Windows Firewall Rules for a Game Server (Inbound TCP and UDP)

To let players reach a game server on Windows, add an inbound rule in Windows Defender Firewall with Advanced Security (wf.msc): Inbound Rules, New Rule, Port, choose TCP or UDP, enter the game's port, Allow the connection, tick Domain, Private and Public, and name it. Or run one PowerShell line as administrator, shown below. If it still fails, look for Block rules for the server program: Windows creates them silently when someone clicks Cancel on the first "allow access" prompt, and block rules beat allow rules.

The one line version

Open PowerShell as administrator (right click Start, Terminal (Admin)) and run the line for your game. Change the port and protocol to match.

New-NetFirewallRule -DisplayName "Valheim server UDP" -Direction Inbound -Protocol UDP -LocalPort 2456-2457 -Action Allow -Profile Any

For a game that needs TCP and UDP, make two rules:

New-NetFirewallRule -DisplayName "7DTD TCP" -Direction Inbound -Protocol TCP -LocalPort 26900 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "7DTD UDP" -Direction Inbound -Protocol UDP -LocalPort 26900-26902 -Action Allow -Profile Any

The older netsh command does the same and works in Command Prompt:

netsh advfirewall firewall add rule name="Minecraft TCP" dir=in action=allow protocol=TCP localport=25565

The click by click version

1. Press Win + R, type wf.msc, press Enter.
2. Click Inbound Rules on the left, then New Rule on the right.
3. Choose Port, click Next.
4. Choose TCP or UDP, select Specific local ports, enter the port or range (for example 2456-2457 or 25565). Next.
5. Choose Allow the connection. Next.
6. Tick Domain, Private and Public. Next.
7. Name it something you will recognize, like Palworld 8211 UDP. Finish.

Repeat for the other protocol if the game needs both. Common ports:

The full list is in how to port forward a game server. The firewall rule and the router forward are two separate locks; you need both open.

Port rule or program rule

A port rule (above) opens a port for any program. A program rule allows one .exe on any port. Program rules are what the "Windows Defender Firewall has blocked some features of this app" prompt creates.

Program rules break more easily:

• Java servers run as java.exe or javaw.exe. If you update Java, the path changes and the old rule no longer matches.
• Steam server tools sometimes launch a different executable from the one you allowed.
• Updates to the server program can move it to a new folder.

Port rules do not care which program is listening, so they keep working through updates. For a dedicated server, use port rules.

The hidden block rules

This is the reason most people's "I added the rule and it still does not work" stories end in frustration.

The first time a server program starts, Windows shows an allow prompt. If someone clicked Cancel, closed it, or only allowed Private while the network was set to Public, Windows creates Block rules for that program. In Windows Firewall, a block rule wins over an allow rule. Your new port rule is ignored for that program.

To find and remove them:

1. Open wf.msc and click Inbound Rules.
2. Click the Action column header to sort, or use Filter by State.
3. Look for red circle icons with names like java(tm) platform se binary, OpenJDK Platform binary, PalServer-Win64-Shipping, valheim_server or srcds.
4. Right click each block rule and choose Delete (or Disable Rule).

PowerShell version to list block rules:

Get-NetFirewallRule -Direction Inbound -Action Block | Select-Object DisplayName, Profile, Enabled

Public vs Private network

Windows treats each network as Public or Private, and rules can apply to one or both. If you ticked only Private and Windows decided your home Ethernet is Public, your rule does nothing.

Check it: Settings, Network & internet, click your connection, look at Network profile type. Set it to Private for your home network. Making the rule apply to all profiles (as in the commands above) avoids the question entirely.

Testing that the firewall is the problem

A quick check: temporarily turn off the firewall for the active profile, have a friend try to join, then turn it straight back on.

• Joins with the firewall off: the problem is your rules. Fix them as above.
• Still fails with the firewall off: the problem is the router, the protocol, or your ISP. Check double NAT and CGNAT.

Do not leave the firewall off. It protects every other service on the PC.

Third party antivirus firewalls

Suites like Norton, Bitdefender, ESET, Kaspersky and McAfee often replace Windows Firewall with their own. If you have one, wf.msc may say another program is managing the firewall, and your rules there are ignored. Add the same port rule in the suite's own firewall settings instead.

A server with no Windows Firewall involved

A hosted server runs on a machine where the game's ports are already open, so there are no firewall prompts, block rules or Java path changes to chase. GamezServers gives you a panel with every setting from the game's server template, a live console and SFTP, and your PC can stay off. See easy game server hosting.

FAQ

Do I need a firewall rule if I already port forwarded?

Yes. The router forward gets traffic to your PC, the firewall rule lets it past Windows to the server. Both are needed.

Should I tick Public when allowing a game server?

Tick it if your network might be set to Public, or set your home network to Private and allow only Private. Ticking all profiles on a desktop at home is the simplest working setup.

How do I allow Java through the firewall for Minecraft?

Use a port rule for TCP 25565 instead. It keeps working when Java updates and changes its install path.

Does Windows Firewall block UDP by default?

It blocks all unsolicited inbound traffic, TCP and UDP, unless a rule allows it.