Open „Windows Defender Firewall with Advanced Security“, create a new inbound rule of type „Port“, enter protocol and port number and allow the connection. Windows Server blocks incoming connections by default, so every service you want to reach from outside needs such a rule.

Example: you run a Minecraft server on your Windows Server. Other players can only connect once port 25565 is open in the Windows Firewall. On our side nothing blocks the port, see Are all ports open?, the rule in Windows is up to you.

Common ports

ApplicationProtocol and port(s)
Minecraft serverTCP 25565
TeamSpeakUDP 9987
TCP 30033
Web serverTCP 80, 443
CS2 serverTCP 27015-27030, 27036-27037
UDP 4380, 27000-27031, 27036
RDPTCP 3389
Ports to open in Windows Firewall

More ports are listed in What are the standard ports?

Step by step in the firewall console

  1. Connect to your Windows Server as Administrator, see Windows Server: Quick Start Guide.
  2. Search for „Firewall“ in the Start menu and open „Windows Defender Firewall with Advanced Security“.
Opening Windows Defender Firewall with Advanced Security
Opening Windows Defender Firewall with Advanced Security
  1. Right-click „Inbound Rules“ on the left and select „New Rule“.
  2. Choose the rule type „Port“ and click „Next“.
  3. Select „TCP“ or „UDP“ and enter the port numbers under „Specific local ports“, for example 25565. Several ports are separated by commas, ranges are written as 50000-51000. Click „Next“.
Entering protocol and ports in the new inbound rule wizard
Entering protocol and ports in the new inbound rule wizard
  1. Choose „Allow the connection“ and click „Next“.
  2. Leave all profiles checked and click „Next“.
  3. Give the rule a name, ideally the application, for example „Minecraft Server“, and click „Finish“.
Naming the new inbound firewall rule
Naming the new inbound firewall rule

The rule takes effect immediately, a restart is not needed.

Faster with PowerShell

In a PowerShell window started as Administrator, one line creates the same rule:

New-NetFirewallRule -DisplayName "Minecraft Server" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow

For UDP, replace TCP with UDP. If an application needs both, create two rules.

Common pitfalls

  • Wrong protocol: Many game servers and TeamSpeak need UDP. A TCP rule alone does not help them.
  • Port open, still no connection: Check whether the service is listening at all: netstat -ano | findstr :25565. No output means the program is not running or uses a different port.
  • Locked out after a firewall change: If you blocked RDP by mistake, log in via VNC and fix the rule.