Windows Server 2019: How to Allow an Application Through Windows Firewall

This guide explains how to allow an application through Windows Firewall on Windows Server 2019.

You can create firewall rules using either the graphical interface (wf.msc) or PowerShell.

Important: Administrator privileges are required.

Contents

1. Before You Begin
2. Method 1 — Using Windows Firewall GUI
3. Method 2 — Using PowerShell
4. Create a Firewall Rule for a Port
5. Verify the Firewall Configuration
6. Windows Defender Exclusions
7. Troubleshooting

1. Before You Begin

Before creating firewall rules:

• Make sure you are logged in with an account that has Administrator privileges.
• Find the full path to the application’s executable file.

For example:

C:\Program Files\MyApp\myapp.exe

If the server is joined to a Windows domain, Group Policy may control the firewall configuration and override local settings.

2. Method 1 — Using Windows Firewall GUI

Step 1. Open Windows Defender Firewall with Advanced Security

Press:

Win + R

Enter:

wf.msc

Press Enter.

The Windows Defender Firewall with Advanced Security window will open.

Step 2. Create a New Inbound Rule

In the left panel, select:

Inbound Rules

Then click:

New Rule…

Step 3. Select the Rule Type

Select:

Program

Click Next.

Step 4. Select the Application

Select:

This program path

Enter the full path to the application’s executable file.

For example:

C:\Program Files\MyApp\myapp.exe

Click Next.

Step 5. Allow the Connection

Select:

Allow the connection

Click Next.

Step 6. Select Network Profiles

Select the profiles where the rule should apply:

• Domain
• Private
• Public

Select only the profiles required for your server configuration.

Click Next.

Step 7. Name the Rule

Enter a descriptive name.

For example:

Allow MyApp (Inbound)

Click Finish.

The application is now allowed to accept incoming connections through Windows Firewall.

Create an Outbound Rule

If your firewall configuration also restricts outgoing connections, you can create an outbound rule.

Select:

Outbound Rules → New Rule…

Then repeat the same steps and select the application’s executable file.

3. Method 2 — Using PowerShell

You can create the same firewall rules using PowerShell.

Open PowerShell as Administrator.

To allow incoming connections for a specific application:

New-NetFirewallRule `
    -DisplayName "Allow MyApp Inbound" `
    -Direction Inbound `
    -Program "C:\Program Files\MyApp\myapp.exe" `
    -Action Allow

To allow outgoing connections for the application:

New-NetFirewallRule `
    -DisplayName "Allow MyApp Outbound" `
    -Direction Outbound `
    -Program "C:\Program Files\MyApp\myapp.exe" `
    -Action Allow

Replace:

C:\Program Files\MyApp\myapp.exe

with the actual path to your application.

Limit the Rule to Specific Network Profiles

You can use the -Profile parameter.

For example:

New-NetFirewallRule `
    -DisplayName "Allow MyApp Inbound" `
    -Direction Inbound `
    -Program "C:\Program Files\MyApp\myapp.exe" `
    -Profile Domain,Private `
    -Action Allow

4. Create a Firewall Rule for a Port

If the application listens on a specific port, you can create a firewall rule for that port instead of the executable file.

For example, to allow incoming TCP connections on port 8080:

New-NetFirewallRule `
    -DisplayName "Allow TCP 8080 (Inbound)" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 8080 `
    -Action Allow

Replace 8080 with the port required by your application.

For UDP, use:

-Protocol UDP

For example:

New-NetFirewallRule `
    -DisplayName "Allow UDP 8080 (Inbound)" `
    -Direction Inbound `
    -Protocol UDP `
    -LocalPort 8080 `
    -Action Allow

5. Verify the Firewall Configuration

Check the Firewall Rule

To find rules containing the application name:

Get-NetFirewallRule | Where-Object DisplayName -like "*MyApp*"

Check Whether the Application Is Listening on the Port

For example, to check TCP port 8080:

netstat -ano | findstr :8080

You can also use PowerShell:

Get-NetTCPConnection -LocalPort 8080

Test the Port from Another Computer

From another Windows machine, run:

Test-NetConnection -ComputerName <server-ip-or-name> -Port 8080

Replace:

<server-ip-or-name>

with the IP address or hostname of your server.

If the connection is successful, you should see:

TcpTestSucceeded : True

6. Windows Defender Exclusions

Windows Firewall and Microsoft Defender Antivirus are separate components.

If the firewall rule is configured correctly but Microsoft Defender Antivirus is blocking your application, you can add an exclusion.

Important: Add exclusions only for applications you trust. Antivirus exclusions reduce security for the selected files or folders.

Add a Folder Exclusion

Add-MpPreference -ExclusionPath "C:\Program Files\MyApp"

Add a Process Exclusion

Add-MpPreference -ExclusionProcess "C:\Program Files\MyApp\myapp.exe"

Check Current Exclusions

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

If another antivirus product is installed, Microsoft Defender commands may not apply to your configuration.

7. Troubleshooting

The Rule Cannot Be Created

Make sure PowerShell or wf.msc is running with Administrator privileges.

Firewall Rules Disappear or Are Replaced

If the server belongs to a Windows domain, firewall settings may be controlled through Group Policy.

In this case, local firewall rules may be overridden by domain policies.

The Port Is Open but the Connection Still Fails

Make sure the application is actually listening on the expected port.

Check with:

netstat -ano | findstr :8080

or:

Get-NetTCPConnection -LocalPort 8080

Also check whether traffic is being blocked by:

• An external firewall
• A provider-side firewall
• A network ACL
• NAT configuration
• A router or gateway
• A load balancer

Allow Access Only from Specific IP Addresses

For better security, you can restrict a firewall rule to trusted remote IP addresses.

For example:

New-NetFirewallRule `
    -DisplayName "Allow MyApp from Trusted IP" `
    -Direction Inbound `
    -Program "C:\Program Files\MyApp\myapp.exe" `
    -RemoteAddress "203.0.113.10" `
    -Action Allow

You can also specify a subnet:

-RemoteAddress "203.0.113.0/24"

Remove a Firewall Rule

To remove a rule by its display name:

Remove-NetFirewallRule -DisplayName "Allow MyApp Inbound"

Conclusion

For most applications, you only need to create an Inbound Rule for the program or the port it listens on.

If your server uses restrictive outbound firewall policies, you may also need an Outbound Rule.

For better security, avoid opening unnecessary ports to the entire Internet and restrict access to trusted IP addresses whenever possible.