Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
A scoped inbound firewall rule exposes only the application protocol, profiles, interfaces, and remote networks that require access.
Prerequisites
- The application port, protocol, executable path, and client networks are confirmed.
- The service is already listening locally.
- Out-of-band access is available before editing remote-management rules.
Configuration procedure
- Confirm the listening process and owning executable.
- Create an inbound rule for the exact TCP or UDP port.
- Restrict remote addresses to approved client subnets.
- Apply only the required Domain, Private, or Public profiles.
- Test locally and remotely, then review firewall logging.
PowerShell commands
Get-NetTCPConnection -State Listen | Sort-Object LocalPort
New-NetFirewallRule -DisplayName "App01 TCP 8443" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 8443 -Profile Domain -RemoteAddress 192.0.2.0/24
Get-NetFirewallRule -DisplayName "App01 TCP 8443" | Get-NetFirewallPortFilter
Verification
An approved client reaches the application on the configured port, while a host outside the allowed TEST-NET example range is blocked. Replace the example subnet with your real approved network.
Rollback
Disable and then remove the named rule if the application fails validation: Disable-NetFirewallRule followed by Remove-NetFirewallRule.
Security and operations
- Never use Any remote address without a documented business requirement.
- TLS should protect application data even on private networks.
- Keep rule names unique and include them in change records.
Related resources
Build your Canadian Windows VPS environment with networkmanager.info. Consult the Microsoft Windows Server documentation before production deployment.
