Why the firewall blocks your app
The firewall is stateful: when your browser connects out to a website, the reply traffic is recognized and allowed back in automatically. What gets dropped is traffic nobody inside asked for — connections that arrive uninvited. That is why most apps never need an exception: they call out, they do not listen.
The few that do listen are the ones that get blocked: a Minecraft or Terraria server, a Plex library, Remote Desktop, a local dev server on port 3000, file sharing over SMB. And the block is profile-aware: Windows keeps separate rules for Domain, Private and Public networks, and treats Public — cafés, airports — far more strictly, by design.
- Hosting or joining a LAN game that uses direct IP connections
- Media servers such as Plex or Jellyfin streamed from your PC
- Remote Desktop, so another PC can reach yours
- Local development servers — Node, IIS Express, a local FTP or database
- File and printer sharing over your home network
- Your own server software that you want reachable on the LAN
Allowing an app through the firewall
Open Windows Security (search for it, or click the shield icon in the tray), go to Firewall & network protection and click Allow an app through firewall. In the classic dialog that opens, click Change settings — you need administrator rights for that — then Allow another app, Browse to the program's .exe file and click Add. Back in the list, tick the box next to your app under Private, and under Public only if you really mean it.
The network types matter more than people think. Private means your home or trusted network; Public means airports, hotel Wi-Fi and other networks you share with strangers. An app that needs to be reachable at home rarely needs to be reachable from a café. When in doubt, tick Private only — you can always come back later and widen the rule.
Cleaning up rules, and the command line for those who prefer it
Rules you no longer use deserve deletion: after you uninstall an app, its entry stays in the allowed list forever, and a stale rule that points at a missing .exe is a small but real risk surface. In the same dialog, select the app and click Remove. If things have gone thoroughly wrong, the Firewall & network protection page has a restore-defaults button that wipes every custom rule — including the ones you wanted, so treat it as a last resort, and never just switch the firewall off.
For scripted setups, one line does the job. In an elevated PowerShell: New-NetFirewallRule -DisplayName "My App" -Direction Inbound -Program "C:\Program Files\MyApp\app.exe" -Action Allow -Profile Private. The older netsh advfirewall firewall add rule name="My App" dir=in action=allow program="C:\Program Files\MyApp\app.exe" enable=yes profile=private works the same. Both create exactly the kind of rule the dialog does, and you remove them later with Remove-NetFirewallRule -DisplayName "My App".
Questions and Answers
Why is my app blocked by the firewall even though Windows never asked?
Some apps install their rule silently, some never trigger a prompt, and the prompt is easy to dismiss. In that case add the .exe manually via Allow an app through firewall.
Should I allow apps on public networks?
As a rule, no. Public is for networks you share with strangers; allow Public only for apps you deliberately want reachable from anywhere.
Does Windows Firewall block outgoing connections?
No — outbound traffic is allowed by default. Blocking an app's internet access takes a custom outbound rule.
Know what is included before you buy.
The one-time 30-minute trial covers core tools. PRO-labelled features stay locked until a paid license is activated.
Read next
Write to us: [email protected]