Windows Firewall Rules That Will Not Lock You Out

Windows Defender Firewall is the control that decides whether your hardening exists on the wire. A Public profile with DefaultInboundAction Block is the right starting point on a VPS. The way people lock themselves out is predictable: they disable the Remote Desktop group, they set RemoteAddress to the wrong IP, or they turn the whole firewall off "to test" and never turn it back on.

The rule for changing inbound policy on a public IPv4 is operational, not theoretical. Keep an existing RDP session or the provider console. Make one change. Open a second RDP connection. Only then close the first session. If the second connection fails, revert from the session that still works.

See what is already allowed

Before you add rules, print the ones that already accept traffic. Server 2022 ships groups for Remote Desktop, File and Printer Sharing, World Wide Web Services, and WinRM. Some are enabled. Some are scoped to Any. Any on 3389 is the problem you came here to fix.

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction
Get-NetFirewallRule -Direction Inbound | Where-Object { $_.Enabled -eq 'True' -and $_.Action -eq 'Allow' } |
  Select-Object DisplayName, Profile, Direction, Action | Format-Table -AutoSize
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Get-NetFirewallAddressFilter | Format-List
Get-NetFirewallRule -DisplayGroup 'World Wide Web Services (HTTP)' | Format-Table DisplayName, Enabled, Profile

If a profile shows Enabled False, you do not have a firewall. Enable it. Do not set DefaultInboundAction to Allow. Add explicit Allow rules for 80, 443, and a scoped 3389.

Change RDP without painting yourself in

The Remote Desktop group is several rules (TCP-In, UDP-In, shadow). Set-NetFirewallRule -DisplayGroup applies to all of them, which is what you want. RemoteAddress can be a single IPv4, a comma list, or a CIDR. Use your current public IP first, test, then add a second office prefix.

$Keep = Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.IPAddress -notlike '127.*' }
$AdminIps = @('203.0.113.10', '198.51.100.25')
Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -Enabled True -Profile Any -RemoteAddress $AdminIps
New-NetFirewallRule -Name 'IIS-HTTP-Public' -DisplayName 'IIS HTTP 80' -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow -Profile Public
New-NetFirewallRule -Name 'IIS-HTTPS-Public' -DisplayName 'IIS HTTPS 443' -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow -Profile Public
Disable-NetFirewallRule -DisplayGroup 'File and Printer Sharing'
Disable-NetFirewallRule -DisplayName 'Windows Remote Management (HTTP-In)'
Get-NetFirewallRule -Name 'IIS-HTTP-Public', 'IIS-HTTPS-Public' | Format-Table Name, Enabled, Direction, Action

203.0.113.10 and 198.51.100.25 are documentation addresses. Put yours in. If your ISP uses CGNAT, your "public" IP as seen by the VPS is not the RFC1918 address ipconfig shows on the laptop. Use a "what is my IP" view from the same workstation you will RDP from, then set RemoteAddress to that.

New-NetFirewallRule needs a unique -Name. If you re-run the script, remove the old rule first or the cmdlet errors and people "fix" it by disabling the firewall. File and Printer Sharing on a public IPv4 is how 445 becomes a headline. Disable the group until you have a scoped SMB design.

Block sets and logging

A Block rule for 445, 135, 139, and 5985 from Any is a useful belt even if DefaultInboundAction is already Block. Explicit blocks show up in logs and survive someone later enabling a sharing group. Enable firewall logging to a file on High-Speed SSD with a size cap, and read dropped packets when an app "cannot connect".

Do not create an Allow for Any/Any. Do not use netsh advfirewall set allprofiles state off. Do not manage rules only in the GUI if you will later overwrite them with a script. Pick one source of truth.

UDP 3389 is part of modern RDP. If you allow TCP 3389 and block UDP, connections still work and you lose some performance. Scope both. If you change the RDP port, change the firewall rule to match; leaving 3389 open and moving the service is not stealth, it is two listeners.

Profiles matter more on a VPS than on a domain-joined office PC. A guest on a public IPv4 often lands on the Public profile even if you think of it as "the server". A rule you created for Domain or Private will not apply, and you will think the firewall is broken. Create HTTP and HTTPS allows on Public. Keep RDP scoped on Any so a profile flip does not lock you out. Confirm with Get-NetFirewallProfile after every reboot until you trust the profile assignment.

Takeaway

Leave the firewall on, scope RDP before you add public HTTP, and prove a second session before you disconnect the first. Explicit allows beat a disabled firewall every time. Apply this on a Windows VPS at Netbay in Lucknow, where L3/L4 DDoS filtering sits in front of a guest firewall you still have to get right, at netbayhosts.in.