New-NetFirewallRule
Use New-NetFirewallRule to create a Windows Firewall rule — allow an app or port inbound, block an outbound program, or open a port on one profile only.
Documentation: Microsoft Learn — new-netfirewallrule
Syntax
Try it
PowerShell example · browser support is limited.
Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.
Examples
Allow inbound web traffic on port 80
Show reference output
Illustrative output · values vary by environment
Name : {a1b2c3d4-e5f6-7890-abcd-ef1234567890}
DisplayName : Allow HTTP
Enabled : True
Direction : Inbound
Action : AllowBlock one application from reaching the internet
Show reference output
Illustrative output · values vary by environment
Name : {b2c3d4e5-f6a7-8901-bcde-f12345678901}
DisplayName : Block Telemetry App
Enabled : True
Direction : Outbound
Action : BlockAllow a port on the Domain profile only
Show reference output
Illustrative output · values vary by environment
Name : {c3d4e5f6-a7b8-9012-cdef-123456789012}
DisplayName : Allow SQL Domain Only
Profile : DomainParameters
Parameter definitions:
-DisplayName— The human-readable name shown in the firewall console. Make it descriptive.-Direction— Inbound or Outbound. Inbound controls traffic coming to this computer.-Action— Allow or Block.-Protocol— TCP, UDP, ICMPv4, ICMPv6, or Any.-LocalPort / -RemotePort— Ports to match. Accepts ranges like 5000-5010 and lists like 80,443.-Program— Full path to an application the rule applies to.-Service— A service name the rule applies to.-Profile— Domain, Private, or Public. The rule only applies on matching networks.-Enabled— True or False. A disabled rule exists but does nothing.
A rule on the wrong profile silently does nothing
The most common firewall-rule mystery is a rule that exists but never matches. Nine times out of ten the rule is scoped to the Domain profile while the computer sits on a Private or Public network. Check the active profile with Get-NetConnectionProfile before blaming the rule.
Block rules beat allow rules when both match the same traffic. If your allow rule does not work, list the block rules first: Get-NetFirewallRule | Where-Object Action -eq 'Block'. A broad block rule from another tool can swallow your traffic.
Creating rules needs administrator rights, and the rule applies immediately. Test from another machine right after creating an inbound rule, while you still remember exactly what you created.
List existing rules with Get-NetFirewallRule
Change a rule with Set-NetFirewallRule
Test the port with Test-NetConnection
Updated 25 October 2026. Browser outputs are fictional; check the installed module help for your environment.
Recap
New-NetFirewallRule Use New-NetFirewallRule to create a Windows Firewall rule — allow an app or port inbound, block an outbound program, or open a port on one profile only.
Next: New Scheduledtasktrigger