Logo
LogoClient Area
KVM SSD VPSKVM NVMe VPSKVM Ryzen VPSNewWindows VPSDedicated ServersColocation · HousingMinecraftGarry's ModFiveMRustWebDocsAboutLegal Notices
Logo
12 min read Easy 33.9k

ICMP (Ping) Activation Guide on Windows VPS

Published on November 11, 2025 at 02:56 PM
ICMP (Ping) Activation Guide on Windows VPS

Complete ICMP (ping) protocol activation guide on Windows VPS via Windows Defender Firewall. This tutorial details activation via GUI and PowerShell, custom rule creation for IPv4/IPv6, IP restriction, and specific use cases (monitoring, VPN, internal network).

ICMP (Ping) Activation Guide on Windows VPS

Introduction

ICMP (Internet Control Message Protocol) is an essential network protocol used to diagnose connectivity issues. The most well-known ICMP function is the ping command, which checks if a server is reachable on the network.

By default, Windows Server blocks incoming ICMP requests as a security measure. This guide shows you how to enable ICMP on your Windows VPS.

What is ICMP?

ICMP is used for:

  • Ping: Check server availability
  • Traceroute: Trace network path to destination
  • Network diagnostics: Identify connectivity issues
  • Error messages: Report routing problems

Why is ICMP Blocked by Default?

Windows Server blocks ICMP to:

  • Prevent DDoS attacks via ping flood
  • Hide server presence from scanners
  • Reduce attack surface

When to Enable ICMP?

Enable ICMP if you need to:

  • Monitor server availability
  • Diagnose network issues
  • Use monitoring tools (Nagios, Zabbix, etc.)
  • Test connectivity easily

Part 1: Activation via GUI

Method 1: Via Windows Defender Firewall

Step 1: Open Windows Firewall

  1. Press Windows + R
  2. Type: wf.msc
  3. Press Enter

You open Windows Defender Firewall with Advanced Security.

Step 2: Enable Existing ICMP Rule

Windows already has preconfigured ICMP rules, just enable them.

  1. In the left panel, click Inbound Rules
  2. Look for these rules:
    • File and Printer Sharing (Echo Request - ICMPv4-In)
    • File and Printer Sharing (Echo Request - ICMPv6-In)
  3. For each rule:
    • Right-click on the rule
    • Select Enable Rule
    • The rule turns green (enabled)
  4. You can also double-click the rule to see its settings:
    • Verify Action is set to Allow the connection
    • Verify profiles are checked (Domain, Private, Public)

Step 3: Verification

Test from another PC:

ping YOUR_VPS_IP

You should receive responses:

Reply from YOUR_VPS_IP: bytes=32 time=15ms TTL=128

Method 2: Create New ICMP Rule

If preconfigured rules don't exist or don't work:

Step 1: Create Custom Rule

  1. In Windows Firewall, click Inbound Rules
  2. In the right panel, click New Rule...
  3. Rule Type:
    • Select Custom
    • Click Next
  4. Program:
    • Select All programs
    • Click Next
  5. Protocol and ports:
    • Protocol type: Select ICMPv4
    • Click Customize
    • Select Specific ICMP types
    • Check Echo Request
    • Click OK
    • Click Next
  6. Scope:
    • Local IP addresses: Any IP address
    • Remote IP addresses: Any IP address (or specify IPs)
    • Click Next
  7. Action:
    • Select Allow the connection
    • Click Next
  8. Profile:
    • Check:
      • ☑ Domain
      • ☑ Private
      • ☑ Public
    • Click Next
  9. Name:
    • Name: ICMP Echo Request (Ping)
    • Description: Allow incoming ping requests
    • Click Finish

Step 2: Repeat for IPv6 (Optional)

If using IPv6, create a similar rule with ICMPv6.

Part 2: Activation via PowerShell

PowerShell offers a quick and automatable method to enable ICMP.

Open PowerShell as Administrator

  1. Click Start
  2. Type PowerShell
  3. Right-click Windows PowerShell
  4. Select Run as administrator

Activation Commands

Enable Preconfigured ICMP Rules

# Enable ICMP for IPv4
Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"

# Enable ICMP for IPv6
Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv6-In)"

Create New ICMP Rule

If rules don't exist:

For IPv4:

New-NetFirewallRule -DisplayName "ICMP Allow incoming V4 echo request" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow

For IPv6:

New-NetFirewallRule -DisplayName "ICMP Allow incoming V6 echo request" -Protocol ICMPv6 -IcmpType 128 -Direction Inbound -Action Allow

Enable ICMP for All Profiles

New-NetFirewallRule -DisplayName "Allow ICMP Ping" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -Action Allow -Profile Any

Verification Commands

Verify Rule is Enabled

Get-NetFirewallRule -DisplayName "*echo*" | Select-Object DisplayName, Enabled, Direction, Action

You should see:

DisplayName                                                     Enabled Direction Action
-----------                                                     ------- --------- ------
File and Printer Sharing (Echo Request - ICMPv4-In)            True    Inbound   Allow

List All ICMP Rules

Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*ICMP*"} | Format-Table DisplayName, Enabled, Action

Part 3: Activation via CMD (Netsh)

Alternative method using netsh tool.

Open CMD as Administrator

  1. Click Start
  2. Type cmd
  3. Right-click Command Prompt
  4. Select Run as administrator

Netsh Commands

Enable ICMP for IPv4

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

Enable ICMP for IPv6

netsh advfirewall firewall add rule name="ICMP Allow incoming V6 echo request" protocol=icmpv6:128,any dir=in action=allow

Enable for All Profiles

netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow

Verify Netsh Rules

netsh advfirewall firewall show rule name=all | findstr ICMP

Part 4: Advanced Configuration

Allow ICMP Only for Specific IPs

For security reasons, you can limit pings to certain IP addresses.

Via PowerShell

New-NetFirewallRule -DisplayName "ICMP from Monitoring Server" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow -RemoteAddress 203.0.113.10,198.51.100.20

Via GUI

  1. Create an ICMP rule as described previously
  2. At the Scope step:
    • Remote IP addresses: Select These IP addresses
    • Click Add
    • Enter allowed IP addresses
    • Click OK

Limit ICMP to Certain Network Profiles

To allow ICMP only on private network:

New-NetFirewallRule -DisplayName "ICMP Private Only" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow -Profile Private

Available ICMP Types

ICMPv4 Types

  • Type 0: Echo Reply (ping response)
  • Type 3: Destination Unreachable
  • Type 5: Redirect
  • Type 8: Echo Request (ping)
  • Type 11: Time Exceeded
  • Type 12: Parameter Problem

ICMPv6 Types

  • Type 1: Destination Unreachable
  • Type 2: Packet Too Big
  • Type 3: Time Exceeded
  • Type 128: Echo Request (ping)
  • Type 129: Echo Reply
New-NetFirewallRule -DisplayName "All ICMP Types" -Protocol ICMPv4 -Direction Inbound -Action Allow

Warning: Allowing all ICMP types can expose your server to certain attacks.

Part 5: Testing and Verification

Test from Local Windows

Open CMD or PowerShell:

ping YOUR_VPS_IP

Expected result:

Pinging YOUR_VPS_IP with 32 bytes of data:
Reply from YOUR_VPS_IP: bytes=32 time=15ms TTL=128
Reply from YOUR_VPS_IP: bytes=32 time=14ms TTL=128
Reply from YOUR_VPS_IP: bytes=32 time=16ms TTL=128
Reply from YOUR_VPS_IP: bytes=32 time=15ms TTL=128

Ping statistics for YOUR_VPS_IP:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 14ms, Maximum = 16ms, Average = 15ms

Test from Linux/Mac

ping YOUR_VPS_IP

Expected result:

PING YOUR_VPS_IP (123.45.67.89): 56 data bytes
64 bytes from 123.45.67.89: icmp_seq=0 ttl=128 time=15.2 ms
64 bytes from 123.45.67.89: icmp_seq=1 ttl=128 time=14.8 ms
64 bytes from 123.45.67.89: icmp_seq=2 ttl=128 time=15.5 ms

Test via Online Tools

Use these services to test from outside:

  1. Enter your VPS IP
  2. Click Ping or Test
  3. Check results

Verify Rule in Firewall

Via PowerShell

Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*ICMP*" -or $_.DisplayName -like "*echo*"} | Select-Object DisplayName, Enabled, Direction, Action | Format-Table

Via GUI

  1. Open Windows Firewall (wf.msc)
  2. Go to Inbound Rules
  3. Look for ICMP rules
  4. Verify they are enabled (green icon)

Part 6: Disabling ICMP

If you want to disable ICMP later:

Via PowerShell

# Disable preconfigured rules
Disable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"
Disable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv6-In)"

# Or remove custom rules
Remove-NetFirewallRule -DisplayName "ICMP Allow incoming V4 echo request"

Via GUI

  1. Open Windows Firewall
  2. Go to Inbound Rules
  3. Find ICMP rules
  4. Right-click > Disable Rule

Or:

  1. Right-click > Delete

Via CMD (Netsh)

netsh advfirewall firewall delete rule name="ICMP Allow incoming V4 echo request"

Part 7: Security and Best Practices

Security Risks

Enabling ICMP can expose your server to:

  1. Ping Flood (DDoS)
    • Attack by flooding ping requests
    • Can slow down or block server
  2. Network Reconnaissance
    • Attackers can identify active servers
    • Facilitates network scanning
  3. Information Leakage
    • TTL and response time can reveal OS
    • Can help with network mapping

Security Recommendations

1. Limit by IP

Only allow trusted IPs:

New-NetFirewallRule -DisplayName "ICMP Monitoring Only" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow -RemoteAddress 203.0.113.10

2. Use Network Profiles

Enable ICMP only on private networks:

New-NetFirewallRule -DisplayName "ICMP Private Network" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow -Profile Private

3. Enable Logging

To monitor ICMP requests:

  1. Open Windows Firewall with Advanced Security
  2. Right-click Windows Defender Firewall
  3. Select Properties
  4. In each profile, Logging > Customize
  5. Enable Log successful connections

4. Rate Limiting

Windows doesn't have native rate limiting for ICMP, but you can:

  • Use third-party tools
  • Configure hardware router/firewall
  • Use Windows Defender Advanced Threat Protection

5. Active Monitoring

Monitor logs to detect:

  • Abnormal number of ping requests
  • Requests from suspicious IPs
  • Attack patterns

For production server:

# Allow ICMP only from monitoring network
New-NetFirewallRule -DisplayName "ICMP from Monitoring" `
                    -Protocol ICMPv4 `
                    -IcmpType 8 `
                    -Direction Inbound `
                    -Action Allow `
                    -RemoteAddress 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 `
                    -Profile Private,Domain

# Block ICMP from Internet (Public profile)
New-NetFirewallRule -DisplayName "Block ICMP Public" `
                    -Protocol ICMPv4 `
                    -IcmpType 8 `
                    -Direction Inbound `
                    -Action Block `
                    -Profile Public

Part 8: Troubleshooting

ICMP Still Doesn't Work

Checks:

1. Verify Rules are Enabled

Get-NetFirewallRule -DisplayName "*echo*" | Select-Object DisplayName, Enabled

Ensure Enabled is True.

2. Check Firewall Service

Get-Service mpssvc

Service must be Running. If not:

Start-Service mpssvc

3. Check Network Profiles

Get-NetFirewallProfile | Select-Object Name, Enabled

Profiles must be enabled.

4. Hosting Provider Firewall

Some VPS providers have their own firewall:

  • Check hosting provider control panel
  • Allow ICMP in external firewall

5. Conflicting Rules

Check there's no rule blocking ICMP:

Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*ICMP*" -and $_.Action -eq "Block"}

If a rule blocks, disable it:

Disable-NetFirewallRule -DisplayName "Rule Name"

Ping Works Locally but Not from Outside

Possible causes:

  1. Hosting provider firewall
    • Solution: Configure firewall in hosting panel
  2. NAT/Router
    • Solution: Check router configuration
  3. Incorrect network profile
    • Solution: Verify rule applies to Public profile

Slow ICMP Responses

Possible causes:

  1. High network latency
    • Normal if server is geographically distant
  2. High server load
    • Check CPU/RAM usage
  3. Network issue
    • Test with tracert YOUR_VPS_IP to see path

Part 9: Automated Scripts

Complete PowerShell Script

Create file enable-icmp.ps1:

# ICMP activation script for Windows Server
# Author: VeryCloud
# Date: 2024

Write-Host "=== Enabling ICMP on Windows Server ===" -ForegroundColor Cyan
Write-Host ""

# Check administrator privileges
if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Host "ERROR: This script must be run as administrator!" -ForegroundColor Red
    exit
}

# Function to create ICMP rule
function Enable-ICMPRule {
    param(
        [string]$DisplayName,
        [string]$Protocol,
        [int]$IcmpType
    )
    
    $existingRule = Get-NetFirewallRule -DisplayName $DisplayName -ErrorAction SilentlyContinue
    
    if ($existingRule) {
        Write-Host "Enabling existing rule: $DisplayName" -ForegroundColor Yellow
        Enable-NetFirewallRule -DisplayName $DisplayName
    } else {
        Write-Host "Creating new rule: $DisplayName" -ForegroundColor Green
        New-NetFirewallRule -DisplayName $DisplayName `
                            -Protocol $Protocol `
                            -IcmpType $IcmpType `
                            -Direction Inbound `
                            -Action Allow `
                            -Profile Any
    }
}

# Enable ICMP for IPv4
Enable-ICMPRule -DisplayName "ICMP Echo Request IPv4" -Protocol "ICMPv4" -IcmpType 8

# Enable ICMP for IPv6
Enable-ICMPRule -DisplayName "ICMP Echo Request IPv6" -Protocol "ICMPv6" -IcmpType 128

Write-Host ""
Write-Host "=== ICMP Rules Verification ===" -ForegroundColor Cyan
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*ICMP*" -or $_.DisplayName -like "*echo*"} | Select-Object DisplayName, Enabled, Action | Format-Table

Write-Host ""
Write-Host "ICMP enabled successfully!" -ForegroundColor Green
Write-Host "Test with: ping $env:COMPUTERNAME" -ForegroundColor Cyan

Execute it:

.\enable-icmp.ps1

Script to Disable ICMP

Create disable-icmp.ps1:

# ICMP disabling script

Write-Host "Disabling ICMP..." -ForegroundColor Yellow

# Disable all ICMP rules
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*ICMP*" -or $_.DisplayName -like "*echo*"} | Disable-NetFirewallRule

Write-Host "ICMP disabled!" -ForegroundColor Green

Part 10: Specific Use Cases

For Monitoring Servers

If using monitoring tools (Nagios, Zabbix, PRTG):

# Allow ICMP only from monitoring servers
$monitoringServers = @("10.0.0.50", "10.0.0.51", "10.0.0.52")

New-NetFirewallRule -DisplayName "ICMP from Monitoring Servers" `
                    -Protocol ICMPv4 `
                    -IcmpType 8 `
                    -Direction Inbound `
                    -Action Allow `
                    -RemoteAddress $monitoringServers

For Internal Network Only

# Allow ICMP only from local network
New-NetFirewallRule -DisplayName "ICMP LAN Only" `
                    -Protocol ICMPv4 `
                    -IcmpType 8 `
                    -Direction Inbound `
                    -Action Allow `
                    -RemoteAddress 192.168.0.0/16,10.0.0.0/8

For VPN Only

# Allow ICMP only from VPN interface
New-NetFirewallRule -DisplayName "ICMP VPN Only" `
                    -Protocol ICMPv4 `
                    -IcmpType 8 `
                    -Direction Inbound `
                    -Action Allow `
                    -InterfaceType RemoteAccess

Quick Reference Commands

Activation

# Enable existing rules
Enable-NetFirewallRule -DisplayName "*echo*"

# Create new IPv4 rule
New-NetFirewallRule -DisplayName "ICMP v4" -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow

# Create new IPv6 rule
New-NetFirewallRule -DisplayName "ICMP v6" -Protocol ICMPv6 -IcmpType 128 -Direction Inbound -Action Allow

Verification

# List ICMP rules
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*ICMP*"}

# Test locally
Test-NetConnection -ComputerName localhost -InformationLevel Detailed

# Classic ping
ping localhost

Disabling

# Disable rules
Disable-NetFirewallRule -DisplayName "*ICMP*"

# Remove rules
Remove-NetFirewallRule -DisplayName "ICMP v4"

Additional Resources

Microsoft Documentation

Testing Tools

Conclusion

You now know how to enable and manage ICMP on your Windows VPS!

Essential points to remember:

Activation:

  • Via GUI: Enable preconfigured rules
  • Via PowerShell: Enable-NetFirewallRule or New-NetFirewallRule
  • Test with: ping YOUR_VPS_IP

Security:

  • Limit access by IP when possible
  • Enable only on necessary profiles
  • Monitor logs to detect abuse
  • Disable if not needed

Usage:

  • Essential for monitoring
  • Useful for network diagnostics
  • Can be disabled in production for more security

Good configuration on your Windows server!

Join our Discord community server

For any questions, suggestions, or just to chat with the community, join us on Discord!

900+Members
Join the server
Terms & PoliciesAbout UsContact
© 2026 VeryCloud SAS v7.5.6bf8c7f
Home
Hosting
Gaming
Docs
Account