Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to add a firewall rule that essentially says, "deny if remoteip= and localport DOES NOT EQUAL ?

I have a network interface connected to a shared network and on that network I only want one TCP port available. But the server is connected to multiple private networks so the private network firewall profile is insufficient here.

share|improve this question
To be honest I've just spent 15 minutes trying to imagine what exactly you're trying to achieve (as in what rule). – LukeP Oct 25 '11 at 9:10

I think it will be much easier to create a rule if you follow these rules:

  1. Deny everything from everywhere on every port.

  2. Open only what you want: netsh advfirewall firewall add rule name=”Rule” dir=in action=allow enable=yes remoteip= profile=private protocol=TCP localport=80

I think you're making it more difficult than it actually is. You should always follow this pattern. Specific DENY rules go out of control very quickly. It's much easier to deny everything and maintain ALLOW rules only.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.