Manage Windows system firewall - Elastic Compute Service

Enable, disable, or configure Windows firewall rules to control remote access to your ECS instance.

Check firewall status

Check whether the firewall is enabled or disabled.

Log on to the Windows instance with VNC.
Select Start > Control Panel.
Set View by to Small icons, then click Windows Defender Firewall.

Note
The option name varies by Windows version. If Windows Defender Firewall is unavailable, select Windows Firewall.
Click Advanced settings.
In the Overview section, view the firewall status.

Note
Keep the firewall state consistent across the domain profile, private profile, and public profile. If they differ, apply the same setting to all profiles.

If you enable the firewall, you must also configure firewall rules.

After the firewall is enabled, it filters traffic based on configured rules.

In the Windows Defender Firewall with Advanced Security window, click Windows Defender Firewall Properties.

Note
To open this window, see Check firewall status.
Set Firewall state to On (recommended), then click Apply.

Note
Enable the firewall on the Domain Profile, Private Profile, and Public Profile tabs.

After the firewall is disabled, all traffic passes through without filtering.

In the Windows Defender Firewall with Advanced Security window, click Windows Defender Firewall Properties.

Note
To open this window, see Check firewall status.
Set Firewall state to Off, then click Apply.

Note
Disable the firewall on the Domain Profile, Private Profile, and Public Profile tabs.

Add inbound rules to allow remote connections after the firewall is enabled. For the full policy reference, see Windows Firewall Policy Configuration Guide.

Open the Remote Desktop port (TCP 3389 by default) to allow remote connections.

Note

If you changed the Remote Desktop port, add the new port to the inbound rule.

In the Windows Defender Firewall with Advanced Security window, click Inbound Rules > New Rule....

Note
To open this window, see Check firewall status.
On the Rule Type page, select Port and click Next.
On the Protocol and Ports page, select TCP, enter the port number in Specific local ports, then click Next.

Note
Enter your remote port number. Default: 3389.
On the Action page, select Allow the connection, then click Next.
On the Profile page, keep the defaults and click Next.
On the Name page, enter a rule name, such as RemoteDesktop, then click Finish.
Configure the scope.

Restrict remote access to specific source IP addresses.
1. Right-click the RemoteDesktop inbound rule and select Properties.
2. On the Scope tab, under Remote IP address, select These IP addresses:, click Add..., add one or more IP addresses or CIDR blocks, then click OK.
  
  Important
  To connect to the instance by using Workbench, you must add 47.96.60.0/24 and 118.31.243.0/24 to the scope.
Connect with your RDP client. In the Computer field, enter the public IP address and port (for example, 192.168.1.2:3389). Expand Show Options and enter the User name (for example, Administrator).

Add a predefined Remote Desktop inbound rule.

Important

This method applies only to the default Remote Desktop port (TCP 3389).

In the Windows Defender Firewall with Advanced Security window, click Inbound Rules > New Rule....

Note
To open the Windows Defender Firewall with Advanced Security window, see Check firewall status.
In the New Inbound Rule Wizard, on the Rule Type page, select Predefined > Remote Desktop, then click Next.
On the Predefined Rules page, select the Remote Desktop - User Mode (TCP-In) checkbox, then click Next.

Note
On earlier Windows versions, if Remote Desktop - User Mode (TCP-In) is unavailable, select Remote Desktop (TCP-In).
On the Actions page, select Allow the connection, then click Completed.
Configure the scope.

Restrict remote access to specific source IP addresses.
1. In the Windows Defender Firewall with Advanced Security window, click Inbound Rules, right-click the rule you created, and select Type.
2. On the Scope tab, under Remote IP address, select These IP addresses:, click Add..., add one or more IP addresses or CIDR blocks, then click OK.
  
  Important
  To connect to the instance by using Workbench, you must add 47.96.60.0/24 and 118.31.243.0/24 to the scope.
Connect with your RDP client. In the Computer field, enter the public IP address and port (for example, 192.168.1.2:3389). Expand Show Options and enter the User name (for example, Administrator).