How to Allow VPN Through Windows Firewall
If your VPN connects but internet access, remote apps, or internal resources fail, Windows Firewall may be blocking the traffic you need.
This guide explains how to allow VPN through Windows Firewall in a way that preserves security while restoring reliable connectivity.
Why Windows Firewall Can Interfere with VPN Traffic
Windows Defender Firewall filters network traffic based on app rules, ports, protocols, and network profiles such as Domain, Private, and Public.
A VPN client may need to create a tunnel interface, exchange authentication traffic, and route application data through that tunnel, and any of those steps can be affected by restrictive firewall rules.
Common VPN technologies include OpenVPN, WireGuard, IKEv2, L2TP/IPsec, and SSTP.
Each protocol uses different ports and services, so the firewall rule you need depends on the VPN client and the tunnel type.
Before You Change Firewall Rules
Check whether the VPN provider recommends a specific port or protocol before editing Windows settings.
Also confirm that the VPN software is installed correctly, the network adapter is enabled, and the VPN server is reachable from your current network.
- Update the VPN client to the latest version.
- Verify Windows is fully updated.
- Temporarily disconnect from other security tools that may also filter traffic, such as third-party firewalls or endpoint protection.
- Document any existing custom firewall rules before changing them.
How to Allow a VPN App Through Windows Defender Firewall
The simplest method is to allow the VPN application itself through the firewall.
This is often enough for client software such as Cisco AnyConnect, NordVPN, OpenVPN Connect, Proton VPN, or FortiClient.
- Open Windows Security.
- Select Firewall & network protection.
- Choose Allow an app through firewall.
- Select Change settings.
- Find your VPN client in the list, or click Allow another app to add it manually.
- Enable the checkboxes for the network profiles you use, usually Private and sometimes Public.
- Save the changes and reconnect the VPN.
This method works best when the VPN client needs broad permission to create and manage the tunnel.
If the app is missing from the list, use the advanced firewall console to create a custom rule.
How to Create a Custom Inbound or Outbound Rule
Some VPNs need a rule for a specific executable, port, or protocol.
Windows Defender Firewall with Advanced Security gives you more control than the basic allow-list screen.
To create a rule for the VPN executable
- Press Win + R, type wf.msc, and press Enter.
- Open Outbound Rules or Inbound Rules depending on the need.
- Click New Rule.
- Select Program and browse to the VPN client executable.
- Choose Allow the connection.
- Select the profiles that apply: Domain, Private, and/or Public.
- Name the rule clearly, such as Allow OpenVPN Client.
To create a rule for a port or protocol
- In New Rule, select Port.
- Choose TCP or UDP based on the VPN protocol.
- Enter the required port number.
- Allow the connection and apply the correct profiles.
Use port rules only when the provider documents a specific requirement, because broad port access can weaken your security posture.
Which Ports and Protocols Does a VPN Typically Use?
Different VPN protocols rely on different network traffic patterns.
The most common examples include:
- OpenVPN: Typically uses UDP 1194, but can also use TCP 443 or other custom ports.
- WireGuard: Commonly uses UDP 51820, though the port can be customized.
- IKEv2/IPsec: Commonly uses UDP 500 and UDP 4500.
- L2TP/IPsec: Uses UDP 500, UDP 4500, and UDP 1701.
- SSTP: Uses TCP 443 and often blends with standard HTTPS traffic.
If you are unsure which one applies, check your VPN provider’s documentation or administrator guidance.
Enterprise environments often define exact ports and server addresses in policy documents or Microsoft Intune profiles.
How to Allow VPN Traffic on Specific Network Profiles
Windows Firewall treats network profiles differently, and this matters if your VPN works on one network but not another.
A rule that is enabled only for Private networks may fail on hotel Wi-Fi, public hotspots, or unmanaged office networks.
When editing or creating a rule, review the profile options carefully:
- Domain: For devices connected to an Active Directory domain.
- Private: For trusted home or work networks.
- Public: For untrusted networks such as airports, cafes, and guest Wi-Fi.
For most remote access VPNs, enabling the app or rule on all three profiles improves reliability, but organizations may intentionally restrict access to reduce risk.
How to Allow VPN Through Windows Firewall for Split Tunneling
Split tunneling routes some traffic through the VPN and other traffic outside it.
This setup is common in corporate remote work environments because it reduces bandwidth usage and preserves access to local devices or cloud services.
To support split tunneling, your firewall rules may need to allow both the VPN client and the specific internal apps that must communicate through the tunnel.
In some cases, you also need rules for DNS traffic, remote desktop services, or application-specific ports such as 3389 for Remote Desktop Protocol.
- Verify which subnets are routed through the VPN.
- Allow the VPN client executable in Windows Firewall.
- Create app-specific rules for internal tools that depend on the tunnel.
- Confirm that DNS servers reachable through the VPN are not blocked.
Troubleshooting If the VPN Still Does Not Work
If the VPN connects but traffic still fails, the issue may be caused by a secondary firewall, an incorrect route, or a blocked protocol.
Use a systematic approach instead of disabling protection entirely.
Check the Windows Firewall profile in use
Open Firewall & network protection and confirm which profile is active.
If the current profile is stricter than expected, your rule may not apply.
Look for third-party security software
Products from Sophos, McAfee, Bitdefender, CrowdStrike, and other vendors can enforce separate filtering rules.
A Windows Firewall exception will not override those controls.
Test with a known VPN port
If your provider allows TCP 443, test it because it is often less likely to be blocked on restrictive networks.
For WireGuard and IKEv2, confirm that UDP traffic is not being filtered upstream.
Review logs and connection status
Open the VPN client logs, Windows Event Viewer, and firewall logs if enabled.
Authentication failures, DNS errors, and dropped packets each point to different fixes.
Security Best Practices When Allowing VPN Through Windows Firewall
Allowing VPN traffic should be precise, not permissive.
The goal is to permit only the traffic needed for the tunnel and the applications that depend on it.
- Prefer app-based rules over wide-open port exceptions.
- Limit rules to the correct network profiles.
- Remove temporary exceptions after testing.
- Use the minimum set of ports required by your VPN protocol.
- Keep both Windows and VPN software updated to close known vulnerabilities.
In managed environments, use Group Policy, Intune, or endpoint management tools to deploy consistent firewall settings.
That reduces configuration drift and makes troubleshooting easier across multiple devices.
When to Ask Your IT Administrator for Help
If you are on a work-managed device, local firewall changes may be overridden by policy.
Your administrator may need to update Microsoft Defender Firewall rules, endpoint security profiles, or VPN gateway settings in Azure, Cisco Secure Client, or a similar platform.
Escalate the issue if you see repeated authentication loops, tunnel drops, unreachable internal subnets, or a VPN client that works only when Windows Firewall is disabled.
Those symptoms often indicate a policy conflict rather than a simple app exception problem.