Is there any way to add a firewall rule that essentially says, "deny if remoteip= and localport DOES NOT EQUAL ?

I have a network interface connected to a shared network and on that network I only want one TCP port available. But the server is connected to multiple private networks so the private network firewall profile is insufficient here.

  • 1
    To be honest I've just spent 15 minutes trying to imagine what exactly you're trying to achieve (as in what rule).
    – LukeP
    Oct 25, 2011 at 9:10

1 Answer 1


I think it will be much easier to create a rule if you follow these rules:

  1. Deny everything from everywhere on every port.

  2. Open only what you want: netsh advfirewall firewall add rule name=”Rule” dir=in action=allow enable=yes remoteip= profile=private protocol=TCP localport=80

I think you're making it more difficult than it actually is. You should always follow this pattern. Specific DENY rules go out of control very quickly. It's much easier to deny everything and maintain ALLOW rules only.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .