How to Create a Scoped Windows Defender Firewall Rule with PowerShell
Applies to: Windows Server 2019, 2022 and 2025, subject to installed updates and feature availability.
A firewall rule should define direction, protocol, port, profile and approved remote addresses instead of opening a service globally.
Security controls should be piloted, monitored and reversible through console access. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Identify exact application port and process.
- List approved source networks.
- Maintain console access.
- Record existing rules and profiles.
Procedure
Step 1: Inspect profiles
Confirm network category and firewall state.
Get-NetConnectionProfile
Get-NetFirewallProfileStep 2: Search existing rules
Avoid duplicate broad rules.
Get-NetFirewallRule | Where DisplayName -Like '*Business App*'Step 3: Create scoped rule
Replace TEST-NET source with approved management network.
New-NetFirewallRule -DisplayName 'Business App HTTPS from Management' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 8443 -RemoteAddress 192.0.2.0/24 -Profile DomainStep 4: Test allowed source
Use the real client.
Test-NetConnection server.corp.example -Port 8443Step 5: Test denied source
Verify another network cannot connect.
Verification
Inspect rule, port filter and address filter.
Get-NetFirewallRule -DisplayName 'Business App HTTPS from Management' | Get-NetFirewallPortFilter
Get-NetFirewallRule -DisplayName 'Business App HTTPS from Management' | Get-NetFirewallAddressFilterRollback and recovery
Disable-NetFirewallRule first if immediate rollback is needed, then Remove-NetFirewallRule after validation.
Security notes
Replace example addresses and avoid Any profile or Any remote address unless explicitly justified.
Official references
Explore Netcloud24 Canada.
