule reference explains the port, profile, protocol, and address filters used by this cmdlet.

Expected values include:

DisplayName                  Enabled Direction Action Profile
-----------                  ------- --------- ------ -------
Allow TCP 8443 - Application True    Inbound   Allow  Public

For a UDP service, run the same block with $Protocol = 'UDP'. If the service is meant for an office, monitoring host, or private application tier, replace Any with a trusted IP address or CIDR range such as 203.0.113.25 or 203.0.113.0/24.

Step 4: Add the rule through the firewall console

The graphical wizard is useful when you want to review the protocol, profile, and remote scope before saving the exception.

Open Server Manager → Tools → Windows Defender Firewall with Advanced Security. You can also press Windows key + R, enter wf.msc, and select OK.

1. Select Inbound Rules in the left pane, then select New Rule… in the Actions pane.
2. Choose Port, select TCP or UDP, and enter the port in Specific local ports.
3. Select Allow the connection. Do not choose Allow the connection if it is secure unless you have deliberately configured IPsec.
4. Select only the active profile from Step 2. Select other profiles only if this service must remain available when the network category changes.
5. On Scope, limit Remote IP address to trusted sources when the application is not intended for the public internet.
6. Enter a descriptive name such as Allow TCP 8443 - Application, add the service and owner in Description, and select Finish.

The new rule should appear enabled under Inbound Rules. Microsoft’s Windows Firewall rule configuration guide documents the same console and policy model for Windows Server 2022.

Verify the firewall rule and remote access

First confirm that Windows saved the expected rule and port filter:

$RuleName = 'Allow TCP 8443 - Application'
Get-NetFirewallRule -DisplayName $RuleName | Format-List DisplayName,Enabled,Direction,Action,Profile
Get-NetFirewallRule -DisplayName $RuleName | Get-NetFirewallPortFilter | Format-List Protocol,LocalPort
Get-NetTCPConnection -LocalPort 8443 -State Listen | Select-Object LocalAddress,LocalPort,State,OwningProcess

Look for Enabled : True, Direction : Inbound, Action : Allow, the expected profile, Protocol : TCP, LocalPort : 8443, and a TCP listener. The rule permits traffic, but the listener proves that the application can receive it.

From a different computer, test the server’s public endpoint. Replace SERVER_IP with the public IP address or DNS name:

Test-NetConnection -ComputerName SERVER_IP -Port 8443

The important result is:

ComputerName     : SERVER_IP
RemotePort       : 8443
TcpTestSucceeded : True

Run this test away from the server. A successful localhost test can bypass an incorrect public route, provider firewall, NAT rule, or DNS record. For UDP, use the application’s client or a protocol-specific test because Test-NetConnection checks TCP.

Troubleshooting

TcpTestSucceeded : False

The service may not be listening, the rule may use the wrong protocol or profile, or an upstream provider firewall may block the port before it reaches Windows. Repeat Step 1, inspect the rule’s port filter, and check any VPS control-panel or network security-group setting outside the operating system.

The port is listening locally but not from the internet

The application may be bound to 127.0.0.1, or the connection may be reaching a different server because of an incorrect DNS record. Check the LocalAddress value, test the public IP directly, and review NAT, load balancer, or provider firewall rules.

PowerShell returns Access is denied

The NetSecurity cmdlets require elevation. Close the current window, search for PowerShell, select Run as administrator, and run the commands again with a local administrator account.

The rule exists but traffic is still blocked

Check that the rule’s profile matches Get-NetConnectionProfile, that the remote address scope includes the client, and that a more specific block rule or Group Policy is not taking precedence. On a domain-managed server, the controlling firewall policy may need to be changed by a domain administrator.

Hardening

• Restrict Remote IP address to trusted sources for databases, dashboards, administration tools, and internal APIs.
• Create separate rules for TCP and UDP, and open only the protocol the application actually uses.
• Record the application, owner, purpose, and expiration date in the rule description.
• Remove a temporary exception when the service is retired:

Remove-NetFirewallRule -DisplayName 'Allow TCP 8443 - Application'

Confirm the display name before removing a rule on a production server.

FAQ

Does opening a firewall port start the application?

No. The rule only allows matching packets through Windows Defender Firewall. The application must be installed, running, bound to a reachable address, and configured for the same port and protocol.

Do TCP and UDP use the same firewall rule?

No. Windows evaluates them as separate protocols even when they use the same port number. Create and test a second rule only when the application documentation says it needs UDP as well as TCP.

Why does the port work on the server but not remotely?

A local test does not validate the public route. The service could be listening only on loopback, or an upstream firewall, NAT rule, security group, or incorrect DNS record could stop the remote connection.

Should I open every Windows Firewall profile?

Usually not. Assign the rule to the profile used by the server’s active adapter, then add another profile only when the service genuinely needs to survive a deliberate network-category change.