# Using Windows Defender Firewall on your VPS
Source: https://vpsdime.com/knowledgebase/windows-vps/windows-firewall
Last reviewed: 2026-07-02
Summary: On a Windows VPS the built-in firewall is your only network layer, how inbound blocking works by default, opening a port for your app (GUI and PowerShell), restricting RDP to your own IPs safely, and verifying from outside.

## What this is

Windows VPS has **no managed edge firewall in front of it** (that's a Linux VPS feature), so Windows Defender Firewall is the network layer, and the good news is its default posture is already right: **inbound connections are blocked unless a rule allows them**. Windows and its services create their own rules (RDP's exists out of the box), so your job is only two things: open ports for what you deliberately serve, and tighten the rules you inherited.

## Opening a port for your application

Say your app listens on TCP 8080. First, remember [a port only answers if something is listening](https://vpsdime.com/knowledgebase/troubleshooting/my-port-xxx-is-closed), confirm your app runs, then allow it:

**PowerShell (fastest):**

```powershell
New-NetFirewallRule -DisplayName "MyApp 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow
```

**GUI:** run `wf.msc` → Inbound Rules → New Rule → Port → TCP, 8080 → Allow → name it. Same result.

Then verify from **outside** (your own machine): `Test-NetConnection YOUR.VPS.IP -Port 8080`, or any online port checker, reading the result with the [closed-vs-filtered rule](https://vpsdime.com/knowledgebase/troubleshooting/my-port-xxx-is-closed). Ask an [AI chatbot](https://vpsdime.com/knowledgebase/support-coverage/software-and-server-management) to draft rules for anything fancier (port ranges, UDP, specific programs), `New-NetFirewallRule` has a parameter for everything.

## Restricting RDP to your own IPs

The highest-value tightening on the whole server, RDP reachable only from addresses you control ends the brute-force question outright:

1. `wf.msc` → **Inbound Rules** → find **Remote Desktop - User Mode (TCP-In)**.
2. Properties → **Scope** tab → Remote IP address → **These IP addresses** → add your home/office IPs (find yours on any "what is my IP" site).
3. OK, the change applies immediately.

Two safety notes: **your home IP may be dynamic**, so add a range or your mobile carrier's egress too if you can, and know the fallback before you need it, the **Console** in your client area reaches the VPS without RDP, so a scope mistake locks the door, not the house (it signs in as the [VPSDime Support Account](https://vpsdime.com/knowledgebase/windows-vps/vpsdime-support-account), so expect a different desktop). (PowerShell equivalent: `Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -RemoteAddress 203.0.113.7`.)

## The habits

- **Don't turn the firewall off** to "test something", allow the specific port instead. Off means every listener on the machine is public.
- **Profiles** (Domain/Private/Public): on a VPS the network is Public; when creating rules, applying them to all profiles avoids surprises.
- Audit occasionally: `Get-NetFirewallRule -Enabled True -Direction Inbound | Where-Object Action -eq Allow` lists everything you're allowing in.

## Still need help?

You can [open a support ticket](https://vpsdime.com/open-ticket/). So we can help on the first reply, it's worth mentioning:

- the VPS hostname or IP and the port involved,
- the rule you created or changed,
- what an outside test of the port shows (refused, or a timeout).

## Related questions

- "How do I open a port on my Windows VPS?"
- "How do I restrict RDP to my IP address?"
- "Is there a firewall in front of my Windows VPS?"
- "Should I disable Windows Firewall to test?"
- "How do I list my inbound firewall rules?"