Add or Edit Firewall Rule

Rules can be created for either inbound traffic or outbound traffic. The rule can be configured to specify the program, service, protocol, or port. As your IT environment changes, you can change, create, or delete rules.

Firewall rules are applied in the following order of priority:

• Authenticated bypass (rules that override block rules)
  
  
• Block connection
  
  
• Allow connection
  
  

Because Windows Firewall with Advanced Security blocks all incoming unsolicited TCP/IP traffic by default, you might need to configure program, port, and system service rules for programs or services that are acting as servers, listeners, or peers. Program, port, and system service rules must be managed on an ongoing basis as your server roles or configurations change.

Important

The settings for a firewall rule add increasing levels of restriction to the criteria for which connection requests will match the rule. For example, if you do not specify a program or service on the Program and Services tab, all programs and services will be allowed to connect if they match other criteria. Therefore, adding more detailed criteria makes the rule progressively more restrictive and less likely to be matched.

To add a program to the rules list, you must specify the full path to the executable (.exe) file used by the program. A system service that runs within its own unique .exe file and is not hosted by a service container is considered to be a program and can be added to the rules list. In the same way, a program that functions like a system service and runs whether or not a user is logged on to the computer is also considered a program, as long as it runs within its own unique .exe file.

	Caution
	Adding programs that host services, such as Svchost.exe, Dllhost.exe, and Inetinfo.exe, to the rules list without further restrictions in the rule might expose the computer to security threats. Also, adding these programs might conflict with other service-hardening policies on computers running Windows Server 2008 R2 or Windows Server 2008.

When you add a program to the rules list, Windows Firewall with Advanced Security dynamically opens (unblocks) and closes (blocks) the ports required by the program. When the program is running and listening for incoming traffic, Windows Firewall with Advanced Security opens the required ports; when the program is not running or is not listening for incoming traffic, Windows Firewall with Advanced Security closes the ports. Because of this dynamic behavior, adding programs to the rules list is the recommended method for allowing unsolicited incoming traffic through Windows Firewall with Advanced Security.

	Note
	You can use program rules to allow unsolicited incoming traffic through Windows Firewall with Advanced Security only if the program uses Windows Sockets (Winsock) to create port assignments. If a program does not use Winsock to assign ports, you must determine which ports the program uses and add those ports to the rules list.

In some cases, if you cannot add a program or system service to the rules list, you must determine which port or ports the program or system service uses and then add the port or ports to the Windows Firewall with Advanced Security rules list.

On the Protocols and Ports tab, you can select from a list of the most commonly used protocols and their associated protocol number. If the protocol that you need to add is not in the list, you can select Custom and specify the protocol number.

If you select either the TCP or UDP protocol, you can then specify the local and remote ports to which the rule applies. When you add a TCP or UDP port to the rules list, the port is open (unblocked) whenever Windows Firewall with Advanced Security is running, whether or not there is a program or system service listening for incoming traffic on the port. For this reason, if you need to allow unsolicited incoming traffic through Windows Firewall with Advanced Security, you should create a program rule instead of a port rule.

Use the Scope tab to specify an IP address, a subnet, or a range of IP addresses. You can use both IPv4 and IPv6 IP addresses.