Why is Windows Firewall blocking my app?
App can't connect? Windows Firewall might be blocking it. Learn how to diagnose and fix it with netsh and PowerShell.
What this covers
When an app can't reach the network but other things work fine, Windows Firewall is a likely suspect. This guide walks you through checking the firewall state, creating an allow rule for your app's port, and verifying the rule is in place — all from the command line.
Symptom
Check if the firewall is on and what rules exist
First, confirm the firewall is actually the culprit. Query the firewall state for all profiles (Domain, Private, Public) and list existing rules. If the firewall is off, the block is coming from elsewhere. If it's on, look for any rule that might be blocking your app. This step tells you whether to proceed with a fix.
Query whether Defender Firewall is enabled per profile (Domain/Private/Public) and list the rules already in place — without touching the GUI.
$ netsh advfirewall show allprofiles stateCreate an inbound allow rule for the app's port
If the firewall is on and no allow rule exists, create one for the port your app uses. This opens the port for inbound traffic. Make sure you specify the correct protocol (TCP/UDP) and port number. After the rule is created, the app should be able to receive connections.
Create an inbound allow rule for a TCP/UDP port with one PowerShell cmdlet, and delete it cleanly afterwards.
$ New-NetFirewallRule -DisplayName "Allow HTTP 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow▾ Undo
$ Remove-NetFirewallRule -DisplayName "Allow HTTP 8080"Verify the new rule is saved and back up your firewall policy
Export the current firewall policy to a file. This serves two purposes: it confirms your new rule is included in the active configuration, and it gives you a backup you can restore if something goes wrong. Open the exported file and search for your rule's name to be sure it's there. If it's missing, the rule wasn't applied correctly.
Snapshot every firewall rule, profile and setting into a single .wfw file with netsh advfirewall export, and put it all back with import.
$ netsh advfirewall export "C:\backup\firewall-policy.wfw"▾ Undo
$ netsh advfirewall import "C:\backup\firewall-policy.wfw"How to confirm it worked
The app can connect again, or the exported firewall policy file contains the new allow rule you created.
Undo everything
Every command above can be reverted. Run these in order to undo all of it.
$ netsh advfirewall import "C:\backup\firewall-policy.wfw"
Remove-NetFirewallRule -DisplayName "Allow HTTP 8080"Review before running — some steps may not be independent.
Sources
- Netsh - Windows CMDEvidence: SS64 documents the netsh advfirewall contexts: show allprofiles state and firewall show rule name=all for inspecting rules and profile states.
- New-NetFirewallRule | Microsoft LearnEvidence: Microsoft documents New-NetFirewallRule with parameters -Direction, -Protocol, -LocalPort and -Action to create an inbound allow rule.
Last verified: 2026-09-22
Related guides
Use PowerShell to identify the PID listening on a Windows port, kill it, and confirm the port is free.
Work through repeating System and Application errors in the right order: query the log properly, look at the other places errors hide, then confirm the noise actually stops.
Work out whether a file is held open by a program, owned by a dead account, or sitting behind a path longer than 260 characters — then delete it with PowerShell, takeown/icacls and robocopy on Windows.