How to Scope Windows Defender Firewall Rules by IP Address and Subnet in Windows 11 Using PowerShell

In modern enterprise workstation management and secure developer environments, applying generic firewall rules that expose ports to entire subnets or the open internet introduces unacceptable security risks. For sensitive network listeners—such as remote administrative tools (RDP, WinRM, SSH), development database instances, or file shares—firewall rules should strictly limit ingress and egress traffic to specific authorized IP addresses or known local subnets. While configuring basic firewall rules via the Windows GUI is straightforward, defining complex, dynamic IP address filters across dozens of workstations requires PowerShell automation.

In Windows 11, the native NetSecurity module decouples network address filtering from the parent rule definition through the Get-NetFirewallAddressFilter and Set-NetFirewallAddressFilter cmdlets. Through address filters, administrators can bind rules to individual IPv4/IPv6 addresses, CIDR notation subnets, IP address ranges, or built-in dynamic network keywords (such as LocalSubnet, DefaultGateway, and DNS). This guide covers how to inspect address filter properties, restrict rules to specific subnets, utilize dynamic keywords, and automate firewall scoping via PowerShell.

Understanding Address Filters in the Windows Filtering Platform

In the Windows Filtering Platform (WFP), every firewall rule is linked to an underlying address filter object (NetFirewallAddressFilter). This filter evaluates packet routing headers independently of transport ports or interface types:

• LocalAddress: The destination IP address on the local machine for inbound traffic, or the source IP address for outbound traffic. Useful for multi-homed systems where a service must listen on one specific IP address while remaining unreachable on others.
• RemoteAddress: The source IP address of incoming packets for inbound rules, or the destination IP address for outbound rules. Supports individual IP addresses, CIDR notation (e.g., 192.168.1.0/24), IP ranges (e.g., 10.0.0.100-10.0.0.200), and dynamic system keyword tokens.
• Dynamic Address Keywords: Windows Defender Firewall supports special symbolic keyword tokens that automatically resolve and adapt to the current network environment:
  • LocalSubnet: Resolves dynamically to the local IP subnet matching the active network adapter.
  • DefaultGateway: Resolves dynamically to the default gateway router IP address.
  • DNS: Matches the IP addresses of currently configured DNS resolvers.
  • DHCP: Matches active local DHCP server IP addresses.
  • Intranet: Matches addresses classified under private IP ranges or corporate direct access routes.

Inspecting Address Filters on Existing Firewall Rules

To inspect the configured IP address scope of any firewall rule, open an elevated PowerShell prompt (Run as Administrator) and pipe Get-NetFirewallRule to Get-NetFirewallAddressFilter:

# Query address filter for the built-in Remote Desktop rule
Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" | 
    Get-NetFirewallAddressFilter

The resulting object displays the active local and remote address scopes:

LocalAddress  : Any
RemoteAddress : Any
PolicyStore   : PersistentStore

By default, rules created without explicit scoping show Any, meaning traffic from all reachable network locations is evaluated.

Restricting Firewall Rules to Specific IP Addresses and CIDR Subnets

To secure a service so that only designated management hosts can connect, update the remote address filter using Set-NetFirewallAddressFilter:

# Restrict RDP access to a specific administrative management IP
Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" | 
    Get-NetFirewallAddressFilter | 
    Set-NetFirewallAddressFilter -RemoteAddress "192.168.10.50"

To permit an entire administrative subnet alongside an off-site VPN subnet using CIDR notation, pass an array of addresses:

# Scope remote addresses to multiple subnets and ranges
Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" | 
    Get-NetFirewallAddressFilter | 
    Set-NetFirewallAddressFilter -RemoteAddress @("192.168.10.0/24", "10.200.0.0/16", "172.16.5.10-172.16.5.25")

To verify the configured address list:

# Verify updated remote address constraints
(Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" | Get-NetFirewallAddressFilter).RemoteAddress

Leveraging Dynamic System Address Keywords

Hardcoding static IP subnets on mobile laptops or devices that travel between office branches can break access when network configurations change. By using dynamic system keywords, rules automatically re-evaluate their scope whenever the host connects to a new network.

For instance, to permit local file sharing or network printing only from devices residing on the immediate physical local network:

# Restrict inbound SMB file sharing strictly to the immediate local subnet
Get-NetFirewallRule -DisplayName "File and Printer Sharing (SMB-In)" | 
    Get-NetFirewallAddressFilter | 
    Set-NetFirewallAddressFilter -RemoteAddress LocalSubnet

Similarly, for secure administrative monitoring scripts querying local gateway routers:

# Allow outbound SNMP queries exclusively to the default gateway
New-NetFirewallRule -DisplayName "SNMP-Gateway-Outbound" `
    -Direction Outbound `
    -Action Allow `
    -Protocol UDP `
    -RemotePort 161 `
    -RemoteAddress DefaultGateway

Creating New Rules with Address Filters Directly

You can define both local and remote address scopes directly when creating a new rule via New-NetFirewallRule using the -LocalAddress and -RemoteAddress parameters:

# Create inbound PostgreSQL database rule restricted to local subnet and management host
New-NetFirewallRule -DisplayName "Postgres-Internal-Access" `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort 5432 `
    -RemoteAddress @("LocalSubnet", "10.0.50.25") `
    -Profile Private, Domain

Auditing Scoped Address Rules Across the System

To audit all inbound firewall rules that have been restricted to specific remote IP addresses or subnets (excluding rules set to Any), execute the following auditing script:

# Audit all inbound rules with custom remote address constraints
Get-NetFirewallRule -Direction Inbound -Enabled True | ForEach-Object {
    $Rule = $_
    $AddressFilter = $Rule | Get-NetFirewallAddressFilter
    if ($AddressFilter.RemoteAddress -ne "Any") {
        [PSCustomObject]@{
            DisplayName   = $Rule.DisplayName
            Direction     = $Rule.Direction
            Action        = $Rule.Action
            RemoteAddress = ($AddressFilter.RemoteAddress -join ", ")
        }
    }
} | Format-Table -AutoSize

Removing Address Constraints and Reverting to Universal Scope

If an address restriction is no longer needed and the rule should accept traffic from any reachable network address, reset the filter by passing "Any":

# Reset remote address scoping back to universal Any
Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" | 
    Get-NetFirewallAddressFilter | 
    Set-NetFirewallAddressFilter -RemoteAddress "Any"

Troubleshooting Common Address Filter Pitfalls

When configuring address filters in Windows Defender Firewall, keep these key operational considerations in mind:

• IPv4 vs IPv6 Address Formats: If an address filter contains only IPv4 addresses (e.g., 192.168.1.50), any traffic arriving over IPv6 will fail to match the rule. When operating in dual-stack environments, ensure both IPv4 and IPv6 addresses (or CIDR blocks such as fe80::/64) are declared in the address array.
• NAT and Gateway Address Translation: When a client connects from behind a Network Address Translation (NAT) router or proxy firewall, the packet arrival address inspected by the firewall is the public or gateway NAT IP, not the client’s internal private IP. Ensure your address filter targets the external facing IP address.
• CIDR Prefix Alignment: When specifying CIDR blocks, ensure the host bits are properly zeroed (e.g., use 192.168.10.0/24, not 192.168.10.5/24). Incorrectly formatted CIDR strings will be rejected by PowerShell input validation.

Using Set-NetFirewallAddressFilter to scope Windows Defender Firewall rules by IP address and subnet ensures that services remain accessible exclusively to authorized network segments, reducing endpoint attack surfaces across enterprise environments.