How to Configure Local Port Forwarding in Windows 11 Using Netsh Portproxy

In developer environments, local virtualization setups, and corporate network auditing, routing network traffic across local listening ports and internal IP endpoints is frequently required. For example, developers using Windows Subsystem for Linux (WSL 2) or Hyper-V virtual machines often need inbound LAN connections forwarded directly to internal VM ports without configuring external third-party proxies. Windows 11 includes a native, kernel-level port forwarding mechanism built into the Netsh command-line suite: netsh interface portproxy.

Understanding How Portproxy Functions in Windows

The portproxy subsystem in Windows acts as a network bridge between IP endpoints. It supports four translation modes:

• v4tov4: Proxies IPv4 traffic arriving on a local port to a remote or internal IPv4 address and port.
• v4tov6: Proxies IPv4 traffic to an IPv6 address.
• v6tov4: Proxies IPv6 traffic to an IPv4 destination.
• v6tov6: Proxies IPv6 traffic to another IPv6 target.

Because Portproxy operates through the Windows IP Helper service (iphlpsvc), port forwarding runs continuously in the background without requiring an open command prompt.

Verifying the IP Helper Service

Portproxy relies directly on the IP Helper service. Open an elevated PowerShell session (Run as Administrator) and verify that the service is running:

Get-Service iphlpsvc

If the service is stopped or set to manual, configure it to start automatically:

Set-Service -Name iphlpsvc -StartupType Automatic
Start-Service -Name iphlpsvc

Creating an IPv4 to IPv4 Port Forwarding Rule

To add a port forwarding rule, use the add v4tov4 sub-command. The command takes four required parameters:

• listenport: The local port number Windows will listen on.
• listenaddress: The local IP address to bind to (use 0.0.0.0 to listen on all interfaces).
• connectport: The destination port on the target machine or virtual machine.
• connectaddress: The destination IP address (e.g., a WSL 2 IP, Hyper-V VM IP, or remote server).

For example, to forward external incoming traffic on port 8080 to a local development web server running on port 3000 inside WSL 2 (IP: 172.28.14.95):

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=3000 connectaddress=172.28.14.95

To forward local port 2222 to an internal virtual machine SSH daemon running on port 22 at 192.168.100.50:

netsh interface portproxy add v4tov4 listenport=2222 listenaddress=0.0.0.0 connectport=22 connectaddress=192.168.100.50

Viewing Active Port Forwarding Rules

To inspect all port forwarding rules currently registered in the Windows TCP/IP stack, execute:

netsh interface portproxy show all

To view only IPv4-to-IPv4 forwarding mappings:

netsh interface portproxy show v4tov4

Windows outputs a structured table detailing listening and connect coordinates:

Listen on ipv4:             Connect to ipv4:

Address         Port        Address         Port
--------------- ----------  --------------- ----------
0.0.0.0         8080        172.28.14.95    3000
0.0.0.0         2222        192.168.100.50  22

Allowing Inbound Traffic Through Windows Defender Firewall

Creating a Portproxy rule tells Windows to forward traffic once received, but Windows Defender Firewall blocks inbound external traffic by default. You must create an inbound firewall rule allowing traffic on the listenport.

To open port 8080 for TCP traffic using PowerShell:

New-NetFirewallRule -DisplayName "Portproxy Forward 8080" -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow

To open port 2222 for SSH forwarding:

New-NetFirewallRule -DisplayName "Portproxy Forward 2222" -Direction Inbound -LocalPort 2222 -Protocol TCP -Action Allow

Deleting and Resetting Portproxy Rules

When development testing is complete or a temporary proxy tunnel is no longer needed, remove the rule by specifying the listening port and address:

netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0

To clear all registered Portproxy rules across all protocols simultaneously:

netsh interface portproxy reset

To remove the associated firewall rule:

Remove-NetFirewallRule -DisplayName "Portproxy Forward 8080"

Utilizing netsh interface portproxy provides a robust, zero-footprint mechanism to manage network redirects and streamline cross-environment communication across Windows 11.