How to Create and Manage Custom Firewall Rules in Windows Defender Firewall on Windows 11

Windows 11 includes a robust, built-in packet inspection engine through Windows Defender Firewall. While the operating system handles standard network traffic automatically, developers, system administrators, and security-conscious users frequently require granular control over network communications. Whether you need to open specific TCP ports for a local development web server, permit peer-to-peer gaming traffic, or completely block a desktop application from communicating over outbound internet channels, mastering Custom Firewall Rules is indispensable.

Understanding Inbound vs Outbound Rules and Network Profiles

Windows Defender Firewall distinguishes traffic direction and network trust levels across clear boundaries:

• Inbound Rules: Govern network packets originating from external machines attempting to reach your computer. By default, Windows blocks unsolicited inbound connections unless explicitly permitted.
• Outbound Rules: Control network traffic generated by local applications attempting to communicate out to external servers. By default, Windows permits most outbound traffic unless a rule explicitly blocks it.
• Network Profiles: Rules can be bound to specific network environments:
  • Domain: Applied when your computer is connected to an enterprise Active Directory domain.
  • Private: Applied on trusted home or office local networks where device discovery is permitted.
  • Public: Applied on untrusted networks (such as coffee shops or airports) with the strictest security baselines.

Accessing Windows Defender Firewall with Advanced Security

While the consumer Settings app offers basic on/off toggles, creating custom port and application rules requires the management console:

1. Press Windows + R on your keyboard to open the Run dialog.
2. Type wf.msc and press Enter (or click OK).
3. Click Yes if prompted by User Account Control (UAC) to open the Windows Defender Firewall with Advanced Security console.

Creating an Inbound Port Rule (e.g. For Local Web Servers)

If you are hosting a local server, database, or media service that needs to receive connections from other devices on your local network:

1. In the left navigation pane of the console, click Inbound Rules.
2. In the right-hand Actions pane, click New Rule….
3. In the New Inbound Rule Wizard, select Port and click Next.
4. Select the protocol (typically TCP) and choose Specific local ports. Enter your target port number or range (e.g., 3000, 8080, 5000-5010), then click Next.
5. Select Allow the connection and click Next.
6. Choose which network profiles this rule applies to. For safety, uncheck Public so the port remains closed when you are on unsecured public Wi-Fi networks.
7. Provide a clear Name (e.g., “Development Node.js Port 3000”) and an optional description, then click Finish.

Creating an Outbound Rule to Block an Application from the Internet

If you have installed a software utility, offline editor, or rendering tool and wish to prevent it from phoning home, sending telemetry, or accessing remote servers:

1. In the left pane, click Outbound Rules.
2. In the Actions pane, click New Rule….
3. Select Program as the rule type and click Next.
4. Choose This program path and click Browse…. Navigate to the executable file (e.g., C:\Program Files\App\software.exe), select it, and click Next.
5. Select Block the connection and click Next.
6. Ensure Domain, Private, and Public are all checked so the block remains permanent across all networks.
7. Name the rule (e.g., “Block Software Telemetry”) and click Finish. The application is now completely isolated from the internet.

Creating and Managing Firewall Rules Using PowerShell

For system automation and scriptable administration, Windows provides the NetSecurity PowerShell module. Open an elevated PowerShell terminal (Run as administrator) to execute commands directly:

Opening an Inbound Port via PowerShell

New-NetFirewallRule -DisplayName "Allow Development Port 8080" `
  -Direction Inbound `
  -LocalPort 8080 `
  -Protocol TCP `
  -Action Allow `
  -Profile Private

Blocking an Outbound Executable via PowerShell

New-NetFirewallRule -DisplayName "Block UntrustedApp Outbound" `
  -Direction Outbound `
  -Program "C:\Utilities\untrusted.exe" `
  -Action Block `
  -Profile Any

Auditing and Disabling Existing Rules

To inspect active rules matching a specific keyword:

Get-NetFirewallRule -DisplayName "*Port 8080*"

To disable a rule temporarily without deleting its configuration:

Disable-NetFirewallRule -DisplayName "Allow Development Port 8080"