guide · static export
Security

Open a Port for a LAN Game Server in Windows Firewall

A server that shows up on the host and nowhere else is a firewall rule away from working. An inbound rule scoped to the local subnet is the safe version.

by@guidox updated:10/31/26 time:25 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:Admin rights, Second PC
TL;DR

Create an **inbound rule** for the exact port and protocol, scope it to the **local subnet**, and test from a second machine. A rule with no scope is open to every network the laptop joins.

Before you start

Requirements

  • Admin rights
  • The game's port number
  • A second PC to test
Step by step

Instructions

01

Find the port and the protocol

The server documentation names a UDP or TCP port, often both. Guessing the protocol is the most common reason a correct rule still fails.

02

Check what is listening

If no process is listening on the port, no firewall rule can help. Confirm the server is actually bound before you change the settings.

netstat -ano | findstr :27015
03

Create a scoped inbound rule

The wizard's program path option is safer than a port rule when the server binary is fixed, but a port rule survives updates that replace the executable. Either way, set the scope.

wf.msc > Inbound Rules > New Rule > Port
⚠ warningLeaving the scope on Any profile opens the port in cafes and hotel networks. Set Remote IP to the local subnet unless the server is meant for the internet.
04

Set the profile correctly

A home network is usually Private, a fresh connection often Public. A rule enabled for Private only does nothing while the adapter reports Public.

Settings > Network & internet > Wi-Fi > Network profile type
05

Test from another machine

Use the host's LAN address, not localhost, and connect with the game client. A test from the host proves nothing because loopback traffic never reaches the firewall.

ipconfig
tipIf the client connects by name but not by address, the problem is name resolution, not the firewall.
06

Write down what you opened

A rule from last year is invisible until it matters. Keep a note of port, protocol and scope, or name the rule so the next person can find it.

netsh advfirewall firewall show rule name=all | findstr /i game
Troubleshooting

Common issues

Still no connection after the rule

The rule is on the wrong profile, the server is not listening, or the router blocks the traffic between subnets.

It works over LAN but not over the internet

Port forwarding on the router is a separate step, and it exposes the host. Prefer a VPN tunnel.

The rule exists but is disabled

Check the Enabled column. A rule created by a wizard can be saved switched off.

Windows resets the rule after an update

A third-party firewall suite replaced the rules. Recreate them in the suite's own console.

FAQ

Frequently asked

Is opening a port dangerous?

It exposes that one service to the addresses in the scope. Scoped to the subnet, the risk is small.

Do I need a static IP?

For a server other machines find by name, yes. The router can reserve the address by MAC.

How to undo this

Delete the rule in **wf.msc > Inbound Rules** or with **netsh advfirewall firewall delete rule name="<rule>"**. The port closes immediately for new connections.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress