Edit or Delete a Connection-Specific Port Firewall Rule

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Use this procedure to edit or delete a TCP or UDP port that is in the Windows Firewall exceptions list on a per-connection basis. This is useful if your computer has multiple network connections (sometimes referred to as interfaces) and you have opened different ports (created specific exceptions) on each network connection.

Administrative Credentials

To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure.

To edit or delete a connection-specific port exception

This procedure can be performed using the graphical user interface or the command prompt. You cannot use Group Policy to configure per-connection port exceptions.

Using the graphical user interface

To edit or delete a connection-specific port exception

  1. Open Windows Firewall, and click the Advanced tab.

  2. In Network Connection Settings, click the connection that the system service uses to communicate, and then click Settings.

  3. Click the system service that you want to edit or delete.

    If you want to delete the system service exception, click Delete, and then click OK.

    If you want to edit the system service exception, click Edit, make changes to the system service exception settings, and then click OK.

If a Windows Firewall setting appears dimmed in the graphical user interface, and on the General tab, you see For your security, some settings are controlled by Group Policy, the setting might be managed by Group Policy. If all Windows Firewall settings appear dimmed, and on the General tab, you see You must be a computer administrator to change these settings, you do not have administrative rights to configure Windows Firewall.

Using the command prompt

To edit or delete a connection-specific port exception

  • Type the following at the command prompt, and press ENTER:

    netsh firewall set portopening protocol = protocol port = port name = name mode = mode interface = "interface"

Substitute values for the placeholders in italics. The following table lists possible values for each placeholder.

Placeholder Possible Values Description

protocol

TCP, UDP, All

Specifies the protocol for the port. Use All to specify both TCP and UDP.

port

Any number between 1 and 65,535

Specifies the port number for which you want to create an exception.

name

Any string less than 256 characters

Specifies the friendly name of the port exception. You must enclose name in quotation marks.

mode

enable, disable

Specifies whether to enable or disable the exception.

interface

The name of any network connection that can exist on the computer, as displayed in the Network Connections folder

Specifies the connection, or interface, on which to enable or disable the exception. You must enclose interface in quotation marks.

If you get an "Access Denied" message when you run a command, you do not have administrative rights to configure Windows Firewall. If you get an "Ok" message but the command does not take effect, the setting might be managed by Group Policy.

Notes

  • To start Windows Firewall, click Start, point to Control Panel, and then click Windows Firewall.

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command Prompt.

  • Windows Firewall is not included in the original release of the Windows Server 2003 operating systems.

  • You cannot change the name of a per-connection port exception by clicking Edit. To rename a per-connection port exception, delete the exception and create a new exception with the new name.

See Also

Concepts

Configuring Firewall Rules for Specific Connections
Known Issues for Managing Firewall Rules
Configuring Port Firewall Rules