Windows Defender Firewall with Advanced Security: Scoped Inbound Rules

Windows Defender Firewall with Advanced Security (WFAS) manages Windows Defender Firewall rules through the wf.msc Microsoft Management Console snap-in. This walkthrough creates a custom inbound rule for a service listening on TCP port 8443, limited to an approved management subnet and the Domain profile.

Replace the port, executable path, and subnet with the values approved for your service. On domain-managed systems, create or edit the rule in the controlling Group Policy Object (GPO); a local rule can be overridden by policy. The MMC requires administrator rights to change local firewall policy.

---

Step 1: Open WFAS and Review the Inbound Rules

01

Launch the Firewall MMC Snap-in

Console

Open the local Windows Firewall with Advanced Security console, then select Inbound Rules. Review the existing rules for the application or port before adding another one. On a domain device, check whether the console is connected to Local Computer or editing a GPO.

Win + R
wf.msc

❯ View Expected Console Output

Console tree:
Windows Defender Firewall with Advanced Security
  Inbound Rules
  Outbound Rules
  Connection Security Rules
  Monitoring

Figure 1: Windows Defender Firewall with Advanced Security (wf.msc) showing the active Inbound Rules table, profiles, and the Actions pane.

Local policy and Group Policy

Use the Group Policy Management Editor when a domain GPO owns the firewall configuration. The local WFAS console can show resultant rules, but a locally created rule may not apply if local rule merging is disabled or a conflicting domain policy controls the setting.

---

Step 2: Start a Custom Inbound Rule

02

Choose Custom to Expose the Full Wizard

Rule Type

With Inbound Rules selected, choose Action → New Rule. On the Rule Type page, choose Custom. The Port option is shorter, but Custom exposes the Program and Scope pages so the rule can be limited to the service executable and approved sources.

Inbound Rules → Action → New Rule → Custom → Next

❯ View Expected Console Output

Program page:
  This program path: <full path to the service executable>

Select Next. Use the specific executable when the service has a dedicated program.

---

Step 3: Set the Protocol and Local Port

03

Allow TCP 8443 for the Service

Protocol and Ports

On Protocol and Ports, choose TCP and Specific local ports, then enter 8443. For inbound TCP/UDP rules, this page configures the local listening port. The remote client source port is not configured here and is normally dynamic.

Protocol type: TCP
Local port:    Specific local ports → 8443

❯ View Expected Console Output

The rule matches TCP connections addressed to local port 8443.

Figure 2: New Inbound Rule Wizard on the Protocol and Ports page selecting TCP protocol and specifying local destination port 8443.

---

Step 4: Restrict the Scope to the Management Subnet

04

Limit Remote Addresses to Approved Clients

Scope

On Scope, leave local addresses as Any IP address unless this server listens on multiple networks and the service should be reachable only on a specific interface address. Under remote addresses, choose These IP addresses and add the approved management subnet. For this walkthrough, enter 10.20.30.0/24; replace it with the source subnet from your network plan.

Which local IP addresses does this rule apply to?
  Any IP address

Which remote IP addresses does this rule apply to?
  These IP addresses: 10.20.30.0/24

❯ View Expected Console Output

Only clients whose source address is in 10.20.30.0/24 match this rule.

Figure 3: New Inbound Rule Wizard on the Scope page with the modal dialog adding remote management subnet 10.20.30.0/24.

---

Step 5: Choose the Action and Network Profile

05

Allow Only the Intended Service Traffic

Policy

Select Allow the connection only if this traffic is required and the service is protected by its own authentication and authorization controls. Apply the rule to Domain only when the host is domain joined and the service should accept traffic only on that network profile. Finish with a unique name and description so another administrator can identify its purpose and owner.

Action:   Allow the connection
Profile:  Domain
Name:     Admin Portal - TCP 8443 - Management Subnet
Description: Inbound access to the admin portal from 10.20.30.0/24.

❯ View Expected Console Output

Rule created with a narrow program, port, source subnet, and profile scope.

Verify the service and network path

An allow rule does not start the application or guarantee connectivity through upstream firewalls, routers, or cloud security controls. Confirm that the service listens on TCP 8443 and that the approved management clients can reach it before closing the change.

---

Step 6: Verify the Rule and Test from an Approved Client

06

Inspect the Effective Rule and Test Reachability

Verification

Confirm the rule is enabled with the intended direction, action, profile, local port, and remote address. Test from a client inside the approved subnet, then verify a client outside that scope is not granted access by this rule. Other broader allow rules can independently permit traffic, so evaluate the complete effective policy when validating the negative test.

$Rule = Get-NetFirewallRule -DisplayName 'Admin Portal - TCP 8443 - Management Subnet'
$Rule | Select-Object DisplayName, Enabled, Profile, Direction, Action
$Rule | Get-NetFirewallPortFilter | Select-Object Protocol, LocalPort
$Rule | Get-NetFirewallAddressFilter | Select-Object LocalAddress, RemoteAddress

# Run from an approved management client:
Test-NetConnection admin-portal.contoso.com -Port 8443

❯ View Expected Console Output

Enabled       : True
Profile       : Domain
Direction     : Inbound
Action        : Allow
Protocol      : TCP
LocalPort     : 8443
RemoteAddress : 10.20.30.0/24
TcpTestSucceeded : True

For the supported wizard workflow, see Microsoft’s Configure firewall rules with Group Policy. For rule details and scoping guidance, see Windows Firewall rule authoring.