How to Scope Windows Defender Firewall Rules by Port and Protocol in Windows 11 Using PowerShell

While basic firewall management often focuses on enabling or disabling predefined rules, precise network security requires fine-tuning transport-layer parameters. In enterprise workstation management and secure development environments, firewall rules must restrict ingress and egress traffic to exact TCP and UDP port numbers, multi-port ranges, specific ICMP diagnostic codes, or dynamic Remote Procedure Call (RPC) interfaces. Misconfigured port rules either leave unnecessary listening ports exposed to the network or inadvertently block legitimate multi-channel communications.

In Windows 11, the native PowerShell NetSecurity module separates port and protocol filtering from general rule metadata through the Get-NetFirewallPortFilter and Set-NetFirewallPortFilter cmdlets. Through this dedicated filter object, administrators can bind rules to distinct local and remote ports, specify protocols beyond standard TCP and UDP, define ICMP type and code filters, and handle complex RPC dynamic endpoint allocation. This guide covers how to inspect port filter properties, define multi-port arrays, scope ICMP diagnostic traffic, and automate port filter configuration.

Understanding Port and Protocol Filters in Windows Filtering Platform

In the Windows Filtering Platform (WFP), a firewall rule relies on an underlying port filter object (NetFirewallPortFilter) to evaluate layer 4 transport headers:

• Protocol: Defines the transport protocol. Supported options include standard protocol names (such as TCP, UDP, ICMPv4, ICMPv6, GRE, L2TP) or raw numeric IANA protocol numbers (e.g., 50 for IPsec ESP or 51 for AH).
• LocalPort: The listening port on the local Windows machine for inbound rules, or the source ephemeral port for outbound rules. Supports individual port numbers, comma-separated lists, contiguous ranges (e.g., 8000-8080), or symbolic dynamic keywords (such as RPC, RPCEP, or IPHTTPS).
• RemotePort: The source port of connecting clients for inbound rules, or the destination port of remote services for outbound rules.
• IcmpType: When filtering ICMPv4 or ICMPv6 protocols, this parameter specifies allowable message types and codes (e.g., restricting ICMP to Echo Request type 8 while blocking redirect or router discovery messages).
• DynamicTransport: Controls whether traffic matching dynamic direct memory access or specialized transport protocols is permitted.

Querying Active Port Filters on Existing Rules

To inspect the port and protocol constraints of an existing firewall rule, open an elevated PowerShell prompt (Run as Administrator) and pipe Get-NetFirewallRule to Get-NetFirewallPortFilter:

# Inspect port filter attributes for the built-in Windows Remote Management rule
Get-NetFirewallRule -DisplayName "Windows Remote Management (HTTP-In)" | 
    Get-NetFirewallPortFilter

The resulting object displays active transport layer parameters:

Protocol      : TCP
LocalPort     : 5985
RemotePort    : Any
IcmpType      : Any
DynamicTarget : Any
PolicyStore   : PersistentStore

Notice that while LocalPort is constrained to 5985, RemotePort is set to Any, allowing clients connecting from dynamic ephemeral client ports to reach the service.

Updating Port and Protocol Scoping with Set-NetFirewallPortFilter

To update an existing firewall rule—such as modifying a development listener to support alternate ports or adding an administrative port range—pipe the rule object directly to Set-NetFirewallPortFilter.

For example, to update a custom web service rule to accept connections across both standard HTTP/HTTPS ports and an alternate development port:

# Update local port filter to multiple distinct ports and ranges
Get-NetFirewallRule -DisplayName "Custom-Web-Service" | 
    Get-NetFirewallPortFilter | 
    Set-NetFirewallPortFilter -Protocol TCP -LocalPort @("80", "443", "8080-8090")

To verify that the port filter was updated correctly:

# Verify updated local ports
(Get-NetFirewallRule -DisplayName "Custom-Web-Service" | Get-NetFirewallPortFilter).LocalPort

Filtering Specific ICMP Diagnostic Types

In security-conscious environments, administrators often allow network diagnostic pings (ICMP Echo Request) while blocking dangerous ICMP redirect or router advertisement messages that could be leveraged in spoofing attacks.

To configure an inbound ICMPv4 rule restricted exclusively to Echo Requests (Type 8):

# Create inbound ICMPv4 rule restricted strictly to Echo Request (Ping)
New-NetFirewallRule -DisplayName "Allow-ICMPv4-Ping-Only" `
    -Direction Inbound `
    -Action Allow `
    -Protocol ICMPv4 `
    -IcmpType 8 `
    -Profile Domain, Private

To allow both Echo Request (Type 8) and Time Exceeded (Type 11) for traceroute diagnostics:

# Update rule to permit Echo Request (8) and Time Exceeded (11)
Get-NetFirewallRule -DisplayName "Allow-ICMPv4-Ping-Only" | 
    Get-NetFirewallPortFilter | 
    Set-NetFirewallPortFilter -IcmpType @("8:*", "11:*")

The *:* syntax represents Type:Code, allowing all sub-codes for the specified ICMP message type.

Managing Dynamic RPC and Endpoint Mapper Ports

Microsoft Remote Procedure Call (RPC) services present a unique challenge for stateful firewalls. Clients first connect to the RPC Endpoint Mapper on TCP port 135 to request the dynamically allocated high-number port (ports 49152–65535) assigned to a specific service interface.

Rather than opening all high-numbered ports, Windows Defender Firewall supports the symbolic keyword RPC (or RPCEP for the endpoint mapper), which instructs the firewall engine to track RPC bindings dynamically:

# Create inbound rule permitting dynamic RPC communication for administrative services
New-NetFirewallRule -DisplayName "Administrative-RPC-Service" `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort RPC `
    -Profile Domain

Creating New Rules with Inline Port Filters

When creating a new firewall rule using New-NetFirewallRule, port filter parameters can be passed directly via the -Protocol, -LocalPort, and -RemotePort parameters:

# Create inbound UDP rule for DNS and NTP caching services
New-NetFirewallRule -DisplayName "Local-DNS-NTP-Ingress" `
    -Direction Inbound `
    -Action Allow `
    -Protocol UDP `
    -LocalPort @("53", "123") `
    -Profile Private

Auditing Open Port Scopes Across Active Rules

To audit all inbound firewall rules currently permitting traffic, displaying their active protocols and listening ports in a structured table:

# Audit all open inbound ports on the local system
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True | ForEach-Object {
    $Rule = $_
    $PortFilter = $Rule | Get-NetFirewallPortFilter
    if ($PortFilter.Protocol -ne "Any") {
        [PSCustomObject]@{
            DisplayName = $Rule.DisplayName
            Protocol    = $PortFilter.Protocol
            LocalPort   = ($PortFilter.LocalPort -join ", ")
            RemotePort  = ($PortFilter.RemotePort -join ", ")
            Profile     = $Rule.Profile
        }
    }
} | Format-Table -AutoSize

Troubleshooting Port Filter Configuration Errors

When configuring port filters in Windows 11, keep these essential troubleshooting tips in mind:

• Protocol Dependency: You cannot configure LocalPort or RemotePort unless Protocol is explicitly set to TCP or UDP. If Protocol is Any, attempting to assign a port number will result in a ParameterBindingException or validation failure.
• Port Range Formatting: Port ranges must use a single hyphen without spaces (e.g., "8000-8080"). Using colons or whitespace will cause syntax parsing errors.
• Outbound Client Port Scoping: When configuring outbound rules for client applications (such as a browser reaching HTTPS websites), set RemotePort 443 and leave LocalPort Any. Specifying LocalPort 443 for outbound client connections will block requests because the client OS generates a random high-numbered ephemeral port as the source.

Using Set-NetFirewallPortFilter provides precise, programmatic control over transport layer boundaries, ensuring listening sockets and network services are protected against unauthorized port access across Windows 11 systems.