# How to Turn Off the Windows Firewall

> Turn the Windows Defender Firewall off per network profile or with netsh, and why allowing a single app through is nearly always the better answer.

- Source: https://zepe.online/guides/turn-off-windows-firewall
- Author: Robert Moca (https://zepe.online/author/robert-moca)
- Topic: Accounts and security
- Published: 2026-07-17T09:00:00+00:00
- Updated: 2026-08-10T09:00:00+00:00
- Author: Zepe editorial team (https://zepe.online/editorial-standards)
- Image: https://zepe.online/img/turn-off-windows-firewall-featured-91678749cd.webp

## The short answer

Open **Windows Security → Firewall & network protection**, click the profile marked *(active)*, and switch the firewall off. Usually you should add an inbound rule for the one app instead, which fixes it without removing protection.

## Key takeaways

- There are three separate firewall profiles — Domain, Private and Public, and turning one off leaves the others active.
- The firewall blocks inbound connections by default and allows outbound, so it rarely causes the problem people blame it for.
- An inbound rule for one port or one program is nearly always the right fix instead of disabling the firewall.
- Turning it off to test something is reasonable; leaving it off is not, and Windows will keep telling you so.

The Windows firewall gets switched off far more often than it ever needs to be, almost always as a quick diagnostic step that then never gets undone. Once you understand what it actually blocks, it becomes obvious how rarely it is the thing causing your problem.

## What the firewall actually blocks

By default, Windows Defender Firewall blocks **inbound** connections that do not match a rule, and lets **outbound** connections through. That asymmetry is the whole story. It means the firewall is almost never why your browser cannot reach a website, and quite often why nothing can reach the server you just started.

- **Browsing the web, streaming, downloading, using an app that talks to a server** — all outbound. The firewall does not interfere.
- **Another machine connecting to a server you are running** — inbound. This is what gets blocked, and it is the real reason people reach for the off switch.
- **File and printer sharing, remote desktop, a local dev server reached from a phone** — all inbound, all blocked until a rule exists.

> **Key point — If a website will not load, it is not the firewall**
>
> Outbound connections are permitted by default. A page that will not load, a program that cannot reach its server, a failing update — none of these are the firewall in its default configuration. The guide on [Wi-Fi connection problems](https://zepe.online/guides/connect-wifi-windows-laptop) covers the causes that actually produce those symptoms.

## The three profiles

Windows keeps three completely independent firewall configurations and applies whichever one matches the network you are currently on. This is the reason turning the firewall off can appear to do nothing at all: you turned off a profile you are not using.

**The three firewall profiles**

| Profile | Applies to | Default posture |
| --- | --- | --- |
| **Domain** | A network with a domain controller the PC is joined to | Managed by policy |
| **Private** | Networks you marked as home or work | Discovery and sharing permitted |
| **Public** | Anything else — cafés, hotels, mobile hotspots | Most restrictive |

Windows Security marks the active one with **(active)**. That is the only one that matters for what you are doing right now.

## Turning it off

### Turn off the firewall for the active network

1. Open **Windows Security** from the Start menu.
2. Click **Firewall & network protection**.
3. Click the profile marked **(active)**, usually Private network or Public network.
   Turning off a profile you are not currently on changes nothing you will notice.
4. Switch **Microsoft Defender Firewall** to **Off** and accept the prompt.
   Windows Security will show a persistent warning until you turn it back on. That warning is doing its job.

### From the command line

1. Open an elevated Command Prompt — **Win + X**, then **A**.
2. Turn off the current profile: `netsh advfirewall set currentprofile state off`.
   For all three at once: `netsh advfirewall set allprofiles state off`.
3. Turn it back on: `netsh advfirewall set currentprofile state on`.
   Write this down before you run the first command. It is easy to forget which profile you changed.
4. Check the current state with `netsh advfirewall show allprofiles`.
   Confirms which profiles are on and which is active, which is quicker than clicking through the interface.

> **Careful — Set a reminder to turn it back on**
>
> The overwhelmingly common outcome of disabling the firewall to test something is that it stays off for months. On a laptop that joins café and hotel networks, that is a genuine exposure: the Public profile exists precisely for those networks and it is doing real work.

## The better answer: allow one thing through

If one specific program or port needs to accept connections, just say so. It takes about the same amount of time as disabling the firewall wholesale, and it leaves everything else on the machine protected, which matters more than it sounds.

### Allow an app through the firewall

1. Open **Windows Security → Firewall & network protection → Allow an app through firewall**.
2. Click **Change settings** — you need administrator rights.
3. Find the app in the list and tick **Private**, **Public**, or both.
   Tick Private only unless you genuinely need the app reachable on untrusted networks. This is the single most useful judgement call on this page.
4. If the app is not listed, click **Allow another app** and browse to its executable.
   Point at the actual .exe, not a shortcut.

For a port rather than a program — a development server on 3000, say — an inbound port rule is more precise. From an elevated prompt:

1. `netsh advfirewall firewall add rule name="Dev server 3000" dir=in action=allow protocol=TCP localport=3000` — allows inbound TCP on that port.
2. Add `profile=private` to restrict it to trusted networks, which is almost always what you want.
3. `netsh advfirewall firewall delete rule name="Dev server 3000"` removes it again when the project ends.

If the port is not reachable and the rule looks correct, check that something is actually listening on it — a rule allowing traffic to a port nothing is bound to fails in a way that looks identical. The guide on [finding what is using a port](https://zepe.online/guides/kill-process-using-port-windows) covers `netstat -ano` for exactly that check.

**Figure: Which fix for which problem**

The first column solves the same problems as the second, without the cost. It is worth the extra two minutes.

| | Add a rule | Turn firewall off |
| --- | --- | --- |
| Lets one app accept connections | yes | yes |
| Other ports stay protected | yes | no |
| Survives moving to a café network safely | yes | no |
| Windows stops warning you | yes | no |
| Takes under two minutes | yes | yes |
| Easy to reverse later | yes | if you remember |

## The advanced console

Press **Win + R** and run `wf.msc` to get Windows Defender Firewall with Advanced Security. This is where the real configuration lives: inbound and outbound rules listed one by one, per-profile settings, and connection security rules. The Windows Security page is a friendly summary of this.

It is also where you find rules you did not create. Installed software frequently adds its own, and a program that stopped working after an update sometimes has a stale rule blocking it. Sorting inbound rules by program name and looking for red-circled Block entries is a five-minute check that occasionally saves an afternoon.

To reset everything to defaults: `netsh advfirewall reset` from an elevated prompt. This removes every custom rule, including ones your software added, so expect to re-allow a few things afterwards.

> **Editor's note — On third-party firewalls**
>
> Security suites frequently install their own firewall and switch the Windows one off. That is completely fine, and Windows Security will show it as managed by another product. What is not fine is two active firewalls at once, which produces intermittent connection failures that are genuinely miserable to diagnose. If you have installed a suite, let it own the job. And if what you are really chasing is a service nobody can reach, the guide on [killing a process using a port](https://zepe.online/guides/kill-process-using-port-windows) covers telling a blocked port apart from an occupied one.

## Common questions

### Is it safe to turn off the Windows firewall?

Briefly, for a specific test, on a network you trust — yes. Permanently — no, particularly on a laptop that joins public networks, where the firewall is the main thing preventing other machines on that network from reaching services on yours. In nearly every case, allowing one app or port through solves the same problem without the exposure.

### Why is the firewall still blocking something after I turned it off?

Most likely you turned off a profile that is not the active one. Windows keeps separate Domain, Private and Public configurations, and only the one marked **(active)** applies. Run `netsh advfirewall show allprofiles` to see the state of all three at once.

### Does the Windows firewall block internet access?

No, not in its default configuration. It blocks unsolicited inbound connections and allows outbound ones, so browsing, streaming and updates are unaffected. If those are failing, the cause is elsewhere — DNS, the adapter, or the router.

### How do I open a port in the Windows firewall?

From an elevated Command Prompt: `netsh advfirewall firewall add rule name="My rule" dir=in action=allow protocol=TCP localport=3000`. Add `profile=private` to limit it to trusted networks. You can also do it through `wf.msc` → Inbound Rules → New Rule if you prefer the interface.

## Sources

- [Turn Microsoft Defender Firewall on or off](https://support.microsoft.com/en-us/windows/turn-microsoft-defender-firewall-on-or-off-ec0844f7-aebd-0583-67fe-601ecf5d774f) — Microsoft Support. Supports: The Windows Security steps for turning the firewall on or off per network profile.
- [Windows Firewall overview](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/) — Microsoft Learn. Supports: The three network profiles, and the default posture of blocking inbound and allowing outbound connections.

## Related guides

- https://zepe.online/guides/turn-on-windows-defender
- https://zepe.online/guides/kill-process-using-port-windows
- https://zepe.online/guides/connect-wifi-windows-laptop

---

© 2026 Zepe. Windows is a trademark of Microsoft Corporation; this site is not affiliated with Microsoft.