{"id":849,"date":"2026-10-16T09:00:00","date_gmt":"2026-10-16T09:00:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=849"},"modified":"2026-10-16T09:00:00","modified_gmt":"2026-10-16T09:00:00","slug":"open-port-windows-server-2022","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/16\/open-port-windows-server-2022\/","title":{"rendered":"How to Open a Port on Windows Server 2022"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To open port on Windows Server 2022, create an inbound Windows Defender Firewall rule for the application\u2019s exact protocol and port. This guide takes about ten minutes and shows how to confirm that the service is listening and reachable from another computer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>A Windows Server 2022 VPS with the application or service you want to expose.<\/li>\n\n\n<li>An active RDP session and a local administrator account, or permission to open an elevated PowerShell window.<\/li>\n\n\n<li>The port number and protocol used by the service. TCP and UDP are different traffic types and require separate rules.<\/li>\n\n\n<li>A second computer or network from which you can test the server\u2019s public IP address or DNS name.<\/li>\n\n\n<li>A Windows environment with administrator access is available through <a href=\"https:\/\/vpslake.com\/buy-windows-rdp\">VPSLake Windows RDP hosting<\/a>.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Confirm the service and port<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The firewall only permits or rejects traffic; it cannot make an application listen on a port, so check the service before adding an exception.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Windows PowerShell \u2192 Run as administrator<\/strong>. Replace <code>8443<\/code> with the port your application uses, then check both common protocols:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Port = 8443\nGet-NetTCPConnection -LocalPort $Port -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,State,OwningProcess\nGet-NetUDPEndpoint -LocalPort $Port -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,OwningProcess<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A TCP result with <code>State<\/code> set to <code>Listen<\/code>, or a UDP endpoint, confirms that a process has claimed the port. No output means the application is stopped, configured for another port, or bound only after startup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example TCP output:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LocalAddress LocalPort State  OwningProcess\n------------ --------- ------ -------------\n0.0.0.0      8443      Listen 4120<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the service is not listening yet, start it or correct its application settings before testing the firewall. A listener on <code>127.0.0.1<\/code> accepts local traffic only; a network service normally needs to bind to the server address or all interfaces.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Check the active network profile<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Windows applies a firewall rule only when its assigned profile matches the profile in use, so identify that profile before creating the rule.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetConnectionProfile | Select-Object InterfaceAlias,Name,NetworkCategory,IPv4Connectivity\nGet-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For an internet-facing VPS, the connected adapter is commonly <code>Public<\/code>, but use the value returned by your server. The firewall should be enabled and the default inbound action should normally be <code>Block<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name    Enabled DefaultInboundAction\n----    ------- --------------------\nDomain  True    Block\nPrivate True    Block\nPublic  True    Block<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not disable Windows Defender Firewall to make a connection work. If <code>NetworkCategory<\/code> is <code>DomainAuthenticated<\/code>, use <code>Domain<\/code> as the rule profile in the next step.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Create the inbound rule with PowerShell<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell creates a named rule that you can inspect, audit, or remove later. The example allows TCP port <code>8443<\/code> on the active profile; change the variables to match your service.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Port = 8443\n$Protocol = 'TCP'\n$RuleName = \"Allow $Protocol $Port - Application\"\n$Profile = Get-NetConnectionProfile | Select-Object -First 1 -ExpandProperty NetworkCategory\nif ($Profile -eq 'DomainAuthenticated') { $Profile = 'Domain' }\nNew-NetFirewallRule -DisplayName $RuleName -Direction Inbound -Action Allow -Protocol $Protocol -LocalPort $Port -Profile $Profile -RemoteAddress Any -Description \"Inbound access for the application on $Protocol port $Port\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The command should return an enabled inbound allow rule. The <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/netsecurity\/new-netfirewallrule\" target=\"_blank\" rel=\"noopener\">New-NetFirewallRule reference<\/a> explains the port, profile, protocol, and address filters used by this cmdlet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Expected values include:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DisplayName                  Enabled Direction Action Profile\n-----------                  ------- --------- ------ -------\nAllow TCP 8443 - Application True    Inbound   Allow  Public<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For a UDP service, run the same block with <code>$Protocol = 'UDP'<\/code>. If the service is meant for an office, monitoring host, or private application tier, replace <code>Any<\/code> with a trusted IP address or CIDR range such as <code>203.0.113.25<\/code> or <code>203.0.113.0\/24<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Add the rule through the firewall console<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The graphical wizard is useful when you want to review the protocol, profile, and remote scope before saving the exception.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Server Manager \u2192 Tools \u2192 Windows Defender Firewall with Advanced Security<\/strong>. You can also press <strong>Windows key + R<\/strong>, enter <code>wf.msc<\/code>, and select <strong>OK<\/strong>.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Select <strong>Inbound Rules<\/strong> in the left pane, then select <strong>New Rule&#8230;<\/strong> in the Actions pane.<\/li>\n\n\n<li>Choose <strong>Port<\/strong>, select <strong>TCP<\/strong> or <strong>UDP<\/strong>, and enter the port in <strong>Specific local ports<\/strong>.<\/li>\n\n\n<li>Select <strong>Allow the connection<\/strong>. Do not choose <strong>Allow the connection if it is secure<\/strong> unless you have deliberately configured IPsec.<\/li>\n\n\n<li>Select only the active profile from Step 2. Select other profiles only if this service must remain available when the network category changes.<\/li>\n\n\n<li>On <strong>Scope<\/strong>, limit <strong>Remote IP address<\/strong> to trusted sources when the application is not intended for the public internet.<\/li>\n\n\n<li>Enter a descriptive name such as <code>Allow TCP 8443 - Application<\/code>, add the service and owner in <strong>Description<\/strong>, and select <strong>Finish<\/strong>.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The new rule should appear enabled under <strong>Inbound Rules<\/strong>. Microsoft\u2019s <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/network-security\/windows-firewall\/configure\" target=\"_blank\" rel=\"noopener\">Windows Firewall rule configuration guide<\/a> documents the same console and policy model for Windows Server 2022.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the firewall rule and remote access<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First confirm that Windows saved the expected rule and port filter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$RuleName = 'Allow TCP 8443 - Application'\nGet-NetFirewallRule -DisplayName $RuleName | Format-List DisplayName,Enabled,Direction,Action,Profile\nGet-NetFirewallRule -DisplayName $RuleName | Get-NetFirewallPortFilter | Format-List Protocol,LocalPort\nGet-NetTCPConnection -LocalPort 8443 -State Listen | Select-Object LocalAddress,LocalPort,State,OwningProcess<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Look for <code>Enabled : True<\/code>, <code>Direction : Inbound<\/code>, <code>Action : Allow<\/code>, the expected profile, <code>Protocol : TCP<\/code>, <code>LocalPort : 8443<\/code>, and a TCP listener. The rule permits traffic, but the listener proves that the application can receive it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From a different computer, test the server\u2019s public endpoint. Replace <code>SERVER_IP<\/code> with the public IP address or DNS name:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Test-NetConnection -ComputerName SERVER_IP -Port 8443<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The important result is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ComputerName     : SERVER_IP\nRemotePort       : 8443\nTcpTestSucceeded : True<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Run this test away from the server. A successful <code>localhost<\/code> test can bypass an incorrect public route, provider firewall, NAT rule, or DNS record. For UDP, use the application\u2019s client or a protocol-specific test because <code>Test-NetConnection<\/code> checks TCP.<\/p>\n\n\n\n<aside class=\"vl-element vl-cta-banner\" aria-label=\"Need a Windows VPS?\">\n\t<div class=\"vl-cta-banner__content\">\n\t\t<p class=\"vl-cta-banner__eyebrow\">Windows Server hosting<\/p>\n\t\t<h3 class=\"vl-cta-banner__title\">Need a Windows VPS?<\/h3>\n\t\t<p class=\"vl-cta-banner__text\">Get administrator access to configure services and firewall rules on Windows Server.<\/p>\n\t<\/div>\n\t<a class=\"vl-cta-banner__button\" href=\"\/buy-windows-rdp\" aria-label=\"View Windows VPS\">View Windows VPS<\/a>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><code>TcpTestSucceeded : False<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The service may not be listening, the rule may use the wrong protocol or profile, or an upstream provider firewall may block the port before it reaches Windows. Repeat Step 1, inspect the rule\u2019s port filter, and check any VPS control-panel or network security-group setting outside the operating system.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The port is listening locally but not from the internet<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The application may be bound to <code>127.0.0.1<\/code>, or the connection may be reaching a different server because of an incorrect DNS record. Check the <code>LocalAddress<\/code> value, test the public IP directly, and review NAT, load balancer, or provider firewall rules.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">PowerShell returns <code>Access is denied<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The NetSecurity cmdlets require elevation. Close the current window, search for PowerShell, select <strong>Run as administrator<\/strong>, and run the commands again with a local administrator account.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The rule exists but traffic is still blocked<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check that the rule\u2019s profile matches <code>Get-NetConnectionProfile<\/code>, that the remote address scope includes the client, and that a more specific block rule or Group Policy is not taking precedence. On a domain-managed server, the controlling firewall policy may need to be changed by a domain administrator.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hardening<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Restrict <strong>Remote IP address<\/strong> to trusted sources for databases, dashboards, administration tools, and internal APIs.<\/li>\n\n\n<li>Create separate rules for TCP and UDP, and open only the protocol the application actually uses.<\/li>\n\n\n<li>Record the application, owner, purpose, and expiration date in the rule description.<\/li>\n\n\n<li>Remove a temporary exception when the service is retired:<\/li>\n\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>Remove-NetFirewallRule -DisplayName 'Allow TCP 8443 - Application'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm the display name before removing a rule on a production server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Does opening a firewall port start the application?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. The rule only allows matching packets through Windows Defender Firewall. The application must be installed, running, bound to a reachable address, and configured for the same port and protocol.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Do TCP and UDP use the same firewall rule?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. Windows evaluates them as separate protocols even when they use the same port number. Create and test a second rule only when the application documentation says it needs UDP as well as TCP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why does the port work on the server but not remotely?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A local test does not validate the public route. The service could be listening only on loopback, or an upstream firewall, NAT rule, security group, or incorrect DNS record could stop the remote connection.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Should I open every Windows Firewall profile?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Usually not. Assign the rule to the profile used by the server\u2019s active adapter, then add another profile only when the service genuinely needs to survive a deliberate network-category change.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Does opening a firewall port start the application?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. The rule only allows matching packets through Windows Defender Firewall. The application must be installed, running, bound to a reachable address, and configured for the same port and protocol.\"}}, {\"@type\": \"Question\", \"name\": \"Do TCP and UDP use the same firewall rule?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. Windows evaluates them as separate protocols even when they use the same port number. Create and test a second rule only when the application documentation says it needs UDP as well as TCP.\"}}, {\"@type\": \"Question\", \"name\": \"Why does the port work on the server but not remotely?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"A local test does not validate the public route. The service could be listening only on loopback, or an upstream firewall, NAT rule, security group, or incorrect DNS record could stop the remote connection.\"}}, {\"@type\": \"Question\", \"name\": \"Should I open every Windows Firewall profile?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Usually not. Assign the rule to the profile used by the server\u2019s active adapter, then add another profile only when the service genuinely needs to survive a deliberate network-category change.\"}}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"Learn how to open port on Windows Server 2022 with PowerShell or the firewall console, verify the listener remotely, and fix common failures.","protected":false},"author":1,"featured_media":850,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5,11],"tags":[39,38,37,52],"class_list":["post-849","post","type-post","status-publish","format-standard","has-post-thumbnail","category-guides","category-windows-server","tag-network-security","tag-powershell","tag-windows-firewall","tag-windows-server-2022","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=849"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/849\/revisions"}],"predecessor-version":[{"id":3416,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/849\/revisions\/3416"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/850"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=849"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=849"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}