{"id":1004,"date":"2026-11-02T04:54:04","date_gmt":"2026-11-02T04:54:04","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=1004"},"modified":"2026-11-02T04:54:04","modified_gmt":"2026-11-02T04:54:04","slug":"firewall-profiles-public-vs-domain-after-vps-reboot","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/","title":{"rendered":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot"},"content":{"rendered":"<h1>Firewall Profiles: Public vs Domain After a Windows VPS Reboot<\/h1>\n<p><img decoding=\"async\" src=\"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80\" alt=\"Network cables and server rack switches in a data center\" \/><\/p>\n<p><strong>TL;DR:<\/strong> After a reboot, Windows can reclassify the NIC as Public and apply a stricter firewall profile\u2014silently blocking RDP, SQL, or custom ports that worked yesterday. Confirm the active profile, set the network category deliberately, and align provider security groups with guest rules on your <a href=\"https:\/\/windows-vps.org\/\">Windows VPS<\/a>.<\/p>\n<h2>Why the same ports \u201cdisappear\u201d overnight<\/h2>\n<p>Windows Firewall is not one flat allowlist. It evaluates Domain, Private, and Public profiles, each with different default outbound and inbound posture. On physical office PCs the Domain profile appears when Active Directory detects a domain controller. On a rented VPS you are usually workgroup-only, so Windows falls back to Private or Public based on how the network stack remembers the adapter.<\/p>\n<p>Provider maintenance, snapshot restores, and cloud-init style NIC renames can wipe that memory. The guest boots, sees an \u201cunidentified\u201d network, and chooses Public. Your carefully opened inbound rules may be scoped only to Private. Result: the panel security group still allows TCP 3389, yet Windows drops the packets before the RDP service answers.<\/p>\n<p>Operators often blame the host firewall first. Spend two minutes inside the guest before opening a ticket\u2014profile mismatches create the same symptoms as a closed cloud ACL.<\/p>\n<h2>How to read the active profile quickly<\/h2>\n<p>Open an elevated PowerShell session after you regain console or RDP access:<\/p>\n<ul>\n<li><strong>Get-NetConnectionProfile<\/strong> \u2014 note Name, InterfaceAlias, and NetworkCategory.<\/li>\n<li><strong>Get-NetFirewallProfile<\/strong> \u2014 confirm which profiles are enabled and whether inbound is Block.<\/li>\n<li><strong>wf.msc<\/strong> \u2014 visual check if a rule\u2019s Profile column excludes Public.<\/li>\n<\/ul>\n<p>If NetworkCategory is Public and your RDP allow rule is Private-only, you have the smoking gun. Do not disable the entire firewall to \u201ctest.\u201d That habit survives into production and invites scanners. Change the category or widen the specific rule\u2019s profile scope with intent.<\/p>\n<h3>Console recovery when RDP is already locked out<\/h3>\n<p>Use the provider\u2019s VNC\/serial console, not hope. From console, set the category:<\/p>\n<p><code>Set-NetConnectionProfile -InterfaceAlias \"Ethernet\" -NetworkCategory Private<\/code><\/p>\n<p>Replace the alias with whatever <code>Get-NetAdapter<\/code> shows. Some images use \u201cEthernet 2\u201d after a hardware UUID change. Persist a note in your runbook with the exact alias for that instance.<\/p>\n<h2>Domain profile myths on solo VPS boxes<\/h2>\n<p>Seeing \u201cDomain\u201d on a non-joined VPS is rare and usually means leftover GPO tooling or a misapplied image. Do not chase Domain profile settings unless the machine truly joins your AD. For typical RDP jump hosts and IIS singles, Private is the sane category when the NIC is on a trusted VPC, and Public is appropriate only when the adapter faces a hostile shared network you refuse to trust.<\/p>\n<p>If you later domain-join the guest, revisit firewall baselines\u2014Domain rules from GPO can override local MMC edits. Document whether local or domain policy wins before the next reboot surprise.<\/p>\n<h2>Scope rules the way you scope cloud ACLs<\/h2>\n<p>Mirror the discipline you already use on the provider panel:<\/p>\n<ul>\n<li>Prefer allow rules limited to admin source IPs when the product supports it.<\/li>\n<li>Duplicate critical allows across Private and Public only when you knowingly accept Public after reboots.<\/li>\n<li>Keep ephemeral lab ports on Private-only so a Public flip fails closed for experiments.<\/li>\n<\/ul>\n<p>Export your firewall policy with <code>netsh advfirewall export<\/code> after a known-good state. Restoring that file beats rebuilding twenty rules after a bad image clone.<\/p>\n<h2>Provider security groups are not a substitute<\/h2>\n<p>Cloud ACLs stop packets before they reach the guest. Guest profiles stop packets after they arrive. You need both layers coherent. When you open 443 on the panel but IIS still fails from the internet, check Windows profile and binding address. When Windows is Private-open but the panel still denies your home IP, fix the panel\u2014not the guest.<\/p>\n<p>After any panel change, retest from a phone hotspot so you are not fooled by a corporate egress that was already allowlisted. Record both the guest NetworkCategory and the panel rule IDs in the change ticket.<\/p>\n<h2>Reboot drills that catch profile flips early<\/h2>\n<p>Schedule a controlled reboot after first provisioning and after major NIC or Windows Update sessions. Immediately run Get-NetConnectionProfile and attempt RDP from a second network. If Public returns, either force Private via a startup script you maintain, or widen the RDP rule profiles and accept the trade-off.<\/p>\n<p>Startup scripts should be idempotent and logged. Silent Set-NetConnectionProfile failures (wrong alias) are worse than no script at all because they create false confidence.<\/p>\n<h2>Keeping IIS and SQL reachable without flattening security<\/h2>\n<p>Web and database workloads often add their own inbound rules during installers. Those rules inherit whatever profile set the installer used that day. After a Public flip, HTTP may die while RDP still works\u2014or the reverse. Audit installer-created rules quarterly; consolidate into named rule groups with explicit profile scopes.<\/p>\n<p>For SQL over the internet (generally discouraged), require Private + VPN or SSH tunnel patterns rather than Public allow-anywhere. Profile hygiene will not save a wide-open 1433.<\/p>\n<h2>Stable NIC naming as the quiet dependency<\/h2>\n<p>Profile fixes fail when InterfaceAlias changes after every restore. Prefer identifying adapters by InterfaceIndex or MacAddress in scripts. Pin provider \u201cnetwork config\u201d so hot-plug events do not spawn Ethernet 4. A stable alias makes Private enforcement boring\u2014which is exactly what you want on a long-lived <a href=\"https:\/\/windows-vps.org\/\">windows-vps.org<\/a> guest.<\/p>\n<p>Treat firewall profile checks as part of the same post-reboot smoke test as time sync and disk space. When Public versus Private stops being a mystery, overnight \u201cport disappeared\u201d tickets mostly disappear with it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Firewall Profiles: Public vs Domain After a Windows VPS Reboot TL;DR: After a reboot, Windows can reclassify the NIC as Public and apply a stricter firewall profile\u2014silently blocking RDP, SQL, or custom ports that worked yesterday. Confirm the active profile, set the network category deliberately, and align provider security groups with guest rules on your &#8230; <a title=\"Firewall Profiles: Public vs Domain After a Windows VPS Reboot\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/\" aria-label=\"Read more about Firewall Profiles: Public vs Domain After a Windows VPS Reboot\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[8],"tags":[],"class_list":["post-1004","post","type-post","status-publish","format-standard","hentry","category-vps-tutorials"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Firewall Profiles: Public vs Domain After a Windows VPS Reboot - Windows VPS Blog<\/title>\n<meta name=\"description\" content=\"Firewall Profiles: Public vs Domain After a Windows VPS Reboot TL;DR: After a reboot, Windows can reclassify the NIC as Public and apply a stricter\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Firewall Profiles: Public vs Domain After a Windows VPS Reboot\" \/>\n<meta property=\"og:description\" content=\"Firewall Profiles: Public vs Domain After a Windows VPS Reboot\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T04:54:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@myxiechengxuan\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/\",\"name\":\"Firewall Profiles: Public vs Domain After a Windows VPS Reboot - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80\",\"datePublished\":\"2026-11-02T04:54:04+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"description\":\"Firewall Profiles: Public vs Domain After a Windows VPS Reboot TL;DR: After a reboot, Windows can reclassify the NIC as Public and apply a stricter\",\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#primaryimage\",\"url\":\"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80\",\"contentUrl\":\"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Firewall Profiles: Public vs Domain After a Windows VPS Reboot\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\",\"https:\/\/x.com\/myxiechengxuan\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot - Windows VPS Blog","description":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot TL;DR: After a reboot, Windows can reclassify the NIC as Public and apply a stricter","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/","og_locale":"en_US","og_type":"article","og_title":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot","og_description":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot","og_url":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-11-02T04:54:04+00:00","og_image":[{"url":"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80","type":"","width":"","height":""}],"author":"windows-vps","twitter_card":"summary_large_image","twitter_creator":"@myxiechengxuan","twitter_misc":{"Written by":"windows-vps","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/","url":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/","name":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#primaryimage"},"image":{"@id":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#primaryimage"},"thumbnailUrl":"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80","datePublished":"2026-11-02T04:54:04+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"description":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot TL;DR: After a reboot, Windows can reclassify the NIC as Public and apply a stricter","breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#primaryimage","url":"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80","contentUrl":"https:\/\/images.unsplash.com\/photo-1558494949-ef010cbdcc31?auto=format&amp;fit=crop&amp;w=1200&amp;q=80"},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/firewall-profiles-public-vs-domain-after-vps-reboot\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Firewall Profiles: Public vs Domain After a Windows VPS Reboot"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog","https:\/\/x.com\/myxiechengxuan"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/1004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=1004"}],"version-history":[{"count":1,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/1004\/revisions"}],"predecessor-version":[{"id":1005,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/1004\/revisions\/1005"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=1004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=1004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=1004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}