[{"data":1,"prerenderedAt":343},["ShallowReactive",2],{"en-post-147":3},{"id":4,"title":5,"body":6,"description":12,"extension":336,"meta":337,"navigation":338,"path":339,"seo":340,"stem":341,"__hash__":342},"content/post/147.md","147",{"type":7,"value":8,"toc":324},"minimark",[9,13,18,21,24,27,31,69,73,93,97,100,195,199,247,251,257,268,273,276,281,289,294,297,301,304,312,316],[10,11,12],"p",{},"The service is running and you can reach it from the same machine, but no other device can connect. That pattern usually traces back to Windows Defender Firewall. Hosting a web service, enabling Remote Desktop, or running a LAN game can all mean opening it up. This guide covers the two ways to allow traffic, by app and by port, plus the order to follow when connections still fail afterwards.",[14,15,17],"h2",{"id":16},"what-is-a-windows-defender-firewall-rule","What Is a Windows Defender Firewall Rule",[10,19,20],{},"Windows Defender Firewall is the network filter built into Windows. It classifies connections by network location into private, public, and domain profiles, each with its own rule set. A home LAN is usually detected as private, public Wi-Fi as public, and the two do not allow the same traffic.",[10,22,23],{},"Rules also split into inbound and outbound. Connections initiated from outside are governed by inbound rules; connections the machine starts are governed by outbound rules. Most server scenarios only need an inbound rule. A rule can allow a program, or allow a port and protocol. Allowing a program is less work, allowing a port is more precise.",[10,25,26],{},"Think of it as a door that filters on conditions. Once network type and inbound direction are clear, the settings stop being guesswork.",[14,28,30],{"id":29},"what-it-does","What It Does",[32,33,34,38,50,53,60,63,66],"ul",{},[35,36,37],"li",{},"Allow a single program without working out which port it uses.",[35,39,40,41,45,46,49],{},"Open a specific port with an inbound rule for ",[42,43,44],"code",{},"TCP"," or ",[42,47,48],{},"UDP",", which suits services that communicate on a known port.",[35,51,52],{},"Limit where a rule applies, since it only takes effect on the network profiles you tick.",[35,54,55,56,59],{},"Configure rules in bulk from the command line with ",[42,57,58],{},"netsh",".",[35,61,62],{},"Test whether the firewall is the culprit by temporarily disabling one rule and retrying the connection.",[35,64,65],{},"Keep the exposed surface small. Allowing one program or one port is much safer than turning the firewall off.",[35,67,68],{},"Log and audit rules from the advanced console, so a rule added months ago can still be identified.",[14,70,72],{"id":71},"when-to-use","When to Use",[32,74,75,78,81,84,87,90],{},[35,76,77],{},"A browser on the same machine opens the service, but a phone or another PC on the same LAN cannot.",[35,79,80],{},"Remote Desktop or a local web server is enabled and the port never connects.",[35,82,83],{},"A multiplayer game reports it cannot reach the host, or LAN sharing cannot find this PC.",[35,85,86],{},"A first run prompt was dismissed with Cancel and the private network box was never ticked.",[35,88,89],{},"You want to reach a home machine from outside, which also needs port forwarding on the router.",[35,91,92],{},"Checking whether third party security software is stacking its own blocking on top.",[14,94,96],{"id":95},"before-you-start","Before You Start",[10,98,99],{},"Before changing anything, confirm the program is running and listening on the target port, otherwise the firewall edit achieves nothing. Creating rules needs administrator rights.",[101,102,103,119],"table",{},[104,105,106],"thead",{},[107,108,109,113,116],"tr",{},[110,111,112],"th",{},"Item",[110,114,115],{},"Windows 10",[110,117,118],{},"Windows 11",[120,121,122,134,151,161,173,183],"tbody",{},[107,123,124,128,131],{},[125,126,127],"td",{},"Allow an app entry",[125,129,130],{},"Control Panel > Windows Defender Firewall",[125,132,133],{},"Same, or search in Settings",[107,135,136,139,148],{},[125,137,138],{},"Advanced rules entry",[125,140,141,144,145],{},[42,142,143],{},"Win + R"," then ",[42,146,147],{},"wf.msc",[125,149,150],{},"Same",[107,152,153,156,159],{},[125,154,155],{},"New inbound rule",[125,157,158],{},"Supported",[125,160,158],{},[107,162,163,166,171],{},[125,164,165],{},"Command line tool",[125,167,168],{},[42,169,170],{},"netsh advfirewall",[125,172,150],{},[107,174,175,178,181],{},[125,176,177],{},"Administrator rights",[125,179,180],{},"Needed to create rules",[125,182,180],{},[107,184,185,188,193],{},[125,186,187],{},"Check listening ports",[125,189,190],{},[42,191,192],{},"netstat -ano",[125,194,150],{},[14,196,198],{"id":197},"step-by-step","Step-by-Step",[200,201,202,208,211,218,227,238,241],"ol",{},[35,203,204,205,59],{},"Try the simple route first. Open ",[42,206,207],{},"Control Panel > Windows Defender Firewall > Allow an app through Windows Defender Firewall",[35,209,210],{},"Click Change settings, find the target program in the list, and tick Private for a home LAN. Leave Public alone unless you have a reason. Ticking the wrong profile exposes the service to unfamiliar networks.",[35,212,213,214,217],{},"If it is not listed, click Allow another app, browse to the program's ",[42,215,216],{},".exe",", and add it. It usually takes effect immediately.",[35,219,220,221,223,224,226],{},"To allow a port instead, press ",[42,222,143],{},", type ",[42,225,147],{},", select Inbound Rules on the left, then click New Rule on the right and choose Port. This console lets you allow by protocol and port precisely.",[35,228,229,230,45,232,234,235,237],{},"Pick ",[42,231,44],{},[42,233,48],{},", enter the port number, use commas for several and a hyphen for a range. If you do not know the protocol, try ",[42,236,44],{}," first.",[35,239,240],{},"Choose Allow the connection, tick the network profiles that apply, give the rule a name you will recognize, and finish. If outbound traffic is blocked too, repeat the steps for an outbound rule. Clear names make the list much easier to maintain later.",[35,242,243,244,59],{},"For bulk work use ",[42,245,246],{},"netsh advfirewall firewall add rule name=\"Open80\" dir=in action=allow protocol=TCP localport=80",[14,248,250],{"id":249},"faq","FAQ",[10,252,253],{},[254,255,256],"strong",{},"The port is open and it still will not connect",[10,258,259,260,263,264,267],{},"Run ",[42,261,262],{},"netstat -ano | findstr :port"," in ",[42,265,266],{},"cmd"," and check whether the port is in LISTEN. If nothing is listening, the program is not up.",[10,269,270],{},[254,271,272],{},"The rule exists but never fires",[10,274,275],{},"A mismatched network profile is the usual cause, since a private rule will not match on a public network. Check the rule properties and the profile column in the console.",[10,277,278],{},[254,279,280],{},"Do I need to touch the router for outside access",[10,282,283,284,59],{},"Yes, the router needs port forwarding. If basic connectivity is broken first, start with ",[285,286,288],"a",{"href":287},"/post/42/","Browser Can't Open Web Pages, but WeChat Works",[10,290,291],{},[254,292,293],{},"Is it fine to just turn the firewall off",[10,295,296],{},"For a short test, yes, but turn it back on afterwards. Leaving a high risk port like 3389 exposed invites brute force attempts.",[14,298,300],{"id":299},"how-it-works","How It Works",[10,302,303],{},"The firewall matches each connection against rules in order, with block rules taking precedence over allow rules and more specific rules winning. Every rule is bound to a network location profile, so moving the same machine to a different network can produce a completely different match. That is exactly why something works at home and fails elsewhere, with no change to the service itself.",[10,305,306,307,311],{},"It is also stateful. Established connections are recorded and return traffic is allowed automatically, which is why you normally only manage the inbound direction. The rest of the baseline protection is covered in ",[285,308,310],{"href":309},"/post/85/","Windows Security Center and Defender","; the firewall is only one part of it.",[14,313,315],{"id":314},"conclusion","Conclusion",[10,317,318,319,323],{},"Allow by program first, by port only if that fails, and leave a temporary firewall shutdown as the last comparison test, restoring it afterwards. Give rules descriptive names so you are not guessing months later. Remote Desktop is the most common case here, so ",[285,320,322],{"href":321},"/post/62/","How to Use Windows Remote Desktop (RDP)"," is the checklist to work through when a connection fails. It is a short checklist, and it usually ends with one missing tick box.",{"title":325,"searchDepth":326,"depth":326,"links":327},"",2,[328,329,330,331,332,333,334,335],{"id":16,"depth":326,"text":17},{"id":29,"depth":326,"text":30},{"id":71,"depth":326,"text":72},{"id":95,"depth":326,"text":96},{"id":197,"depth":326,"text":198},{"id":249,"depth":326,"text":250},{"id":299,"depth":326,"text":300},{"id":314,"depth":326,"text":315},"md",{},true,"/post/147",{"description":12},"post/147","504fSQ70ICFounyGKxPcGJZhoQ8ANJCI37CEb8tf78c",1794378304872]