Port Opening Guide on Windows VPS

Introduction

Opening ports on a Windows VPS is an essential step to allow applications and services to communicate with the outside world. This guide walks you through the complete Windows Firewall configuration to open necessary ports.

What is a Port?

A port is a virtual entry point on your server that allows applications to communicate over the network. Each service uses one or more specific ports:

• Port 80: HTTP (websites)
• Port 443: HTTPS (secure websites)
• Port 3389: Remote Desktop (RDP)
• Port 21: FTP
• Port 22: SSH
• Port 25565: Minecraft
• Port 27015: Source (CS:GO, etc.)

Prerequisites

Before starting, ensure you have:

• Administrator access to your Windows VPS
• Active Remote Desktop (RDP) connection
• Port numbers you want to open
• Protocol used (TCP, UDP, or both)

Part 1: Opening Ports via GUI

Method 1: Via Windows Defender Firewall

Step 1: Open Windows Firewall

Option A: Via Start Menu

1. Click the Start button
2. Type Windows Defender Firewall
3. Click Windows Defender Firewall with Advanced Security

Option B: Via Run

1. Press Windows + R
2. Type: wf.msc
3. Press Enter

Step 2: Create an Inbound Rule

Inbound traffic allows external connections to access your server.

1. In Windows Firewall, click Inbound Rules in the left panel
2. In the right panel, click New Rule...
3. Rule Type:
   • Select Port
   • Click Next
4. Protocol and Ports:
   • Select the protocol:
     • TCP: For most web applications and games
     • UDP: For games, VoIP, streaming
   • Select Specific local ports
   • Enter port number (example: 8080)
   • For multiple ports: 80,443,8080
   • For a range: 25565-25575
   • Click Next
5. Action:
   • Select Allow the connection
   • Click Next
6. Profile:
   • Check all three options:
     • ☑ Domain
     • ☑ Private
     • ☑ Public
   • Click Next
7. Name:
   • Name: Give a descriptive name (example: "HTTP Web Server")
   • Description: Add description (optional)
   • Click Finish

Step 3: Create an Outbound Rule (Optional)

Outbound traffic allows your server to connect externally.

1. Click Outbound Rules in the left panel
2. Follow the same steps as for inbound traffic

Note: By default, outbound traffic is generally allowed. This step is only necessary if you have specific restrictions.

Method 2: Via Windows Settings (Simplified)

For simpler configuration (Windows 10/11/Server 2019+):

Step 1: Open Firewall Settings

1. Click Start
2. Go to Settings (gear icon)
3. Click Network & Internet
4. Click Windows Defender Firewall
5. Click Advanced settings

You arrive at the same screen as Method 1.

Part 2: Opening Ports via PowerShell

PowerShell allows you to open ports quickly via commands.

Open PowerShell as Administrator

1. Click Start
2. Type PowerShell
3. Right-click Windows PowerShell
4. Select Run as administrator

Basic Commands

Open a TCP Port

New-NetFirewallRule -DisplayName "Rule Name" -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow

Example: Open port 80 (HTTP)

New-NetFirewallRule -DisplayName "HTTP Port 80" -Direction Inbound -LocalPort 80 -Protocol TCP -Action Allow

Open a UDP Port

New-NetFirewallRule -DisplayName "Rule Name" -Direction Inbound -LocalPort 27015 -Protocol UDP -Action Allow

Example: Open port 25565 (Minecraft)

New-NetFirewallRule -DisplayName "Minecraft Server" -Direction Inbound -LocalPort 25565 -Protocol UDP -Action Allow

Open TCP and UDP Port

To open the same port for both protocols:

New-NetFirewallRule -DisplayName "Port 25565 TCP" -Direction Inbound -LocalPort 25565 -Protocol TCP -Action Allow

New-NetFirewallRule -DisplayName "Port 25565 UDP" -Direction Inbound -LocalPort 25565 -Protocol UDP -Action Allow

Open Multiple Ports

To open multiple ports at once:

New-NetFirewallRule -DisplayName "Multiple Ports" -Direction Inbound -LocalPort 80,443,8080 -Protocol TCP -Action Allow

Open a Port Range

New-NetFirewallRule -DisplayName "FTP Passive Port Range" -Direction Inbound -LocalPort 49152-65535 -Protocol TCP -Action Allow

Advanced Commands

Allow Port for Specific IP

New-NetFirewallRule -DisplayName "SSH from specific IP" -Direction Inbound -LocalPort 22 -Protocol TCP -Action Allow -RemoteAddress 203.0.113.10

Allow Port for Specific Program

New-NetFirewallRule -DisplayName "Server Application" -Direction Inbound -Program "C:\MyServer\server.exe" -Action Allow

Create Rule with Specific Profile

New-NetFirewallRule -DisplayName "Public Port" -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow -Profile Public

Available profiles: Domain, Private, Public, or Any

Part 3: Common Configuration Examples

Web Server (HTTP/HTTPS)

Via PowerShell:

# HTTP
New-NetFirewallRule -DisplayName "HTTP Web Server" -Direction Inbound -LocalPort 80 -Protocol TCP -Action Allow

# HTTPS
New-NetFirewallRule -DisplayName "HTTPS Web Server" -Direction Inbound -LocalPort 443 -Protocol TCP -Action Allow

FTP Server

# FTP control port
New-NetFirewallRule -DisplayName "FTP Control" -Direction Inbound -LocalPort 21 -Protocol TCP -Action Allow

# FTP passive ports (standard range)
New-NetFirewallRule -DisplayName "FTP Passive Ports" -Direction Inbound -LocalPort 49152-65535 -Protocol TCP -Action Allow

Game Servers

Minecraft:

# Main port
New-NetFirewallRule -DisplayName "Minecraft TCP" -Direction Inbound -LocalPort 25565 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "Minecraft UDP" -Direction Inbound -LocalPort 25565 -Protocol UDP -Action Allow

# RCON port (optional)
New-NetFirewallRule -DisplayName "Minecraft RCON" -Direction Inbound -LocalPort 25575 -Protocol TCP -Action Allow

Rust:

# Main port
New-NetFirewallRule -DisplayName "Rust Server TCP" -Direction Inbound -LocalPort 28015 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "Rust Server UDP" -Direction Inbound -LocalPort 28015 -Protocol UDP -Action Allow

# RCON port
New-NetFirewallRule -DisplayName "Rust RCON" -Direction Inbound -LocalPort 28016 -Protocol TCP -Action Allow

Counter-Strike/Source:

New-NetFirewallRule -DisplayName "Source Server TCP" -Direction Inbound -LocalPort 27015 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "Source Server UDP" -Direction Inbound -LocalPort 27015 -Protocol UDP -Action Allow

Database Servers

MySQL/MariaDB:

New-NetFirewallRule -DisplayName "MySQL Server" -Direction Inbound -LocalPort 3306 -Protocol TCP -Action Allow

PostgreSQL:

New-NetFirewallRule -DisplayName "PostgreSQL Server" -Direction Inbound -LocalPort 5432 -Protocol TCP -Action Allow

MongoDB:

New-NetFirewallRule -DisplayName "MongoDB Server" -Direction Inbound -LocalPort 27017 -Protocol TCP -Action Allow

Email Server

SMTP:

New-NetFirewallRule -DisplayName "SMTP" -Direction Inbound -LocalPort 25 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "SMTP Submission" -Direction Inbound -LocalPort 587 -Protocol TCP -Action Allow

IMAP:

New-NetFirewallRule -DisplayName "IMAP" -Direction Inbound -LocalPort 143 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "IMAPS" -Direction Inbound -LocalPort 993 -Protocol TCP -Action Allow

POP3:

New-NetFirewallRule -DisplayName "POP3" -Direction Inbound -LocalPort 110 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "POP3S" -Direction Inbound -LocalPort 995 -Protocol TCP -Action Allow

Part 4: Managing Existing Rules

List All Rules

Get-NetFirewallRule | Select-Object DisplayName, Direction, Action, Enabled | Format-Table

List Rules for Specific Port

Get-NetFirewallRule | Where-Object {$_.LocalPort -eq 8080}

Search Rule by Name

Get-NetFirewallRule -DisplayName "Minecraft*"

Enable a Disabled Rule

Enable-NetFirewallRule -DisplayName "Rule Name"

Disable a Rule

Disable-NetFirewallRule -DisplayName "Rule Name"

Delete a Rule

Remove-NetFirewallRule -DisplayName "Rule Name"

Modify Existing Rule

Set-NetFirewallRule -DisplayName "Rule Name" -LocalPort 9090

Part 5: Verifying Open Ports

Check if Port is Open

Via PowerShell (Local Connection Test)

Test-NetConnection -ComputerName localhost -Port 8080

If port is open, you'll see:

TcpTestSucceeded : True

Via CMD (Netstat)

netstat -an | findstr :8080

If port is listening, you'll see a line like:

TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING

Check from Outside

Online Tools

Use these sites to test your port accessibility from Internet:

• CanYouSeeMe: https://canyouseeme.org/
• PortChecker: https://portchecker.co/
• YouGetSignal: https://www.yougetsignal.com/tools/open-ports/

1. Enter your VPS public IP
2. Enter the port number
3. Click Check

Via Telnet (from another PC)

telnet YOUR_VPS_IP 8080

If connection succeeds, port is open.

Part 6: Security and Best Practices

Security Principles

1. Only open necessary ports
   • Each open port is a potential risk
   • Close unused ports
2. Use non-standard ports (optional)
   • Change default ports (e.g., SSH on 2222 instead of 22)
   • Reduces automated attacks
3. Limit access by IP when possible
   • Restrict access to trusted IPs
   • Example: RDP only from your IP
4. Always use encryption
   • HTTPS instead of HTTP
   • SFTP instead of FTP
   • SSL/TLS for databases

IP Address Restriction

To allow a port only from certain IPs:

New-NetFirewallRule -DisplayName "Secure RDP" -Direction Inbound -LocalPort 3389 -Protocol TCP -Action Allow -RemoteAddress 203.0.113.10,198.51.100.20

Rate Limiting

Windows doesn't have native rate limiting in firewall, but you can:

1. Use third-party tools like PeerBlock
2. Configure Windows Defender Advanced Threat Protection
3. Use hardware or third-party software firewall

Logging

To enable connection logging:

1. Open Windows Defender Firewall with Advanced Security
2. Right-click Windows Defender Firewall with Advanced Security (Local Computer)
3. Select Properties
4. For each profile (Domain, Private, Public):
   • Click the tab
   • Logging section, click Customize
   • Set:
     • Log dropped packets: Yes
     • Log successful connections: Yes
     • Size limit: 4096 KB (or more)
   • Note the log file location
5. View logs at:

   C:\Windows\System32\LogFiles\Firewall\pfirewall.log
   

Part 7: Useful PowerShell Scripts

Script to Open Multiple Ports

Create a file open-ports.ps1:

# Multiple port opening script

# Define ports to open
$ports = @(
    @{Name="HTTP"; Port=80; Protocol="TCP"},
    @{Name="HTTPS"; Port=443; Protocol="TCP"},
    @{Name="FTP"; Port=21; Protocol="TCP"},
    @{Name="Minecraft"; Port=25565; Protocol="TCP"},
    @{Name="Minecraft"; Port=25565; Protocol="UDP"}
)

# Open each port
foreach ($port in $ports) {
    $ruleName = "$($port.Name) - Port $($port.Port) $($port.Protocol)"
    
    Write-Host "Opening port $($port.Port) ($($port.Protocol)) for $($port.Name)..." -ForegroundColor Green
    
    New-NetFirewallRule -DisplayName $ruleName `
                        -Direction Inbound `
                        -LocalPort $port.Port `
                        -Protocol $port.Protocol `
                        -Action Allow `
                        -ErrorAction SilentlyContinue
}

Write-Host "All ports opened successfully!" -ForegroundColor Cyan

Execute it:

.\open-ports.ps1

Script to Close All Non-Essential Ports

# List custom rules
$rules = Get-NetFirewallRule | Where-Object {$_.DisplayName -notlike "Core*" -and $_.DisplayName -notlike "@*"}

# Display and disable
foreach ($rule in $rules) {
    Write-Host "Disabling: $($rule.DisplayName)" -ForegroundColor Yellow
    Disable-NetFirewallRule -DisplayName $rule.DisplayName
}

Write-Host "Done!" -ForegroundColor Green

Port Verification Script

# List of ports to check
$ports = @(80, 443, 3389, 25565)
$hostname = "localhost"

Write-Host "Checking ports on $hostname..." -ForegroundColor Cyan

foreach ($port in $ports) {
    $result = Test-NetConnection -ComputerName $hostname -Port $port -WarningAction SilentlyContinue
    
    if ($result.TcpTestSucceeded) {
        Write-Host "Port $port : OPEN" -ForegroundColor Green
    } else {
        Write-Host "Port $port : CLOSED" -ForegroundColor Red
    }
}

Part 8: Troubleshooting

Port is Open but Inaccessible

Checks:

1. Application not starting
   • Verify your application is listening on correct port
   • Use netstat -an | findstr :PORT
2. Hosting provider firewall
   • Some providers have their own firewall
   • Check your VPS hosting panel
3. Port already in use

   Get-Process -Id (Get-NetTCPConnection -LocalPort 8080).OwningProcess
   

4. Listening on wrong interface
   • Check application listens on 0.0.0.0 not 127.0.0.1

"Cannot Create Rule" Error

Solutions:

1. Run PowerShell as administrator
2. Check if rule with same name exists:

   Get-NetFirewallRule -DisplayName "Rule Name"
   

3. Delete existing rule if necessary:

   Remove-NetFirewallRule -DisplayName "Rule Name"
   

Rules Don't Apply

Solutions:

1. Restart firewall service:

   Restart-Service mpssvc
   

2. Check firewall is enabled:

   Get-NetFirewallProfile | Select-Object Name, Enabled
   

3. Enable firewall if needed:

   Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
   

Port Open but Slow Connection

Possible causes:

1. Bandwidth issue
   • Check VPS network usage
2. Incorrect MTU
   • Test different MTU sizes
3. High latency
   • Use ping to check latency

Part 9: Advanced Configuration

Create Rule Groups

To organize your rules:

# Create multiple rules with same group
New-NetFirewallRule -DisplayName "Web Server HTTP" -Direction Inbound -LocalPort 80 -Protocol TCP -Action Allow -Group "Web Servers"

New-NetFirewallRule -DisplayName "Web Server HTTPS" -Direction Inbound -LocalPort 443 -Protocol TCP -Action Allow -Group "Web Servers"

Enable/Disable a Group

# Disable all web servers
Get-NetFirewallRule -Group "Web Servers" | Disable-NetFirewallRule

# Re-enable
Get-NetFirewallRule -Group "Web Servers" | Enable-NetFirewallRule

Service-Based Rules

Allow specific Windows service:

New-NetFirewallRule -DisplayName "Remote Desktop" -Direction Inbound -Service TermService -Action Allow

Default Block with Exceptions

For highly secure server:

1. Block all inbound traffic by default
2. Allow only necessary services

# Block all inbound traffic
Set-NetFirewallProfile -Profile Public,Private,Domain -DefaultInboundAction Block

# Allow only RDP and Web
New-NetFirewallRule -DisplayName "RDP Allowed" -Direction Inbound -LocalPort 3389 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "HTTPS Allowed" -Direction Inbound -LocalPort 443 -Protocol TCP -Action Allow

Part 10: Third-Party Tools

Advanced Firewall Software

For additional features:

1. GlassWire
   • Intuitive GUI
   • Real-time monitoring
   • Connection alerts
2. TinyWall
   • Lightweight and free
   • Simplified Windows firewall interface
   • Learning mode
3. ZoneAlarm
   • Advanced protection
   • Intrusion detection
   • Free version available

Port Testing Tools

1. Nmap (from another PC)

   nmap -p 80,443,8080 YOUR_VPS_IP
   

2. PortQry (Microsoft)
   • Download from Microsoft
   • Tests ports locally and remotely
3. PsPing (Sysinternals)
   • Advanced latency and bandwidth testing

   psping YOUR_VPS_IP:8080
   

Quick Reference Commands

Creating Rules

# TCP Inbound
New-NetFirewallRule -DisplayName "Name" -Direction Inbound -LocalPort PORT -Protocol TCP -Action Allow

# UDP Inbound
New-NetFirewallRule -DisplayName "Name" -Direction Inbound -LocalPort PORT -Protocol UDP -Action Allow

# TCP Outbound
New-NetFirewallRule -DisplayName "Name" -Direction Outbound -LocalPort PORT -Protocol TCP -Action Allow

# Multiple ports
New-NetFirewallRule -DisplayName "Name" -Direction Inbound -LocalPort 80,443,8080 -Protocol TCP -Action Allow

# Port range
New-NetFirewallRule -DisplayName "Name" -Direction Inbound -LocalPort 5000-5100 -Protocol TCP -Action Allow

# Specific IP
New-NetFirewallRule -DisplayName "Name" -Direction Inbound -LocalPort PORT -Protocol TCP -Action Allow -RemoteAddress IP

Managing Rules

# List all rules
Get-NetFirewallRule

# Search rule
Get-NetFirewallRule -DisplayName "Name*"

# Enable rule
Enable-NetFirewallRule -DisplayName "Name"

# Disable rule
Disable-NetFirewallRule -DisplayName "Name"

# Delete rule
Remove-NetFirewallRule -DisplayName "Name"

# Modify rule
Set-NetFirewallRule -DisplayName "Name" -LocalPort NEW_PORT

Verification

# Test port locally
Test-NetConnection -ComputerName localhost -Port PORT

# View listening ports
netstat -an | findstr LISTENING

# See which process uses port
Get-Process -Id (Get-NetTCPConnection -LocalPort PORT).OwningProcess

Additional Resources

Microsoft Documentation

• Windows Firewall: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/
• NetSecurity PowerShell: https://docs.microsoft.com/en-us/powershell/module/netsecurity/
• Windows Server Security: https://docs.microsoft.com/en-us/windows-server/security/

Community and Forums

• Microsoft Tech Community: https://techcommunity.microsoft.com/
• Stack Overflow: Tag windows-firewall
• Reddit: r/sysadmin

Conclusion

You now know how to open and manage ports on your Windows VPS! Essential points to remember:

Basic Configuration:

• Use Windows Defender Firewall with Advanced Security
• Create inbound rules for each port
• Name rules clearly for easy management

Security:

• Only open strictly necessary ports
• Limit access by IP when possible
• Enable logging to monitor connections
• Use encrypted protocols (HTTPS, SFTP, etc.)

Maintenance:

• Regularly check open ports
• Remove obsolete rules
• Test service accessibility
• Monitor firewall logs

Good configuration on your Windows VPS!