Export and Restore Firewall Rules in Windows 10/11

You can back up and restore the local Windows Defender Firewall with Advanced Security policy by exporting it to a .wfw file and later importing that file. This preserves more than individual inbound and outbound rules: it also captures firewall profile settings and connection security/IPsec policy in the current policy store. The procedure applies to Windows 10 and Windows 11, including Home and Pro editions, although organization-managed devices may have Group Policy or MDM rules that override local settings after import.

Prerequisites and compatibility​

Quick walkthrough

• Sign in with an account that has local administrator rights. Firewall configuration changes require elevation.
• Use this procedure for a local firewall-policy backup before changing rules, reinstalling software, troubleshooting networking, or moving a configuration to a comparable PC.
• Save the backup somewhere safe, such as an encrypted external drive or a protected network location. A .wfw file can expose rule names, application paths, ports, IP addresses, and network configuration details.
• Exporting and importing does not require a restart. The imported policy takes effect immediately.
• On work or school PCs, policies from Active Directory Group Policy, Microsoft Intune, or another MDM service can take precedence over local rules. An import may succeed but affected rules may remain unavailable or ineffective.

Warning: Importing a firewall policy is a replacement-style recovery action, not a selective merge tool. It can change profile defaults, inbound/outbound behavior, logging settings, local firewall rules, and connection security rules at once. If you are connected through Remote Desktop, VPN, Windows Remote Management, or another remote administration method, the restored policy can disconnect you immediately. Export the current policy on the destination PC before importing anything.

Click to expand...

Primary procedure: export and restore through Windows Defender Firewall with Advanced Security​

1. Create a dedicated backup folder​

• Open File Explorer.
• Create a folder that is not routinely cleared, for example:
  C:\FirewallBackups
• Use a descriptive file name that includes the computer or purpose and date, such as:
  Office-PC-Before-VPN-Changes-2026-08-07.wfw

Expected result: You have a known, writable location for the firewall-policy backup.

2. Open the advanced firewall console​

The export and import controls are in the same Microsoft Management Console on both Windows versions.

• Press Windows + R.
• Type:
  wf.msc
• Select OK.
• If User Account Control requests permission, select Yes.

The console opens as Windows Defender Firewall with Advanced Security. Its left pane contains:

• Inbound Rules
• Outbound Rules
• Connection Security Rules
• Monitoring

Expected result: The center pane shows an overview for Domain, Private, and Public firewall profiles.

3. Export the current firewall policy​

• In the left pane, select the top-level Windows Defender Firewall with Advanced Security on Local Computer node.
• In the right-side Actions pane, select Export Policy.
• Browse to the backup folder created earlier.
• Enter a file name ending in .wfw, for example:
  C:\FirewallBackups\Office-PC-Before-VPN-Changes-2026-08-07.wfw
• Select Save.
• If prompted to overwrite an existing backup, choose No unless you deliberately intend to replace it.

Expected result: Windows creates the .wfw file. Confirm it exists in File Explorer and has a non-zero file size.

4. Record the configuration before changing anything​

A policy export is the main rollback asset, but record a few visible settings as a quick reference.

• In Windows Defender Firewall with Advanced Security, keep the top-level local-computer node selected.
• Review the center-pane Overview section.
• Note whether each profile is On or Off, and note its default inbound and outbound behavior if shown.
• Select Inbound Rules and identify any critical rules you rely on, such as rules for:
• Remote Desktop
• File and Printer Sharing
• A VPN client or server
• A web, game, database, or other locally hosted service
• A management or backup agent

For a command-line record, open Command Prompt (Admin) and run:
netsh advfirewall show allprofiles
To save the displayed profile configuration to a text file:
netsh advfirewall show allprofiles > "C:\FirewallBackups\FirewallProfileStatus.txt"
Expected result: You have both a restorable .wfw policy file and a readable reference of the active profile settings.

5. Make your intended firewall change​

Make only the required rule or profile change. If you are troubleshooting an application, avoid disabling the firewall for all profiles as a test; create or adjust a narrowly scoped rule instead.
For example, to inspect a rule:

• Select Inbound Rules or Outbound Rules.
• Locate the rule.
• Double-click it.
• Review the General, Programs and Services, Protocols and Ports, Scope, Advanced, and Users tabs as applicable.
• Select OK without changing anything if you only need to inspect it.

Expected result: Changes are applied immediately; no reboot is normally needed.

6. Restore the saved policy when needed​

Warning: Before importing, create a fresh backup of the policy currently on this PC, even if it is broken. That gives you a way to undo the import or recover a recently added rule. If you are working remotely, make sure you have local console access, an out-of-band management option, or someone at the PC.

Click to expand...

• Open Windows Defender Firewall with Advanced Security by running wf.msc.
• Select Windows Defender Firewall with Advanced Security on Local Computer in the left pane.
• In the Actions pane, select Export Policy.
• Save a pre-restore backup, for example:
  C:\FirewallBackups\Before-Restore-2026-08-07.wfw
• With the top-level local-computer node still selected, choose Import Policy in the Actions pane.
• Read the warning dialog carefully. Confirm that you are restoring the intended backup.
• Select Yes to continue.
• Browse to the desired .wfw file.
• Select Open.
• Wait for the console to refresh.

Expected result: The saved firewall policy is imported into the local policy store and takes effect immediately. A restart is not required.

Verification of success​

Use both a configuration check and a practical test of the service or connection affected by the rules.

Verify in the advanced firewall console​

• Press F5 in Windows Defender Firewall with Advanced Security to refresh the display.
• Select Inbound Rules and Outbound Rules.
• Confirm that the expected rules are present and show the intended Enabled state.
• Open a restored rule and confirm its:
• Action: Allow, Block, or Allow if secure
• Program or service path
• Protocol and local/remote ports
• Local and remote IP scope
• Selected Domain, Private, or Public profiles

Verify profile state from Windows Security​

Windows 11​

• Open Settings.
• Go to Privacy & security > Windows Security > Open Windows Security.
• Select Firewall & network protection.
• Confirm the active network profile reports Microsoft Defender Firewall is on, unless your backup intentionally set it otherwise.

Windows 10​

• Open Settings.
• Go to Update & Security > Windows Security > Open Windows Security.
• Select Firewall & network protection.
• Confirm the active network profile reports Microsoft Defender Firewall is on, unless the restored policy intentionally disabled it.

Verify from an elevated command prompt​

Run:
netsh advfirewall show allprofiles state
Expected result: The output reports the intended ON or OFF state for Domain, Private, and Public profiles.
To inspect a specific restored rule by display name, run:
netsh advfirewall firewall show rule name="Your Rule Name" verbose
Replace Your Rule Name with the exact rule name. The output should show the rule’s enabled state, direction, action, profiles, program, addresses, and ports.
Finally, test the real workload. For example:

• Connect to the PC by Remote Desktop from an authorized host.
• Access the application’s listening port from an authorized remote device.
• Start the affected application and verify it can reach its required network service.
• Confirm a deliberately blocked connection remains blocked.

Alternate method: export and import with Netsh​

Use the command-line method when you need to script backups, run the task remotely through an approved management tool, or avoid navigating the MMC interface. It creates and restores the same .wfw policy format.

Export with Netsh​

• Open Command Prompt as administrator.
• Create a backup folder if needed:
  mkdir C:\FirewallBackups
• Export the current policy:
  netsh advfirewall export "C:\FirewallBackups\FirewallBackup.wfw"

Expected result: The command completes successfully and creates FirewallBackup.wfw.

Import with Netsh​

Warning: This imports the file into the current firewall policy store and can immediately disrupt remote access or network services. Export the current state first.

Click to expand...

• Create a pre-import backup:
  netsh advfirewall export "C:\FirewallBackups\BeforeImport.wfw"
• Import the intended backup:
  netsh advfirewall import "C:\FirewallBackups\FirewallBackup.wfw"
• Verify the profile state:
  netsh advfirewall show allprofiles state

Expected result: Netsh reports successful completion, and the profile states and rules match the imported policy. No restart is required.

Troubleshooting and rollback/escalation​

“Access is denied” or export/import controls are unavailable​

The console or command prompt is not elevated, or the current account lacks administrator rights.

• Close the tool.
• Sign in with an administrator account, or provide administrator credentials when prompted.
• Open Command Prompt by right-clicking it and selecting Run as administrator.
• For the graphical method, run wf.msc and approve the UAC prompt.

If the PC is organization-managed, local administrative rights may still be insufficient to alter enforced policy. Contact the organization’s IT administrator rather than attempting to bypass management controls.

Import succeeds, but rules are missing, disabled, or do not work​

The most common cause is centrally managed firewall policy. Group Policy and MDM/CSP policies can supersede local settings, and an organization can prevent local-rule merging for one or more profiles.

• In the advanced firewall console, select Monitoring.
• Open Firewall and inspect rule sources where available.
• Run:
  netsh advfirewall show allprofiles settings
• Check whether local firewall rules are permitted to merge with managed policy.
• If the rule is needed on a managed PC, deploy it through the organization’s supported Group Policy or MDM method rather than relying on a local .wfw import.

The imported policy disconnects Remote Desktop, VPN, file sharing, or a hosted service​

This indicates that the restored policy does not allow the required traffic on the current network profile, or a rule is limited to a different profile, port, application path, or remote-address scope.
Use local console access if possible. Then:

• Open wf.msc.
• Export the broken current state if you have not already done so.
• Import the known-good Before-Restore or BeforeImport backup created immediately before the restore.
• Verify the network category in Settings:
• Windows 11: Settings > Network & internet > select the active connection > Network profile type
• Windows 10: Settings > Network & Internet > Status > Properties > Network profile
• Ensure the relevant firewall rule applies to the active Private, Public, or Domain profile.

If no backup is available and you need a last-resort reset, first export the current policy for forensic recovery:
netsh advfirewall reset export "C:\FirewallBackups\BeforeFirewallReset.wfw"
Then reset local Windows Defender Firewall with Advanced Security policies to defaults:
netsh advfirewall reset

Warning: Reset removes custom local firewall and connection-security policy. It can break applications that require custom inbound rules. Use it only after preserving the current policy and confirming that you can recreate or restore required exceptions.

Click to expand...

After a reset, re-enable the firewall for all profiles if necessary:
netsh advfirewall set allprofiles state on
Then restore a known-good .wfw backup or recreate only the minimum required rules.

The .wfw file cannot be found, opened, or copied​

Confirm the full path and file extension in File Explorer. Do not rename another file type to .wfw; use a policy file created by Export Policy or netsh advfirewall export.
If the backup is on a network share, copy it locally before importing, for example to C:\FirewallBackups. This avoids access failures caused by disconnected VPNs, unavailable shares, or policy changes that block the connection needed to reach the backup during import.

You need to move rules to another PC but should not copy all firewall settings​

Do not import a full .wfw backup if the target PC has different network requirements, management policy, installed software paths, or security defaults. Instead, manually recreate only the needed rule in Inbound Rules or Outbound Rules, confirming the target PC’s program path, ports, profile, and scope. For a managed fleet, deploy the rule through Group Policy or MDM so it remains consistent and is not overwritten by policy refresh.