Allow ping on a Windows Server VPS: ICMPv4, ICMPv6 and the firewall

A Windows VPS can accept RDP, HTTP or HTTPS connections and still not answer ping. That behaviour does not necessarily mean the server is down: the ICMP Echo request may be filtered by the Windows firewall, by a network firewall placed in front of the VPS, or by a device somewhere along the path.

The right method is not to disable Windows Defender Firewall. You need a precise inbound rule:

ICMPv4, type 8, for an IPv4 Echo request;
ICMPv6, type 128, for an IPv6 Echo request;
on the network profile that is actually active;
ideally limited to the addresses of your monitoring probes or administrators.

This guide gives the recommended PowerShell procedure, the graphical method with wf.msc, a netsh command for legacy environments, the effective-policy checks and a packet-by-packet diagnostic procedure.

Method, scope and limits

The commands and behaviours described here were cross-checked on 31 August 2026 against the official Microsoft Learn documentation on Windows Firewall, the PowerShell references of the NetSecurity module, RFC 792 for ICMPv4, RFC 4443 for ICMPv6 and the IPv6 filtering recommendations in RFC 4890.

Microsoft states that the methods shown apply to Windows Server 2016, 2019, 2022 and 2025. This guide targets 2019 to 2025, the versions most commonly administered on a VPS.

The final behaviour also depends on your environment: the host's network firewall, the active Windows profile, any GPO, MDM or IPsec policies, a higher-priority block rule, IPv4 or IPv6 routing, and the filtering applied on the network sending the ping. Test each step before drawing conclusions.

The addresses 198.51.100.10, 203.0.113.10 and 2001:db8:100::10 are reserved for documentation; replace them with your real addresses.

1. What ping actually tests

ping sends an Echo request and waits for an Echo reply. The ICMP protocol does not rely on TCP or UDP ports: it uses types and codes.

Family	Request sent to the VPS	Reply from the VPS	Reference
ICMPv4	type 8, code 0	type 0, code 0	RFC 792
ICMPv6	type 128, code 0	type 129, code 0	RFC 4443

Allowing "the ping port" is therefore technically incorrect wording. To make the VPS pingable, you allow reception of the Echo Request type matching the IP family.

A successful ping mainly proves that DNS resolution works if a name was used, that a forward and a return route exist, that ICMP Echo requests and replies are not filtered, and that the VPS network stack responds.

It does not prove that RDP, IIS, SQL Server or an application is working. Conversely, an ICMP timeout does not prove the VPS is offline. Always test the service itself as well.

# Test RDP without opening a session
Test-NetConnection -ComputerName 203.0.113.10 -Port 3389

# Test HTTPS
Test-NetConnection -ComputerName 203.0.113.10 -Port 443

2. Should ping be allowed from the whole Internet?

Ping is useful for availability monitoring, latency measurement, loss detection and routing diagnostics. Answering publicly also makes the host easier to inventory and can expose it to unwanted ICMP traffic. It does not create an administration port and does not, on its own, grant access to the server.

Choose the scope according to the real need:

Need	Recommended scope
one or more fixed monitoring probes	limit `RemoteAddress` to the probes' IPv4/IPv6 addresses
administration from a VPN or a bastion	limit to the VPN subnet or the bastion address
temporary demonstration or diagnosis	allow the technician's address, then disable the rule
public availability measurement	allow `Any`, monitor and accept that exposure
no operational use of ping	do not create an Echo rule

Microsoft recommends keeping the default inbound block and making exceptions as specific as possible, in particular by profile and remote address, in its recommendations on Windows Firewall rules.

3. Before the change: identify the profile and the filtering layers

Open a PowerShell session as administrator. First collect the state without changing anything:

Get-ComputerInfo |
    Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Get-NetIPConfiguration

Get-NetConnectionProfile |
    Format-Table Name, InterfaceAlias, NetworkCategory,
        IPv4Connectivity, IPv6Connectivity -AutoSize

Get-NetFirewallProfile |
    Format-Table Name, Enabled, DefaultInboundAction,
        DefaultOutboundAction, AllowInboundRules,
        AllowLocalFirewallRules -AutoSize

Get-NetConnectionProfile shows the category attached to the interface: Public, Private or DomainAuthenticated. On a standalone VPS exposed to the Internet, Public is common, but do not write it into a rule without checking. A server joined to Active Directory may use the domain profile.

The real path of a ping goes through several checks:

Layer	What to check
workstation or probe	correct address, correct IP family, any outbound filtering
Internet and routing	forward and return route, gateway, IPv6 prefix
host's network firewall	ICMP Echo allowed to the VPS, correct source
Windows firewall	active profile, ICMP type, remote scope, effective rule
centralised policy	GPO/MDM, local rule merging, explicit block

Our guide on configuring the Windows Server firewall on a VPS distinguishes the infrastructure firewall from the system one. A Windows allow rule cannot bring back a packet that was already blocked upstream.

Before any remote change:

keep the current RDP session open;
check access to the rescue console or the panel;
do not modify the RDP rule during this operation;
export the policy if the server is critical;
note the exact name of the rule you create so you can disable it.

$Backup = "C:\Windows\Temp\firewall-before-icmp.wfw"
netsh.exe advfirewall export $Backup
Test-Path $Backup

The export is a precaution. Creating a targeted ICMP rule should not change the other rules.

4. Allow ICMPv4 ping with PowerShell

Recommended variant: a specific source

Replace 198.51.100.10 with the public IPv4 address of the administration workstation or the monitoring probe. Replace Public if another profile is active.

$RuleV4 = @{
    Name          = "OH-ICMPv4-Echo-In"
    DisplayName   = "Allow inbound ICMPv4 ping - monitoring"
    Description   = "ICMPv4 Echo Request type 8 ; approved monitoring source"
    Direction     = "Inbound"
    Action        = "Allow"
    Enabled       = "True"
    Profile       = "Public"
    Protocol      = "ICMPv4"
    IcmpType      = 8
    RemoteAddress = "198.51.100.10"
}

New-NetFirewallRule @RuleV4

The rule only allows ICMPv4 Echo requests of type 8 coming from that address. It does not disable the firewall and does not allow every ICMPv4 type.

For several probes or a known subnet:

Set-NetFirewallRule -Name "OH-ICMPv4-Echo-In" -RemoteAddress @(
    "198.51.100.10",
    "198.51.100.11",
    "192.0.2.0/28"
)

Public variant: all sources

If the requirement calls for a reply from any address:

Set-NetFirewallRule -Name "OH-ICMPv4-Echo-In" -RemoteAddress Any

Or create a dedicated public rule directly:

$PublicRuleV4 = @{
    Name          = "OH-ICMPv4-Echo-In-Public"
    DisplayName   = "Allow inbound ICMPv4 ping - public"
    Direction     = "Inbound"
    Action        = "Allow"
    Enabled       = "True"
    Profile       = "Public"
    Protocol      = "ICMPv4"
    IcmpType      = 8
    RemoteAddress = "Any"
}

New-NetFirewallRule @PublicRuleV4

Do not keep a public rule and a restricted rule side by side without a reason: the broader rule makes the restriction pointless.

Avoiding duplicates in a script

New-NetFirewallRule returns an error if the same Name already exists in the same policy store. A repeatable deployment can create or update the rule:

$RuleName = "OH-ICMPv4-Echo-In"
$Existing = Get-NetFirewallRule -Name $RuleName -ErrorAction SilentlyContinue

$Parameters = @{
    Name          = $RuleName
    DisplayName   = "Allow inbound ICMPv4 ping - monitoring"
    Description   = "ICMPv4 Echo Request type 8"
    Direction     = "Inbound"
    Action        = "Allow"
    Enabled       = "True"
    Profile       = "Public"
    Protocol      = "ICMPv4"
    IcmpType      = 8
    RemoteAddress = "198.51.100.10"
}

if ($null -eq $Existing) {
    New-NetFirewallRule @Parameters
}
else {
    Set-NetFirewallRule @Parameters
}

5. Allow ICMPv6 ping without breaking IPv6

Create a separate rule. An ICMPv4 rule does not handle ICMPv6.

Replace 2001:db8:100::10 with the probe's IPv6 address and check that the VPS has a correctly routed global IPv6 address:

Get-NetIPAddress -AddressFamily IPv6 |
    Format-Table InterfaceAlias, IPAddress, PrefixLength,
        AddressState -AutoSize

Get-NetRoute -AddressFamily IPv6 |
    Sort-Object RouteMetric |
    Format-Table DestinationPrefix, NextHop,
        InterfaceAlias, RouteMetric -AutoSize

Create the IPv6 Echo Request rule:

$RuleV6 = @{
    Name          = "OH-ICMPv6-Echo-In"
    DisplayName   = "Allow inbound ICMPv6 ping - monitoring"
    Description   = "ICMPv6 Echo Request type 128 ; approved monitoring source"
    Direction     = "Inbound"
    Action        = "Allow"
    Enabled       = "True"
    Profile       = "Public"
    Protocol      = "ICMPv6"
    IcmpType      = 128
    RemoteAddress = "2001:db8:100::10"
}

New-NetFirewallRule @RuleV6

For all IPv6 sources:

Set-NetFirewallRule -Name "OH-ICMPv6-Echo-In" -RemoteAddress Any

Do not blindly allow or block "all ICMPv6" to fix a ping. ICMPv6 also carries functions that IPv6 needs in order to work, in particular packet size errors and neighbour discovery messages. RFC 4890 provides filtering recommendations by type; it does not recommend blanket, undifferentiated removal.

The rule above adds only Echo Request type 128. Do not disable the Windows "Core Networking" rules already present for IPv6 without studying their purpose.

6. Graphical method with Windows Firewall

Microsoft documents creating an inbound ICMP rule with Windows Firewall. To reproduce the targeted IPv4 rule:

open the Start menu, type wf.msc and confirm;
select Inbound Rules;
click New Rule;
choose Custom;
select All programs;
under Protocol type, choose ICMPv4;
click Customize;
choose Specific ICMP types, then Echo Request;
under Scope, add the allowed remote address;
choose Allow the connection;
tick only the profile you actually need;
use an explicit name and a dated description.

Repeat with ICMPv6 if the VPS must answer over IPv6.

The predefined rule "File and Printer Sharing (Echo Request - ICMPv4-In)" may be present depending on the version and language. Avoid enabling the whole "File and Printer Sharing" group: other rules unrelated to ping would then be enabled too. A custom rule has a stable name, a clear scope and lends itself better to auditing.

7. Legacy variant with netsh

PowerShell and the NetSecurity module are preferable for modern automation. netsh advfirewall is still useful in an older script. Microsoft explicitly gives an ICMPv4 type 8 rule in its documentation on managing the firewall with netsh.

Restricted IPv4 rule:

netsh advfirewall firewall add rule name="OH ICMPv4 Echo In" dir=in action=allow protocol=icmpv4:8,any remoteip=198.51.100.10 profile=public enable=yes

IPv4 rule from all sources:

netsh advfirewall firewall add rule name="OH ICMPv4 Echo In Public" dir=in action=allow protocol=icmpv4:8,any remoteip=any profile=public enable=yes

Delete the legacy rule:

netsh advfirewall firewall delete rule name="OH ICMPv4 Echo In"

Do not use the old netsh firewall context. Microsoft recommends the advfirewall context, which handles profiles and advanced features.

8. Check the rule that was actually created

Do not rely on the success message alone. Check the object, its ICMP filter and its address filter:

$RuleName = "OH-ICMPv4-Echo-In"

Get-NetFirewallRule -Name $RuleName |
    Format-List Name, DisplayName, Description, Enabled,
        Profile, Direction, Action, PolicyStoreSourceType

Get-NetFirewallRule -Name $RuleName |
    Get-NetFirewallPortFilter |
    Format-List Protocol, IcmpType

Get-NetFirewallRule -Name $RuleName |
    Get-NetFirewallAddressFilter |
    Format-List LocalAddress, RemoteAddress

Expected result for the recommended variant:

Property	Expected value
Enabled	True
Direction	Inbound
Action	Allow
Profile	the active profile
Protocol	ICMPv4
IcmpType	8
RemoteAddress	the probe's address or range

To display the rules that apply after merging the local, GPO and other stores:

Get-NetFirewallRule -PolicyStore ActiveStore |
    Where-Object {
        $_.Direction -eq "Inbound" -and
        $_.Enabled -eq "True"
    } |
    Sort-Object DisplayName |
    Format-Table DisplayName, Action, Profile,
        PolicyStoreSourceType -AutoSize

Microsoft sets out the precedence that applies to inbound rules: an explicitly defined allow rule takes precedence over the default block setting, an explicit block rule takes precedence over any conflicting allow rule, and a more specific rule takes precedence over a less specific one, except where an explicit block rule applies. Windows Firewall has no manually adjustable weighted ordering. So look for Block rules that cover the same traffic:

Get-NetFirewallRule -PolicyStore ActiveStore |
    Where-Object {
        $_.Enabled -eq "True" -and
        $_.Direction -eq "Inbound" -and
        $_.Action -eq "Block"
    } |
    Format-Table DisplayName, Profile,
        PolicyStoreSourceType -AutoSize

9. Test correctly from outside

A ping sent by the VPS to 127.0.0.1 validates neither the inbound rule nor the network firewall. Test from another Internet connection or from the allowed probe.

From Windows:

ping.exe -4 203.0.113.10
ping.exe -6 2001:db8::10

Test-Connection -ComputerName 203.0.113.10 -Count 4

From Linux:

ping -4 -c 4 203.0.113.10
ping -6 -c 4 2001:db8::10

Interpret the results carefully:

Result	Likely interpretation	Next check
replies with latency	Echo works on that path	also test the useful service
request timed out	request or reply filtered, or no route	check both firewalls, then capture
destination unreachable	a host or router reports a routing problem	check address, mask, gateway and routes
IPv4 answers, IPv6 does not	IPv6 rule, address or routing incomplete	check type 128 and the IPv6 default route
RDP answers, ping does not	VPS online, Echo probably filtered	inspect the ICMP rule
ping answers, RDP does not	IP reachable, but RDP is not	RDP service, port 3389 and its own rule

To avoid a false diagnosis caused by the scope, run a test from an explicitly allowed address, from a non-allowed address which must fail if the restriction works, over IPv4 and IPv6 separately, and from a network outside the VPS. Our guide on connecting to a Windows VPS over RDP covers testing the administration service itself.

10. Check the host's network firewall

A firewall placed in front of the VPS sees the request before Windows does. If an external network policy is active, add a rule matching the need:

Parameter	Value
direction	inbound
protocol	ICMP or ICMPv4
type	Echo Request, type 8 if the interface allows it
source	monitoring IP or Any, as needed
destination	the VPS public IPv4 address

For IPv6, use ICMPv6 Echo Request type 128 and the server's IPv6 destination. Labels vary between platforms. If the provider's interface does not let you choose the ICMP type, check its documentation to see whether "ICMP" allows every type or only Echo.

Do not widen a network rule to all IP traffic just to make ping work. The upstream rule and the Windows rule must have a consistent scope.

11. Active Directory, GPO and ignored local policy

On a domain-joined server, a GPO can enforce the domain profile, deploy a centralised ICMP rule, create an explicit block rule, or prevent locally created rules from being merged.

Microsoft explains that when local policy merging is disabled, local rules are not included in the effective policy; the rule must then be deployed centrally. Check:

Get-NetFirewallProfile |
    Format-List Name, Enabled, AllowInboundRules,
        AllowLocalFirewallRules, DefaultInboundAction

gpresult.exe /scope computer /r

Get-NetFirewallRule -Name "OH-ICMPv4-Echo-In" |
    Format-List Name, Enabled, Profile,
        PolicyStoreSourceType, PolicyStoreSource

For a fleet of servers, create a GPO under Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security > Inbound Rules.

Apply it first to a test organisational unit, then check:

gpupdate.exe /force
gpresult.exe /h C:\Windows\Temp\gpresult-icmp.html

Microsoft documents this procedure in configuring firewall rules with group policy. If the server is a domain controller, our guide on installing Active Directory on a Windows Server VPS details the flows to plan for.

12. Temporarily enable firewall logging

The firewall log helps determine whether Windows is allowing or dropping the packets. Microsoft recommends raising the log size to at least 20,480 KB, the maximum accepted size being 32,767 KB. For the Public profile:

$LogPath = "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall_Public.log"

$Logging = @{
    Name                = "Public"
    LogFileName         = $LogPath
    LogMaxSizeKilobytes = 32767
    LogBlocked          = "True"
    LogAllowed          = "True"
}

Set-NetFirewallProfile @Logging
Get-NetFirewallProfile -Name Public |
    Format-List Name, LogFileName, LogMaxSizeKilobytes,
        LogBlocked, LogAllowed

While an external workstation sends pings:

Get-Content $LogPath -Tail 100 -Wait

Look for the ICMP protocol, the probe's source address and the VPS address. After the diagnosis, disable logging of allowed connections if it is not part of your collection policy:

Set-NetFirewallProfile -Name Public -LogAllowed False

You may keep LogBlocked=True if storage capacity and log handling are planned for. The full procedure and required permissions are detailed in configure Windows Firewall logging.

13. Capture ICMP with Pktmon

If the log is not enough, Packet Monitor is built into the Windows Server versions covered here. It can show whether a request reaches the Windows stack and where it is dropped.

Start the capture in an administrator console. Replace 198.51.100.10 with the probe's address:

mkdir C:\Windows\Temp\icmp-diagnostic
cd /d C:\Windows\Temp\icmp-diagnostic

pktmon filter remove
pktmon filter add MyPing -i 198.51.100.10 -t ICMP
pktmon start --capture

Send a few pings from the probe, then stop immediately:

pktmon stop
pktmon etl2txt PktMon.etl --out icmp-pktmon.txt
notepad icmp-pktmon.txt
pktmon filter remove

The ICMP filter syntax and the ETL conversion are documented by Microsoft in pktmon filter add and pktmon etl2txt.

Interpretation:

no request captured: check the network firewall, routing, a wrong IP or the wrong family;
request captured then dropped: look for a Windows rule or an effective policy;
request and reply both visible: the return traffic may be filtered after the VPS or misrouted;
only ICMPv4 visible during an IPv6 test: the client is probably not testing the expected address.

Always stop Pktmon after the experiment. A long capture generates noise and consumes space.

14. Methodical troubleshooting

The rule exists but ping fails

Check in this order:

does the VPS still answer over RDP or on a known service?
is the client pinging the right address with -4 or -6?
does the real source match RemoteAddress?
does the rule's profile match the active profile?
is the rule present in ActiveStore?
does an explicit Block rule overlap the traffic?
is a GPO disabling local rule merging?
does the upstream network firewall allow the Echo type?
does the request appear in the log or in Pktmon?

Ping only works after disabling the firewall

Re-enable the profiles immediately:

Set-NetFirewallProfile -Profile Domain, Private, Public -Enabled True

This symptom locates the problem in the Windows policy, but disabling the firewall is not a solution. Inspect the profile, the type, the scope and the block rules. Microsoft advises against disabling Windows Firewall and explains that stopping the MpsSvc service is not supported, in its command-line management documentation.

The rule works, then stops working

Common causes are a change of network profile, a new probe address, a new GPO, a change to the network firewall, a switch between IPv6 and IPv4, or a rule with the same name being replaced during policy merging.

Compare the current state with your change record and the validation output you kept.

IPv6 does not answer

Get-NetIPAddress -AddressFamily IPv6
Get-NetRoute -AddressFamily IPv6 -DestinationPrefix "::/0"
Get-NetFirewallRule -Name "OH-ICMPv6-Echo-In"
Get-NetFirewallRule -Name "OH-ICMPv6-Echo-In" |
    Get-NetFirewallPortFilter

A link-local address starting with fe80:: is not a public IPv6 address routable on the Internet. You need a global address, a default route and an ICMPv6 rule.

15. Disable, re-enable or remove cleanly

To suspend the ping reply while keeping the definition:

Disable-NetFirewallRule -Name "OH-ICMPv4-Echo-In"
Disable-NetFirewallRule -Name "OH-ICMPv6-Echo-In"

To re-enable it:

Enable-NetFirewallRule -Name "OH-ICMPv4-Echo-In"
Enable-NetFirewallRule -Name "OH-ICMPv6-Echo-In"

To permanently remove the custom rules:

Remove-NetFirewallRule -Name "OH-ICMPv4-Echo-In"
Remove-NetFirewallRule -Name "OH-ICMPv6-Echo-In"

Disable-NetFirewallRule keeps the object; Remove-NetFirewallRule deletes it. Microsoft describes the difference in the Disable-NetFirewallRule reference.

16. Security, monitoring and operational limits

Ping does not replace an application probe

For IIS, combine ICMP for latency and network loss, an HTTPS request against a health URL, a certificate check, an alert on the HTTP status code and response time, and a local check of the service and its logs. Our guide on installing IIS on a Windows Server VPS covers setting up the web server.

A server can answer ping while its application is unavailable. A server can also serve the site while ICMP is filtered.

A Windows rule does not stop a volumetric attack upstream

Rate limiting or filtering on the VPS happens after the traffic has reached its virtual interface. Under heavy volume, network capacity can be saturated before Windows applies its rule. Volumetric protection is a matter for the infrastructure and the host's anti-DDoS system.

Do not block all ICMP to "hide" the server

Not answering ping does not prevent the discovery of an exposed TCP service. On IPv6, blocking ICMPv6 wholesale can additionally break important network functions. Filter by type according to the need and keep the essential control messages.

Document the rule's owner

A professional rule should state its justification, its owner, its allowed sources, its ICMP types, the profiles concerned, its creation date, its review date and its removal procedure. The description field built into Windows can carry a ticket or service reference, without unnecessary personal data.

Frequently asked questions

Which PowerShell command allows IPv4 ping?

The minimal command is:

New-NetFirewallRule -Name "OH-ICMPv4-Echo-In" -DisplayName "Allow inbound ICMPv4 ping" -Direction Inbound -Action Allow -Profile Public -Protocol ICMPv4 -IcmpType 8 -RemoteAddress Any

It allows every source. For a stricter configuration, replace Any with the probe's address.

Which port should be opened for ping?

None. Ping uses ICMP, not TCP or UDP. The Echo request is type 8 in ICMPv4 and type 128 in ICMPv6.

Why does ping fail while RDP works?

RDP uses TCP 3389, whereas ping uses ICMP. The two flows are evaluated by different rules. The server can therefore be reachable over RDP and ignore Echo.

Should Echo Reply be allowed outbound?

With the usual Windows policy, outbound traffic is allowed by default. If your organisation enforces strict outbound blocking or an explicit block rule, audit the effective policy and create a limited reply exception if required. Do not widen the global outbound policy just to solve this one case.

Why does a local PowerShell rule have no effect?

It may target the wrong profile, be overridden by an explicit block, not match the source, or be excluded from the effective policy when local rule merging is disabled by GPO or MDM.

Can I enable the predefined File and Printer Sharing rule?

You can enable only the matching Echo rule and check its scope. Do not enable the whole group, which may contain other exceptions. A custom rule remains clearer and easier to automate.

Does ping increase the risk of being hacked?

It confirms reachability and can make automated inventory easier, but it does not provide access to the system. The risk is managed with a rule limited to monitoring sources, keeping the firewall enabled, monitoring, and suitable network protection.

Final checklist

the Windows Server version is identified;
the active network profile is known;
Windows Firewall stays enabled;
the rule targets ICMPv4 type 8 or ICMPv6 type 128, or both;
the rule's profile matches the active profile;
the remote scope is restricted wherever possible;
the upstream network firewall is consistent with the Windows rule;
no explicit block rule overlaps the allow rule;
the rule appears in the effective policy;
the test succeeds from an allowed source;
the test fails from a non-allowed source, if the rule is restricted;
the real service, for example RDP or HTTPS, is tested separately;
the rule, its owner and its review date are documented;
the disable or removal procedure is kept on record.

Going further

This article complements our Windows guides: getting started with your Windows VPS for the initial setup, configuring the Windows Server firewall for the full policy, connecting over RDP for administrative access, and backing up your Windows VPS before any sensitive change.