How do I inspect Windows firewall rules affecting SSH?
Read the active firewall rule together with its associated filters. The rule summary alone does not show all port and address conditions. Provider firewalls and network allowlists can impose additional restrictions outside Windows.
Instructions
1. Read the active SSH rule
The example name is the rule commonly created by the Microsoft OpenSSH Server feature. Your installation may use a different authorised rule.
Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -PolicyStore ActiveStore | Select-Object Name, Enabled, Direction, Action, ProfileActiveStore reflects the combined active policy. Confirm that the rule applies to the current network profile.
2. Inspect its associated port filter
A rule name mentioning SSH is not proof that it permits the actual configured port.
Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -PolicyStore ActiveStore | Get-NetFirewallPortFilterCheck protocol and local port against the listening SSH service.
3. Review source scope and other policy layers
Inspect the rule’s address filter and the provider firewall. An additional narrow allow rule does not automatically remove a separate broad allow rule.
Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -PolicyStore ActiveStore | Get-NetFirewallAddressFilterReview RemoteAddress and LocalAddress. Resolve policy mismatches through a scoped approved change while retaining a recovery console.
Check the result
- The effective rule, port and allowed source address agree with the intended SSH access policy.
- A connection succeeds from an authorised client and is evaluated alongside provider firewall policy.
Troubleshooting
- The named rule is absent
- Inspect the installation’s actual rule names instead of creating a duplicate automatically.
- The Windows rule allows access but the client still fails
- Check the listener, assigned port, provider firewall and source-address routing.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.