Manage Windows 11 Firewall for Game and Web Servers

Hosting a dedicated game server or a local web application on Windows 11 requires allowing external incoming traffic through the operating system’s built-in security layers. This guide provides a direct, step-by-step walkthrough on how to manage, create, and secure custom inbound firewall rules using both the Windows Defender Firewall interface and PowerShell, ensuring your services are reachable without compromising your local network security.

Step 1: Open Advanced Firewall Settings

While the basic Windows 11 Settings app allows simple toggle switches, managing specific ports and protocols requires the Advanced Security console.

1. Press Win + R to open the Run dialog box.
2. Type wf.msc and press Enter (or search for Windows Defender Firewall with Advanced Security in the Start menu).

Step 2: Create a New Inbound Rule

1. In the left navigation pane of the firewall console, click on Inbound Rules.
2. In the right Actions pane, select New Rule… to launch the setup wizard.

Step 3: Choose the Rule Type

• Port (Recommended): Choose this option if your server or application relies on a static port (e.g., port 80/3000/8080 for web apps, or port 25565/27015 for game servers).
• Program: Choose this option if your application dynamically shifts ports or if you prefer to grant network permissions directly to the application’s executable file (.exe).

Select Port and click Next.

Step 4: Specify Protocol and Ports

1. Select the required transport protocol:
   • TCP: Used by standard web servers (Node.js, Apache, Nginx, Python Flask/Django).
   • UDP: Commonly used by real-time game servers (Valheim, Rust, Minecraft Bedrock) for lower latency.
   • Note: If your game requires both, you can create two separate rules or select both if prompted.
2. Select Specific local ports and enter the port number (e.g., 8080) or a port range (e.g., 27015-27020).
3. Click Next.

Step 5: Configure the Action and Network Profile

1. Choose Allow the connection and click Next.
2. Select the network profiles where this rule applies:
   • Domain: For corporate or Active Directory networks.
   • Private: Recommended for home and secure local networks.
   • Public: Applies when connected to untrusted public Wi-Fi. It is safest to leave this unchecked unless strictly necessary.
3. Click Next.

Step 6: Name and Finalize the Rule

1. Provide a clear and descriptive name (e.g., Minecraft Server - TCP 25565 or Local React Dev - Port 3000).
2. Add a description specifying the software and reason for the rule for easier maintenance later.
3. Click Finish.

Quick Method: Add Rules via PowerShell

For faster management, you can create inbound rules using an elevated PowerShell terminal (Run as Administrator).

Allow a TCP Web Port (e.g., Port 8080):

New-NetFirewallRule -DisplayName "Local Web App - 8080" -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow -Profile Private

Allow a UDP Game Server Port (e.g., Port 27015):

New-NetFirewallRule -DisplayName "Game Server - 27015" -Direction Inbound -LocalPort 27015 -Protocol UDP -Action Allow -Profile Private

Modifying and Securing Inbound Rules

• Restricting Access by IP Address: To limit server access to specific friends or local devices, open your rule in wf.msc, navigate to the Scope tab, go to Remote IP address, select These IP addresses, and add the authorized IP addresses.
• Disabling Rules: Instead of deleting a rule when a server is not in use, right-click the rule in the Inbound Rules list and select Disable Rule.
• Removing Rules: Right-click the rule and select Delete to completely remove the configuration.