Allow a Packaged App to Reach a Local Server

TL;DR

Use **CheckNetIsolation LoopbackExempt -a -n=<package family name>** to exempt one package, then verify with **-s**. Remove the exemption again when you are done testing.

Before you start

Requirements

Admin rights
The package family name
10 minutes

Step by step

Instructions

Reproduce the failure and note the port

The app shows a generic connection error. A working browser request to the same port proves the server is fine and the sandbox is the blocker.

Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 8080 | Select-Object LocalAddress,LocalPort,OwningProcess
Invoke-WebRequest http://localhost:8080/ -UseBasicParsing | Select-Object StatusCode
Get-Process -Id (Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 8080).OwningProcess | Select-Object Name,Id

Find the package family name

**Get-AppxPackage** prints the PackageFamilyName, which is the identifier the exemption tool expects. A wrong name fails silently.

Get-AppxPackage | Where-Object Name -like '*App*' | Select-Object Name,PackageFamilyName,InstallLocation
Get-AppxPackage -Name 'Microsoft.WindowsCalculator' | Select-Object PackageFamilyName

Add the loopback exemption

**CheckNetIsolation** changes the per-user exemption list. **-a** adds, **-d** deletes, and **-s** shows what is currently exempt.

CheckNetIsolation LoopbackExempt -s
CheckNetIsolation LoopbackExempt -a -n="Microsoft.WindowsCalculator_8wekyb3d8bbwe"
CheckNetIsolation LoopbackExempt -s

Test from inside the app

The exemption applies at the next connection, not to an existing one. Close the app completely, start it, and retry the action.

Get-Process | Where-Object { $_.Path -like '*WindowsApps*' } | Select-Object Name,Id
# close and restart the app, then retry
Get-NetTCPConnection -State Established | Where-Object LocalPort -eq 8080 | Select-Object RemoteAddress,RemotePort

Scope the server to the loopback interface

A dev server bound to 0.0.0.0 is reachable from the network, which is worse than an exemption. Bind it to 127.0.0.1 when only local apps need it.

Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 8080 | Select-Object LocalAddress
# bind the dev server explicitly, e.g. --host 127.0.0.1
netsh interface ipv4 show excludedportrange protocol=tcp

Remove the exemption after testing

Every exemption widens what the sandbox can reach. Delete it with **-d** once the test is over, and confirm the list is back to its previous size.

CheckNetIsolation LoopbackExempt -d -n="Microsoft.WindowsCalculator_8wekyb3d8bbwe"
CheckNetIsolation LoopbackExempt -s

Troubleshooting

Common issues

CheckNetIsolation says the package is not found

The name is the PackageFamilyName, not the display name. Copy it exactly, including the publisher hash.

The app still cannot connect

It may use a different host name or IPv6 loopback. Check with Get-NetTCPConnection whether a connection attempt appears at all.

The exemption list is empty after a restart

It is per user and can be reset by a servicing update. Re-add it, or run the app outside the container during development.

The server refuses the connection from 127.0.0.1

It listens on another interface only. Bind it to 127.0.0.1 as well, then retest.

FAQ

Frequently asked

Is this the same as a firewall rule?

No. The firewall allows traffic; the app container blocks loopback regardless. Both have to permit it.

Should I ship this to users?

No. It is a development aid. A production app should not need a loopback exemption.

Does it affect other apps?

Only the listed package. Exempting everything with -a -n=all would weaken the isolation for every app on the machine.

How to undo this

Delete the exemption with CheckNetIsolation LoopbackExempt -d -n="<PackageFamilyName>" and confirm with -s that the entry is gone.

Changelog · 1 entry

2026-11-01
First version

Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress