> For the complete documentation index, see [llms.txt](https://docs.ititanhosting.ro/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ititanhosting.ro/docs/english/vps/windows/how-to-configure-windows-firewall.md).

# How to configure Windows Firewall

Windows Firewall is your server's first line of defense. It controls which traffic can reach your VPS. By default, most ports are blocked. You need to open the ones your services use.

The firewall is already running on your Windows VPS. You just need to configure it.

### Opening Windows Firewall

1. Click the **Start** button
2. Type **Windows Defender Firewall**
3. Click the result to open it

You see a simple status screen showing whether the firewall is on. For the full configuration, click **Advanced settings** on the left.

### Understanding the interface

In the Advanced Security window, you see three sections on the left:

* **Inbound Rules** - controls traffic coming into your server
* **Outbound Rules** - controls traffic leaving your server
* **Connection Security Rules** - advanced authentication rules (rarely needed)

Inbound rules are the ones you will use most often.

### Opening a port (inbound rule)

1. Click **Inbound Rules**
2. Click **New Rule...** on the right
3. Select **Port** and click **Next**
4. Choose **TCP** (or UDP, depending on the service)
5. Enter the port number (e.g., `25565` for Minecraft)
6. Select **Allow the connection**
7. Check the profiles (Domain, Private, Public - usually keep all three)
8. Give the rule a name like `Minecraft Port 25565`
9. Click **Finish**

The rule appears in the list. Traffic on that port is now allowed.

### Opening a port range

Some applications use multiple ports. Follow the same steps but enter a range in the port field:

```
30000:30010
```

This opens ports 30000 through 30010.

### Allowing a program instead of a port

Sometimes it is easier to allow a program rather than specific ports:

1. Click **New Rule...**
2. Select **Program** and click **Next**
3. Browse to the program's executable file (e.g., `C:\MyServer\server.exe`)
4. Select **Allow the connection**
5. Complete the wizard

The firewall will let that program communicate on any port it needs.

### Blocking an IP address

If you see repeated failed login attempts from a specific IP, block it:

1. Click **Inbound Rules**
2. Click **New Rule...**
3. Select **Custom** and click **Next**
4. Keep **All programs** selected, click **Next**
5. Keep **Any protocol**, click **Next**
6. Under **Remote IP address**, select **These IP addresses** and click **Add**
7. Enter the IP you want to block
8. Select **Block the connection**
9. Name the rule `Block malicious IP`

### Enabling or disabling a rule

Find the rule in the list. Right-click it and select:

* **Enable Rule** - turns the rule on
* **Disable Rule** - turns the rule off without deleting it

### Viewing the firewall log

If you are troubleshooting, check what the firewall has blocked:

1. In Windows Firewall, click **Properties** (top of the window)
2. Go to the **Domain Profile**, **Private Profile**, or **Public Profile** tab
3. Next to **Logging**, click **Customize**
4. Set **Log dropped packets** to **Yes**
5. Click **OK**

Now check `C:\Windows\System32\LogFiles\Firewall\pfirewall.log` for blocked connection attempts.

### Quick commands in PowerShell

Open a port:

```powershell
netsh advfirewall firewall add rule name="My Port" dir=in action=allow protocol=TCP localport=8080
```

Remove a rule:

```powershell
netsh advfirewall firewall delete rule name="My Port"
```

List all rules:

```powershell
netsh advfirewall firewall show rule name=all | more
```

Export your firewall policy:

```powershell
netsh advfirewall export "C:\backup\firewall-policy.wfw"
```

Import a firewall policy:

```powershell
netsh advfirewall import "C:\backup\firewall-policy.wfw"
```

### Common mistakes

**Opening too many ports** Only open what you need. Each open port is a potential entry point. Close ports when you stop using the service.

**Forgetting UDP** Some applications (game servers, voice chat) use UDP. Make sure you open both TCP and UDP when needed.

**Not testing from outside** After opening a port, test it from a different network. Use a website like portchecker.co or a tool like `Test-NetConnection` in PowerShell:

```powershell
Test-NetConnection your-server-ip -Port 25565
```

### Windows Firewall vs third-party firewalls

Windows Firewall is good enough for most VPS setups. It is free, built-in, and integrates with Windows. If you need advanced features like intrusion detection or application-level filtering, consider a third-party solution, but for basic port management, the built-in firewall works well.

### Quick reference: common ports

| Port  | Protocol | Service              |
| ----- | -------- | -------------------- |
| 80    | TCP      | HTTP (web)           |
| 443   | TCP      | HTTPS (secure web)   |
| 3389  | TCP      | Remote Desktop (RDP) |
| 3306  | TCP      | MySQL                |
| 25565 | TCP      | Minecraft            |
| 30120 | TCP+UDP  | FiveM                |
| 27015 | TCP+UDP  | CS2 / Source games   |

### Conclusion

Windows Firewall is simple once you know where to look. Add rules for the ports you need, block everything else, and your server stays secure.