Is Windows Firewall on by default on a Windows VPS?

Yes. On our Windows Server 2022 image all three profiles are on, the network adapter is in the Public profile, and incoming connections are blocked unless a rule allows them. Outgoing connections are allowed.

Why can't I ping my Windows server?

Windows blocks ping by default: the rule File and Printer Sharing (Echo Request - ICMPv4-In) exists but is turned off. Enable it with one PowerShell command and the server answers ping right away.

I opened a port in Windows Firewall but it's still closed from the internet. Why?

On a NAT plan only your personal port reaches the server, and it leads to Remote Desktop. Other ports can't be reached from the internet whatever the firewall says. To run a website or another service on Windows, use a plan with its own IPv4 address.

What if I lock myself out of RDP with a firewall rule?

Open the console in your dashboard. It works without RDP, so you can log in there and fix or remove the rule. Before you limit RDP to one IP, check that your own address doesn't change.

How do I see what the firewall is blocking?

Turn on logging of dropped connections for the Public profile. Windows then writes each blocked attempt to pfirewall.log. In our test the entries appeared within about a minute, because Windows writes the log in batches.

How to configure Windows Firewall on a VPS

Open a port on Windows Server 2022, limit it to your own IP address, turn on ping, log blocked connections and back up your rules, all with a few PowerShell commands. Each rule was tested from a second machine to check it really opened or closed the port.

Windows Server comes with its firewall switched on, and that's the right default: everything that tries to connect in is turned away unless a rule lets it through. You'll need to change it when you run something of your own, like a web app on port 8080 or a service only your office should reach. This guide does it all with PowerShell on Windows Server 2022. We tried every rule on our image and tested it from a second machine, so you know it really opens or closes the port.

Open PowerShell as Administrator. If you haven't yet, secure RDP first: that guide covers limiting Remote Desktop itself.

1. See what's on

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction
Get-NetConnectionProfile | Format-Table InterfaceAlias, NetworkCategory

On our fresh server all three profiles (Domain, Private, Public) were on, and the network adapter was in Public. DefaultInboundAction reads NotConfigured, which means Windows' default: block incoming, allow outgoing. So the rules that count are the ones for the Public profile.

To see what is allowed in:

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow |
    Group-Object DisplayGroup | Sort-Object Count -Descending |
    Select-Object Count, Name -First 8

We counted 54 enabled inbound rules. Most belong to Windows itself (Core Networking, Cast to Device, mDNS), plus the three Remote Desktop rules. Ping wasn't among them.

2. Open a port

Say your app listens on TCP port 8080:

New-NetFirewallRule -DisplayName 'Web app 8080' -Direction Inbound `
    -Protocol TCP -LocalPort 8080 -Action Allow

The rule works the moment it's created. From our second machine port 8080 went from blocked to open, while port 8081, which also had a program listening on it, stayed blocked. A rule without -Profile applies to all profiles, Public included.

For a range or a list, use -LocalPort 8000-8010 or -LocalPort 80,443. For UDP, change -Protocol.

3. Allow only certain addresses

Most services don't need to accept the whole internet. Limit the rule to the addresses that should connect:

Set-NetFirewallRule -DisplayName 'Web app 8080' -RemoteAddress 203.0.113.10
Set-NetFirewallRule -DisplayName 'Web app 8080' -RemoteAddress 203.0.113.10, 198.51.100.0/24

We tested both ways. With a foreign address in -RemoteAddress, our test machine couldn't connect anymore. With its own address added, it could. Use the same parameter on the Remote Desktop rules to keep RDP for your office only. If your home IP changes often, think twice about doing that for RDP.

4. Turn on ping

Windows doesn't answer ping out of the box. The rule exists but is off:

Enable-NetFirewallRule -DisplayName 'File and Printer Sharing (Echo Request - ICMPv4-In)'

After this our server answered ping straight away. Monitoring tools that check uptime by ping need it. To turn it off again, use Disable-NetFirewallRule with the same name.

5. Log what gets blocked

When something can't connect and you don't know why, have the firewall write down what it drops:

Set-NetFirewallProfile -Profile Public -LogBlocked True -LogMaxSizeKilobytes 4096
Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log -Tail 20

Each blocked attempt becomes a line like this:

2026-10-25 02:07:25 DROP TCP 198.51.100.7 203.0.113.25 43386 445 60 S 2112839481 0 64240 - - - RECEIVE 4

That reads: date and time, the action, protocol, source address, your server's address, source port, destination port. Be patient: Windows writes the log in batches, and our test entries showed up about a minute after the attempts. The 4 MB limit keeps the file from growing without end.

6. Back up and clean up

Save all rules to a file before a big change:

netsh advfirewall export C:\fw-backup.wfw

Our export was 148 KB. netsh advfirewall import C:\fw-backup.wfw puts that exact set back, replacing whatever is there. Delete a rule you no longer need by name:

Remove-NetFirewallRule -DisplayName 'Web app 8080'

If you lock yourself out

If a rule cuts off your own Remote Desktop, open the console in your dashboard. It doesn't go through RDP, so you can log in and run Remove-NetFirewallRule or Set-NetFirewallRule to undo it.

NAT or your own IP

On NAT plans, the internet reaches your server through one personal port, which leads to Remote Desktop. Other ports stay unreachable from outside no matter what you allow in Windows Firewall. To serve a website or accept connections on other ports, you need your own IPv4: Windows Small-IP (4 vCPU, 4 GB, 50 GB, $28/mo) gives you one with all ports open, so Windows Firewall is what decides. Windows-Small is $11/mo on NAT. All four Windows plans are on the Windows VPS page, and payment is in USDT, USDC or ETH on Base, Ethereum or Polygon.

How to configure Windows Firewall on a VPS: open a port, allow one IP, see what gets blocked