How to Configure Hyper-V Network Adapter Extended Port ACLs in Windows 11 Using PowerShell

In virtualized enterprise networks and lab environments running on Microsoft Hyper-V, securing guest virtual machines against unauthorized lateral network traversal, rogue network services, and packet spoofing is critical. While guest-level firewalls (such as Windows Defender Firewall or Linux iptables) protect the internal operating system, guest administrators can disable or misconfigure them. Hyper-V provides an additional layer of hardware-agnostic protection at the hypervisor boundary: Virtual Switch Extended Port Access Control Lists (Extended ACLs). Configured in Windows 11 and Windows Server via PowerShell, Extended Port ACLs enforce stateful and stateless firewall packet filtering directly at the virtual switch port, before packets ever reach guest memory.

Understanding Hyper-V Extended Port ACL Architecture

Hyper-V Virtual Switch implements Extended Port ACLs as filter rules evaluated during packet forwarding across virtual ports:

• Granular Match Criteria: Rules can match against IPv4 and IPv6 source/destination IP addresses, subnet CIDR masks, protocols (TCP, UDP, ICMP), and TCP/UDP port ranges.
• Traffic Directions: Rules evaluate traffic in either Inbound (entering the VM from the virtual switch) or Outbound (leaving the VM toward the virtual switch) directions.
• Action Types:
  • Allow: Permits matching packets through the switch port.
  • Deny: Silently drops matching packets at the switch layer.
• Stateful Inspection (Stateful Packet Filtering): By specifying the Stateful parameter, the Hyper-V virtual switch tracks TCP connection handshake states (SYN, ACK, FIN) and automatically permits corresponding return traffic for established outbound connections, eliminating the need for open inbound ephemeral return ports.
• Weight and Precedence: Rules are evaluated based on numeric weight values (e.g., 1 to 65535). The rule with the highest weight takes precedence when packet headers match multiple criteria.

Inspecting Existing Extended Port ACLs

Launch an elevated PowerShell session on your Windows 11 host. To query all active Extended Port ACLs applied to a specific virtual machine’s network adapter, execute:

Get-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01"

To inspect comprehensive rule properties cleanly:

Get-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" | Select-Object Action, Direction, Protocol, LocalPort, RemotePort, RemoteIPAddress, Stateful, Weight | Format-Table

Creating Inbound and Outbound Extended Port ACLs

Administrators create port filtering rules using the Add-VMNetworkAdapterExtendedAcl cmdlet. Best practice dictates implementing a default-deny posture and explicitly allowing permitted traffic.

Step 1: Implementing a Default Outbound and Inbound Drop Rule

Create low-priority catch-all rules to deny all unsolicited incoming and outgoing packets:

# Catch-all rule: Deny all inbound traffic (low weight 1)
Add-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Deny `
  -Direction Inbound `
  -Weight 1

# Catch-all rule: Deny all outbound traffic (low weight 1)
Add-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Deny `
  -Direction Outbound `
  -Weight 1

Step 2: Allowing Inbound Web Traffic (HTTP and HTTPS)

Create high-priority rules allowing public ingress traffic to TCP ports 80 and 443:

# Allow inbound HTTP
Add-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Allow `
  -Direction Inbound `
  -LocalPort 80 `
  -Protocol TCP `
  -Weight 100

# Allow inbound HTTPS
Add-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Allow `
  -Direction Inbound `
  -LocalPort 443 `
  -Protocol TCP `
  -Weight 100

Step 3: Configuring Stateful Outbound DNS and Database Connections

To allow the VM to make outbound DNS queries and database calls while automatically allowing return traffic back through the switch, specify the -Stateful $true flag:

# Allow stateful outbound DNS queries
Add-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Allow `
  -Direction Outbound `
  -RemotePort 53 `
  -Protocol UDP `
  -Stateful $true `
  -Weight 200

# Allow stateful outbound SQL database queries to specific backend server
Add-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Allow `
  -Direction Outbound `
  -RemoteIPAddress "10.0.10.50/32" `
  -RemotePort 1433 `
  -Protocol TCP `
  -Stateful $true `
  -Weight 200

Restricting Administrative Access to Subnets

To restrict administrative SSH (port 22) or RDP (port 3389) management traffic strictly to an administrative jumpbox subnet:

Add-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Allow `
  -Direction Inbound `
  -LocalPort 3389 `
  -Protocol TCP `
  -RemoteIPAddress "192.168.100.0/24" `
  -Weight 300

Any RDP attempt originating outside 192.168.100.0/24 hits the catch-all Deny rule and is dropped immediately at the Hyper-V switch port.

Removing Extended Port ACL Rules

To remove a specific rule that is no longer required, specify its matching parameters with Remove-VMNetworkAdapterExtendedAcl:

# Remove specific HTTP rule
Remove-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" `
  -Action Allow `
  -Direction Inbound `
  -LocalPort 80 `
  -Protocol TCP

# Clear all Extended ACLs from a virtual machine adapter
Get-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" | Remove-VMNetworkAdapterExtendedAcl

Auditing Dropped Packets and Troubleshooting

If a virtual machine loses connectivity after applying rules, verify the precedence hierarchy of the active ACL rules. The Hyper-V virtual switch processes rules from highest weight down to lowest weight:

Get-VMNetworkAdapterExtendedAcl -VMName "Web-DMZ-01" | Sort-Object Weight -Descending | Select-Object Weight, Action, Direction, Protocol, LocalPort, RemotePort, RemoteIPAddress

By enforcing Hyper-V Network Adapter Extended Port ACLs via PowerShell, administrators implement micro-segmentation and defense-in-depth isolation directly at the hypervisor switch layer, protecting virtual machines independently of guest OS security states.