{"id":692,"date":"2026-08-22T22:53:14","date_gmt":"2026-08-22T22:53:14","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=692"},"modified":"2026-08-22T22:53:14","modified_gmt":"2026-08-22T22:53:14","slug":"windows-defender-firewall-windows-server-rules-profiles","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/","title":{"rendered":"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Every Windows Server VPS ships with Windows Defender Firewall enabled, yet most setup guides treat it as an afterthought. Understanding three concepts &#8212; profiles, rules, and the default-deny inbound model &#8212; lets you lock down a server without breaking RDP, IIS, or SQL Server. This guide walks through how the firewall thinks, then gives you the exact commands for the scenarios that matter on a VPS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How profiles work<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The firewall applies three profiles &#8212; Domain, Private, and Public &#8212; and every network connection is assigned exactly one of them. On a VPS, the internet-facing interface is almost always classified as the Public profile, so rules you create for Private or Domain simply never apply. The practical consequence: when a rule &#8220;does not work,&#8221; the first thing to check is which profile the rule is bound to and which profile the network is using (<code>Get-NetConnectionProfile<\/code>).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The default-deny inbound model<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Defender Firewall blocks unsolicited inbound traffic by default and allows all outbound traffic by default. That means you do not secure a server by adding block rules; you secure it by adding <em>allow<\/em> rules only for the services you intentionally expose, and by keeping everything else denied. Most VPS hardening is therefore a matter of auditing the built-in allow rules (Remote Desktop, File and Printer Sharing, IIS) and disabling or scoping the ones you do not need.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common VPS scenarios<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Scope RDP to your IP range instead of leaving it open to the world &#8212; this is the single highest-value rule on any Windows VPS:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Allow RDP only from your office \/ home CIDR\nNew-NetFirewallRule -DisplayName \"RDP from trusted IPs\" -RemoteAddress 203.0.113.0\/24 -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then disable the built-in, wide-open Remote Desktop rule so the scoped rule is the only path in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Disable-NetFirewallRule -DisplayName \"Remote Desktop (TCP-In)\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For a web server, enable only the IIS HTTP\/HTTPS rules and leave the rest denied:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Enable-NetFirewallRule -DisplayName \"World Wide Web Services (HTTP Traffic-In)\"\nEnable-NetFirewallRule -DisplayName \"World Wide Web Services (HTTPS Traffic-In)\"<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Built-in rules worth auditing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On a fresh Windows Server image, a handful of built-in inbound rules are enabled by default. Audit each one against what the box actually needs to do:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Remote Desktop (TCP-In):<\/strong> scope it to trusted IPs or disable it; RDP should never be open to the whole internet.<\/li>\n<li><strong>File and Printer Sharing (SMB-In):<\/strong> disable on a public interface; port 445 is a favorite target for scanners.<\/li>\n<li><strong>World Wide Web Services (HTTP\/HTTPS):<\/strong> enable only if the box runs IIS and you have configured bindings.<\/li>\n<li><strong>ICMPv4 Echo (ping):<\/strong> harmless, but disabling it hides the server from casual ping sweeps.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">The traps<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Locking yourself out:<\/strong> a &#8220;block all&#8221; inbound rule applied over RDP, or a scoped rule with the wrong IP, ends your session. Always keep the provider console as a fallback and test from a second session.<\/li>\n<li><strong>Disabled by third-party software:<\/strong> some security suites and a few provider images turn the firewall off. Re-enable it with <code>Set-NetFirewallProfile -Profile Public -Enabled True<\/code>.<\/li>\n<li><strong>Wrong profile:<\/strong> a rule bound only to Domain silently does nothing on a Public network &#8212; bind rules to all three profiles unless you have a reason not to.<\/li>\n<li><strong>Blocking outbound:<\/strong> aggressive outbound rules can break Windows Update and KMS activation. If you restrict outbound, allow 80\/443 and the activation endpoints first.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">A minimal hardening sequence<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Verify the firewall is enabled on all profiles: <code>Get-NetFirewallProfile<\/code>.<\/li>\n<li>Scope the RDP rule to your IP ranges (or disable the built-in rule and add a scoped one).<\/li>\n<li>Enable only the service rules you need: HTTP\/HTTPS for IIS, 1433 for SQL Server if required.<\/li>\n<li>Add explicit block rules for anything you never want exposed, such as SMB (445) on a public interface.<\/li>\n<li>Test every change from a second session, and keep the provider console ready.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Verifying your work<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After each change, confirm what is actually allowed: <code>Get-NetFirewallRule -Direction Inbound -Enabled True | Where-Object Profile -like \"*Public*\"<\/code> gives you the effective inbound surface. From another machine, <code>Test-NetConnection &lt;server-ip&gt; -Port 3389<\/code> (or a port scan) confirms only the ports you intended are reachable. If a scan shows something unexpected, the rule list is the first place to look &#8212; and the second is the network profile assignment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Bottom line<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Defender Firewall is already your default-deny perimeter; the job is to keep it on, scope what little you expose, and avoid the profile and lockout traps. That combination blocks most of the scan-and-exploit traffic that hits RDP and other services on a Windows VPS. If you are starting fresh and want a provider whose images keep the firewall intact and offer a console fallback, compare options in <a href=\"https:\/\/windows-vps.org\/#providers\">our Windows VPS comparison table<\/a> and <a href=\"https:\/\/windows-vps.org\/\">see the plans on our comparison page<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ready to apply these rules on a new box? <a href=\"https:\/\/interserver.net\/r\/1067805?url=interserver.net\/vps\/windows-vps.html\" rel=\"noreferrer noopener sponsored\" target=\"_blank\">InterServer&#8217;s Windows VPS plans<\/a> (promo code <strong>TRYINTERSERVER<\/strong>, penny first month) and <a href=\"https:\/\/vultr.com\/?ref=9804308-9J\" rel=\"noreferrer noopener sponsored\" target=\"_blank\">Vultr&#8217;s Windows instances<\/a> both give you full firewall control and out-of-band console access.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every Windows Server VPS ships with Windows Defender Firewall enabled, yet most setup guides treat it as an afterthought. Understanding three concepts &#8212; profiles, rules, and the default-deny inbound model &#8212; lets you lock down a server without breaking RDP, IIS, or SQL Server. This guide walks through how the firewall thinks, then gives you &#8230; <a title=\"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/\" aria-label=\"Read more about Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-692","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control - Windows VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control\" \/>\n<meta property=\"og:description\" content=\"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-22T22:53:14+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/\",\"name\":\"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-08-22T22:53:14+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control - Windows VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/","og_locale":"en_US","og_type":"article","og_title":"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control","og_description":"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control","og_url":"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-08-22T22:53:14+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_misc":{"Written by":"windows-vps","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/","url":"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/","name":"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-08-22T22:53:14+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/windows-defender-firewall-windows-server-rules-profiles\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Windows Defender Firewall on Windows Server: Rules, Profiles, and Inbound Traffic Control"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/692","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=692"}],"version-history":[{"count":1,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/692\/revisions"}],"predecessor-version":[{"id":696,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/692\/revisions\/696"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}