{"id":865,"date":"2026-10-18T09:00:00","date_gmt":"2026-10-18T09:00:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=865"},"modified":"2026-10-18T09:00:00","modified_gmt":"2026-10-18T09:00:00","slug":"open-port-windows-server-2012","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/18\/open-port-windows-server-2012\/","title":{"rendered":"How to Open a Port on Windows Server 2012"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To open a port on Windows Server 2012, create an inbound Windows Firewall rule for the service&#8217;s exact protocol and port. You can finish the change in about ten minutes, then prove it works from another computer without weakening the rest of the server&#8217;s firewall.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>A VPS running Windows Server 2012, not Windows Server 2012 R2, with the application installed and configured to use a known port.<\/li>\n\n\n<li>An RDP session with a local administrator account, or another account that can open an elevated Windows PowerShell window.<\/li>\n\n\n<li>The port number and protocol required by the application. TCP and UDP are different rules, even when they use the same number.<\/li>\n\n\n<li>The server&#8217;s public IP address or DNS name and a separate computer or network for the remote test.<\/li>\n\n\n<li>If you need a Windows server for this procedure, see <a href=\"https:\/\/vpslake.com\/buy-windows-rdp\">VPSLake Windows RDP hosting<\/a>.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Confirm the application is listening<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Firewall only filters packets; it does not start an application or make a service listen on a port.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Windows PowerShell<\/strong>, right-click it, select <strong>Run as administrator<\/strong>, and replace <code>8443<\/code> with your application&#8217;s port:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Port = 8443\nGet-NetTCPConnection -LocalPort $Port -State Listen -ErrorAction SilentlyContinue | Format-Table LocalAddress,LocalPort,State,OwningProcess\nGet-NetUDPEndpoint -LocalPort $Port -ErrorAction SilentlyContinue | Format-Table LocalAddress,LocalPort,OwningProcess<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A TCP service should return a row with <code>State<\/code> set to <code>Listen<\/code>. A UDP service should return an endpoint; UDP does not report a TCP-style listening state.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LocalAddress LocalPort State  OwningProcess\n------------ --------- ------ -------------\n0.0.0.0           8443 Listen          4120<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">No output usually means the service is stopped, configured for another port, or bound only to <code>127.0.0.1<\/code>. Fix the application first. A firewall exception cannot make a loopback-only service reachable from the internet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Identify the active firewall profile<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Windows applies firewall rules by network profile, so check the connected adapter before assigning a profile to the new rule.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetConnectionProfile | Format-Table InterfaceAlias,NetworkCategory,IPv4Connectivity\nGet-NetFirewallProfile | Format-Table Name,Enabled,DefaultInboundAction,DefaultOutboundAction<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On a VPS, the active network is commonly <code>Public<\/code>, but use the value shown by your server. The firewall should be enabled and inbound traffic should normally default to <code>Block<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name    Enabled DefaultInboundAction DefaultOutboundAction\n----    ------- -------------------- ---------------------\nDomain     True                 Block                Allow\nPrivate    True                 Block                Allow\nPublic     True                 Block                Allow<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the network category is <code>DomainAuthenticated<\/code>, use <code>Domain<\/code> as the rule profile. Do not disable Windows Firewall to troubleshoot a failed connection; that exposes every other service whose access is not otherwise restricted.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Create the inbound rule with PowerShell<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The NetSecurity cmdlet creates a named rule that you can inspect, narrow, disable, or remove later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The block below detects the active profile, converts <code>DomainAuthenticated<\/code> to the firewall profile name <code>Domain<\/code>, and allows TCP port <code>8443<\/code>. Change the port and rule name to match the application:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Port = 8443\n$Protocol = 'TCP'\n$RuleName = 'Allow TCP 8443 - Application'\n$Profile = Get-NetConnectionProfile | Select-Object -First 1 -ExpandProperty NetworkCategory\nif ($Profile -eq 'DomainAuthenticated') { $Profile = 'Domain' }\n\nNew-NetFirewallRule -DisplayName $RuleName -Direction Inbound -Action Allow -Protocol $Protocol -LocalPort $Port -Profile $Profile -RemoteAddress Any -Description \"Inbound $Protocol access for the application on port $Port\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The result should describe an enabled inbound allow rule. For UDP, change <code>$Protocol<\/code> to <code>'UDP'<\/code> and make sure the application actually uses UDP. If only known clients need access, replace <code>Any<\/code> with a trusted address or range such as <code>203.0.113.25<\/code> or <code>203.0.113.0\/24<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft&#8217;s <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/netsecurity\/new-netfirewallrule\" target=\"_blank\" rel=\"noopener\">New-NetFirewallRule reference<\/a> documents the filters available in this cmdlet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Add the rule in the graphical console<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The GUI is useful when you want to review the protocol, profile, and remote address scope before saving the exception.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Server Manager \u2192 Tools \u2192 Windows Firewall with Advanced Security<\/strong>. You can also press <strong>Windows key + R<\/strong>, enter <code>wf.msc<\/code>, and select <strong>OK<\/strong>.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Select <strong>Inbound Rules<\/strong>, then select <strong>New Rule&#8230;<\/strong> in the Actions pane.<\/li>\n\n\n<li>Choose <strong>Port<\/strong>, select <strong>TCP<\/strong> or <strong>UDP<\/strong>, and enter the value in <strong>Specific local ports<\/strong>.<\/li>\n\n\n<li>Select <strong>Allow the connection<\/strong>. Do not select <strong>Allow the connection if it is secure<\/strong> unless you have deliberately configured IPsec.<\/li>\n\n\n<li>Select the active profile from Step 2. Select additional profiles only when the service must remain reachable after a deliberate network-category change.<\/li>\n\n\n<li>On <strong>Scope<\/strong>, limit <strong>Remote IP address<\/strong> when the application is intended for an office, monitoring host, or private application tier rather than the whole internet.<\/li>\n\n\n<li>Give the rule a precise name such as <code>Allow TCP 8443 - Application<\/code>, add its purpose and owner in the description, and select <strong>Finish<\/strong>.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The rule should appear enabled under <strong>Inbound Rules<\/strong>. If a domain policy manages the server, a local rule may be overridden; make the change in the controlling Group Policy when required. Microsoft&#8217;s <a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-r2-and-2012\/jj717282(v=ws.11\" target=\"_blank\" rel=\"noopener\">Windows Server 2012 inbound port-rule procedure<\/a>) explains the same wizard choices.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the open port<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First confirm that Windows saved the expected rule and that a local listener still exists:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$RuleName = 'Allow TCP 8443 - Application'\nGet-NetFirewallRule -DisplayName $RuleName | Format-List DisplayName,Enabled,Direction,Action,Profile\nGet-NetFirewallRule -DisplayName $RuleName | Get-NetFirewallPortFilter | Format-List Protocol,LocalPort\nGet-NetTCPConnection -LocalPort 8443 -State Listen | Format-Table LocalAddress,LocalPort,State,OwningProcess<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should see <code>Enabled : True<\/code>, <code>Direction : Inbound<\/code>, <code>Action : Allow<\/code>, the expected profile, <code>Protocol : TCP<\/code>, <code>LocalPort : 8443<\/code>, and a listener:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DisplayName : Allow TCP 8443 - Application\nEnabled     : True\nDirection   : Inbound\nAction      : Allow\nProfile     : Public\nProtocol    : TCP\nLocalPort   : 8443<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">From a different computer, test the public endpoint. Replace <code>SERVER_IP<\/code> with the server&#8217;s public IP or DNS name:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Test-NetConnection -ComputerName SERVER_IP -Port 8443<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The important result is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ComputerName     : SERVER_IP\nRemotePort       : 8443\nTcpTestSucceeded : True<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Run this check from outside the server. A successful <code>localhost<\/code> test proves only that the local machine can reach itself; it does not test DNS, routing, a provider firewall, or the public interface. For UDP, use the application&#8217;s client or another UDP-specific test because <code>Test-NetConnection<\/code> checks TCP.<\/p>\n\n\n\n<aside class=\"vl-element vl-cta-banner\" aria-label=\"Need a Windows VPS?\">\n\t<div class=\"vl-cta-banner__content\">\n\t\t<p class=\"vl-cta-banner__eyebrow\">Windows Server hosting<\/p>\n\t\t<h3 class=\"vl-cta-banner__title\">Need a Windows VPS?<\/h3>\n\t\t<p class=\"vl-cta-banner__text\">Run Windows applications with administrator access and control over firewall rules.<\/p>\n\t<\/div>\n\t<a class=\"vl-cta-banner__button\" href=\"\/buy-windows-rdp\" aria-label=\"View Windows VPS\">View Windows VPS<\/a>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><code>TcpTestSucceeded : False<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The service may not be listening, the rule may use the wrong protocol or profile, or an upstream firewall may drop the connection before it reaches Windows. Repeat Steps 1 and 2, inspect the rule&#8217;s port filter, and check any VPS control-panel or provider-level firewall outside the operating system.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The port works locally but not from the internet<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The application may be bound to <code>127.0.0.1<\/code>, the DNS record may point to another address, or an external NAT or security rule may be missing. Check <code>LocalAddress<\/code>, test the public IP directly, and confirm the provider is forwarding the requested port to this VPS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The rule exists but traffic is still blocked<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check that the rule&#8217;s profile matches <code>Get-NetConnectionProfile<\/code> and that its remote-address scope includes the client. A more specific block rule or domain Group Policy can also take precedence; inspect the effective policy in <strong>Windows Firewall with Advanced Security<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">PowerShell returns \u201cAccess is denied\u201d<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The firewall cmdlets require elevation. Close the window, search for PowerShell, select <strong>Run as administrator<\/strong>, and run the commands again with a local administrator account or delegated permissions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hardening<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Open only the protocol the application requires. A TCP rule does not permit UDP on the same port.<\/li>\n\n\n<li>Limit <strong>Remote IP address<\/strong> for databases, admin panels, dashboards, and internal APIs that do not need public access.<\/li>\n\n\n<li>Keep the rule description specific enough for another administrator to identify the application, owner, and purpose.<\/li>\n\n\n<li>Windows Server 2012 reached the end of regular support on October 10, 2023. Plan a move to a supported Windows Server release or use the vendor&#8217;s current Extended Security Updates guidance before exposing new services publicly.<\/li>\n\n\n<li>Remove a temporary rule after testing:<\/li>\n\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>Remove-NetFirewallRule -DisplayName 'Allow TCP 8443 - Application'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm the display name before removing it so you do not delete a different application&#8217;s rule.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Does opening a port start the Windows service?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. The firewall rule only permits matching packets through Windows. The application must be installed, running, bound to a reachable address, and configured for the same protocol and port.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Should I open TCP, UDP, or both?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use the protocol specified by the application&#8217;s documentation. TCP and UDP are separate transport protocols, so create a second rule only when the service genuinely requires both.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why does the firewall rule work on one network profile but not another?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Each rule is assigned to Domain, Private, Public, or a combination of profiles. If the connected adapter changes category, the rule may stop applying; check <code>Get-NetConnectionProfile<\/code> and update the rule deliberately instead of enabling every profile by default.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can I test a UDP port with <code>Test-NetConnection<\/code>?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. <code>Test-NetConnection -Port<\/code> performs a TCP test. Use the application&#8217;s normal UDP client or a protocol-aware diagnostic tool, and verify the UDP endpoint with <code>Get-NetUDPEndpoint<\/code> on the server.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Does opening a port start the Windows service?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. The firewall rule only permits matching packets through Windows. The application must be installed, running, bound to a reachable address, and configured for the same protocol and port.\"}}, {\"@type\": \"Question\", \"name\": \"Should I open TCP, UDP, or both?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Use the protocol specified by the application's documentation. TCP and UDP are separate transport protocols, so create a second rule only when the service genuinely requires both.\"}}, {\"@type\": \"Question\", \"name\": \"Why does the firewall rule work on one network profile but not another?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Each rule is assigned to Domain, Private, Public, or a combination of profiles. If the connected adapter changes category, the rule may stop applying; check `Get-NetConnectionProfile` and update the rule deliberately instead of enabling every profile by default.\"}}, {\"@type\": \"Question\", \"name\": \"Can I test a UDP port with `Test-NetConnection`?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. `Test-NetConnection -Port` performs a TCP test. Use the application's normal UDP client or a protocol-aware diagnostic tool, and verify the UDP endpoint with `Get-NetUDPEndpoint` on the server.\"}}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"Learn how to open port on windows server 2012 with PowerShell or the firewall console, verify remote access, and fix blocked connections securely.","protected":false},"author":1,"featured_media":866,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5,11],"tags":[39,38,37,31],"class_list":["post-865","post","type-post","status-publish","format-standard","has-post-thumbnail","category-guides","category-windows-server","tag-network-security","tag-powershell","tag-windows-firewall","tag-windows-server-2012","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=865"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/865\/revisions"}],"predecessor-version":[{"id":3628,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/865\/revisions\/3628"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/866"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}