Skip to content
Tutorial Reference

How to Allow a Port Range Through the Firewall in Batch Script

Learn how to create, manage, and secure port ranges in Windows Firewall using Batch scripts with netsh advfirewall, including methods for TCP/UDP, program-specific locks, and best practices for security.

Certain applications, like high-end databases, voice-over-IP (VoIP) systems, and multiplayer games, don't just use one port; they use a wide range of "dynamic ports" to handle multiple simultaneous streams of data. Manually opening fifty different ports in the Windows Firewall is a recipe for errors. A Batch script can use the netsh advfirewall command to open an entire block of ports (e.g., 5000-5050) in a single operation, ensuring your application has the breathing room it needs to operate without compromising your overall system security.

This guide will explain how to authorize multiple ports at once.

Method 1: Creating the Port Range Rule (Netsh)

The netsh advfirewall command allows you to specify a port range using a simple hyphen (start-end).

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    echo         Right-click and select "Run as administrator."
    pause
    endlocal
    exit /b 1
)

set "RuleName=VOIP_SERVICE_RANGE"
set "PortRange=5000-5050"
set "Protocol=TCP"
set "Profiles=domain,private"
set "LogFile=%USERPROFILE%\firewall_changes.log"

echo [ACTION] Opening firewall ports %PortRange% (%Protocol%^)...
echo         Rule:     %RuleName%
echo         Profiles: %Profiles%
echo.

:: Validate port range format (basic check for number-number)
echo %PortRange% | findstr /R "^[0-9][0-9]*-[0-9][0-9]*$" >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] Invalid port range format: %PortRange%
    echo         Expected format: StartPort-EndPort (e.g., 5000-5050^)
    pause
    endlocal
    exit /b 1
)

:: Extract start and end ports to validate range
for /f "tokens=1,2 delims=-" %%a in ("%PortRange%") do (
    set "StartPort=%%a"
    set "EndPort=%%b"
)

if !StartPort! geq !EndPort! (
    echo [ERROR] Start port (!StartPort!^) must be less than end port (!EndPort!^).
    pause
    endlocal
    exit /b 1
)

:: Calculate number of ports being opened
set /a "PortCount=!EndPort!-!StartPort!+1"
echo [INFO] This will open !PortCount! ports.

:: Warn if range is excessively wide
if !PortCount! gtr 100 (
    echo.
    echo [WARNING] Opening !PortCount! ports is a very wide range.
    echo          Only open what your application specifically requires.
    set /p "wideConfirm=Continue? (Y/N): "
    if /i "!wideConfirm!" neq "Y" (
        echo [CANCELLED] No changes made.
        pause
        endlocal
        exit /b 0
    )
)

echo.

:: Check if rule already exists
netsh advfirewall firewall show rule name="%RuleName%" >nul 2>&1
if !errorlevel! equ 0 (
    echo [INFO] Rule "%RuleName%" already exists. No duplicate created.
    echo.
    netsh advfirewall firewall show rule name="%RuleName%" | findstr /i "Rule Name: Enabled: LocalPort: Protocol: Profile:"
    pause
    endlocal
    exit /b 0
)

:: Create the rule
netsh advfirewall firewall add rule name="%RuleName%" dir=in action=allow protocol=%Protocol% localport=%PortRange% profile=%Profiles% enable=yes >nul 2>&1

if !errorlevel! equ 0 (
    echo [SUCCESS] Ports %PortRange% (%Protocol%^) are now open.
    echo.
    echo --- Rule Details ---
    netsh advfirewall firewall show rule name="%RuleName%" | findstr /i "Rule Name: Enabled: Direction: Action: LocalPort: Protocol: Profile:"
    echo --------------------
    echo.
    echo [%date% %time%] CREATED "%RuleName%" ports=%PortRange%/%Protocol% profiles=%Profiles% by %USERNAME% >> "%LogFile%"
) else (
    echo [ERROR] Rule creation failed. Check parameters and permissions.
)

pause
endlocal

Output:

[ACTION] Opening firewall ports 5000-5050 (TCP)...
        Rule:     VOIP_SERVICE_RANGE
        Profiles: domain,private

[INFO] This will open 51 ports.

[SUCCESS] Ports 5000-5050 (TCP) are now open.

--- Rule Details ---
Rule Name:                            VOIP_SERVICE_RANGE
Enabled:                              Yes
Direction:                            In
Protocol:                             TCP
LocalPort:                            5000-5050
Action:                               Allow
--------------------

Method 2: Opening Both TCP and UDP Ranges

Many media servers (like Plex or custom game servers) require the same range open on both protocols.

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    pause
    endlocal
    exit /b 1
)

set "Range=8000-8010"
set "RulePrefix=MEDIA_SERVER"
set "Profiles=domain,private"
set "LogFile=%USERPROFILE%\firewall_changes.log"

echo [ACTION] Opening TCP and UDP ranges for %Range%...
echo         Profiles: %Profiles%
echo.

set "CreatedCount=0"
set "SkippedCount=0"

:: TCP Rule
set "TCPRule=%RulePrefix%_TCP_%Range%"
netsh advfirewall firewall show rule name="!TCPRule!" >nul 2>&1
if !errorlevel! equ 0 (
    echo [SKIP] TCP rule already exists.
    set /a SkippedCount+=1
) else (
    netsh advfirewall firewall add rule name="!TCPRule!" dir=in action=allow protocol=TCP localport=%Range% profile=%Profiles% enable=yes >nul 2>&1
    if !errorlevel! equ 0 (
        echo [OK] TCP %Range% - opened
        set /a CreatedCount+=1
    ) else (
        echo [FAIL] TCP rule creation failed.
    )
)

:: UDP Rule
set "UDPRule=%RulePrefix%_UDP_%Range%"
netsh advfirewall firewall show rule name="!UDPRule!" >nul 2>&1
if !errorlevel! equ 0 (
    echo [SKIP] UDP rule already exists.
    set /a SkippedCount+=1
) else (
    netsh advfirewall firewall add rule name="!UDPRule!" dir=in action=allow protocol=UDP localport=%Range% profile=%Profiles% enable=yes >nul 2>&1
    if !errorlevel! equ 0 (
        echo [OK] UDP %Range% - opened
        set /a CreatedCount+=1
    ) else (
        echo [FAIL] UDP rule creation failed.
    )
)

echo.
echo [SUMMARY] Created: !CreatedCount!  Skipped: !SkippedCount!

if !CreatedCount! gtr 0 (
    echo [%date% %time%] CREATED "%RulePrefix%" TCP+UDP %Range% profiles=%Profiles% by %USERNAME% >> "%LogFile%"
)

echo.
echo [CLEANUP] To remove both rules later:
echo          netsh advfirewall firewall delete rule name="!TCPRule!"
echo          netsh advfirewall firewall delete rule name="!UDPRule!"

pause
endlocal

Output:

[ACTION] Opening TCP and UDP ranges for 8000-8010...
        Profiles: domain,private

[OK] TCP 8000-8010 - opened
[OK] UDP 8000-8010 - opened

[SUMMARY] Created: 2  Skipped: 0

[CLEANUP] To remove both rules later:
         netsh advfirewall firewall delete rule name="MEDIA_SERVER_TCP_8000-8010"
         netsh advfirewall firewall delete rule name="MEDIA_SERVER_UDP_8000-8010"

Method 3: Limiting the Range to a Specific Program

For maximum security, only open the port range for the specific application that needs it. This prevents other programs from hijacking the open ports.

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    pause
    endlocal
    exit /b 1
)

set "RuleName=APP_RANGE_LOCK"
set "AppPath=C:\App\server.exe"
set "PortRange=10000-10100"
set "Protocol=UDP"
set "Profiles=domain,private"
set "LogFile=%USERPROFILE%\firewall_changes.log"

echo [DEPLOY] Creating program-locked port range rule...
echo         Rule:     %RuleName%
echo         Program:  %AppPath%
echo         Ports:    %PortRange% (%Protocol%^)
echo         Profiles: %Profiles%
echo.

:: Verify the application exists
if not exist "%AppPath%" (
    echo [WARN] Application not found at: %AppPath%
    echo        Rule will be created but won't activate until the file exists.
    echo.
)

:: Check for existing rule
netsh advfirewall firewall show rule name="%RuleName%" >nul 2>&1
if !errorlevel! equ 0 (
    echo [INFO] Rule already exists. Skipping creation.
    pause
    endlocal
    exit /b 0
)

:: Create the combined program + port range rule
netsh advfirewall firewall add rule name="%RuleName%" dir=in action=allow program="%AppPath%" protocol=%Protocol% localport=%PortRange% profile=%Profiles% enable=yes >nul 2>&1

if !errorlevel! equ 0 (
    echo [SUCCESS] Port range locked to specific program.
    echo.
    echo          ONLY "%AppPath%" can receive traffic on ports %PortRange%.
    echo          Other programs on the same ports will be BLOCKED.
    echo.
    echo --- Verification ---
    netsh advfirewall firewall show rule name="%RuleName%" | findstr /i "Rule Name: Enabled: Direction: Action: Program: LocalPort: Protocol: Profile:"
    echo --------------------
    echo [%date% %time%] CREATED "%RuleName%" program="%AppPath%" ports=%PortRange%/%Protocol% by %USERNAME% >> "%LogFile%"
) else (
    echo [ERROR] Failed to create rule.
)

pause
endlocal

Output:

[DEPLOY] Creating program-locked port range rule...
        Rule:     APP_RANGE_LOCK
        Program:  C:\App\server.exe
        Ports:    10000-10100 (UDP)
        Profiles: domain,private

[SUCCESS] Port range locked to specific program.

         ONLY "C:\App\server.exe" can receive traffic on ports 10000-10100.
         Other programs on the same ports will be BLOCKED.

--- Verification ---
Rule Name:                            APP_RANGE_LOCK
Enabled:                              Yes
Direction:                            In
Protocol:                             UDP
LocalPort:                            10000-10100
Action:                               Allow
--------------------

Method 4: Interactive Port Range Manager

A user-friendly script for creating, viewing, and removing port range rules.

@echo off
setlocal enabledelayedexpansion

:: Check for Administrator privileges
net session >nul 2>&1
if !errorlevel! neq 0 (
    echo [ERROR] This script requires Administrator privileges.
    pause
    endlocal
    exit /b 1
)

set "LogFile=%USERPROFILE%\firewall_changes.log"

echo ==========================================
echo   PORT RANGE FIREWALL MANAGER
echo ==========================================
echo.
echo   1. Open a port range
echo   2. Close (delete^) a port range rule
echo   3. List existing port range rules
echo.
set /p "Action=Enter choice (1-3): "

if "%Action%"=="1" goto :OpenRange
if "%Action%"=="2" goto :CloseRange
if "%Action%"=="3" goto :ListRanges
echo [ERROR] Invalid choice.
pause
endlocal
exit /b 1

:OpenRange
echo.
set /p "RuleName=Rule name (e.g., GAME_SERVER): "
set /p "PortRange=Port range (e.g., 5000-5050): "
set /p "Protocol=Protocol (TCP/UDP/BOTH): "
set /p "Profiles=Profiles (domain,private / public / all): "

if /i "!Profiles!"=="all" set "Profiles=domain,private,public"

if /i "!Protocol!"=="BOTH" (
    :: Create TCP rule
    netsh advfirewall firewall add rule name="!RuleName!_TCP" dir=in action=allow protocol=TCP localport=!PortRange! profile=!Profiles! enable=yes >nul 2>&1
    if !errorlevel! equ 0 ( echo [OK] TCP rule created. ) else ( echo [FAIL] TCP rule failed. )

    :: Create UDP rule
    netsh advfirewall firewall add rule name="!RuleName!_UDP" dir=in action=allow protocol=UDP localport=!PortRange! profile=!Profiles! enable=yes >nul 2>&1
    if !errorlevel! equ 0 ( echo [OK] UDP rule created. ) else ( echo [FAIL] UDP rule failed. )
) else (
    netsh advfirewall firewall add rule name="!RuleName!" dir=in action=allow protocol=!Protocol! localport=!PortRange! profile=!Profiles! enable=yes >nul 2>&1
    if !errorlevel! equ 0 ( echo [OK] Rule created. ) else ( echo [FAIL] Rule creation failed. )
)

echo [%date% %time%] OPENED ports !PortRange!/!Protocol! as "!RuleName!" by %USERNAME% >> "%LogFile%"
goto :End

:CloseRange
echo.
set /p "DelRule=Rule name to delete: "
netsh advfirewall firewall delete rule name="!DelRule!" >nul 2>&1
if !errorlevel! equ 0 (
    echo [OK] Rule "!DelRule!" deleted.
    echo [%date% %time%] DELETED port range rule "!DelRule!" by %USERNAME% >> "%LogFile%"
) else (
    echo [INFO] Rule not found. Check the exact name.
)
goto :End

:ListRanges
echo.
echo [LIST] Firewall rules with port ranges:
echo ==========================================
netsh advfirewall firewall show rule name=all dir=in 2>nul | findstr /i "Rule Name: LocalPort:" | findstr /i /v "Any"
echo ==========================================
goto :End

:End
pause
endlocal

How to Avoid Common Errors

Wrong Way: Opening a Range That's Too Wide

If you open 1-65535, you have effectively disabled your firewall for that protocol. This is a massive security risk.

Correct Way: Only open the exact range specified by your software vendor. If the app needs 5 ports, open those 5, not the surrounding 1,000. Method 1 includes a warning when the range exceeds 100 ports.

Wrong Way: Not Specifying Profiles

By default, rules apply to all profiles including Public. A port range open on public café Wi-Fi exposes your services to every device on that network.

Correct Way: Always specify the appropriate profiles:

:: Correct: only trusted networks
profile=domain,private

:: RISKY: includes public networks
(no profile specified = all profiles)

Wrong Way: Opening Ports Without Locking to a Program

A port-only rule lets any application receive traffic on those ports, including malware.

Correct Way: Whenever possible, combine the port range with a specific program (Method 3):

netsh advfirewall firewall add rule name="APP_RANGE" dir=in action=allow program="C:\app.exe" protocol=TCP localport=5000-5050

Wrong Way: Incorrect Protocol Selection

Opening a TCP range for an application that uses UDP will not work: the packets will still be dropped.

Correct Way: Read the technical documentation for your software. If it doesn't specify, use Method 2 to open both protocols. Common protocol requirements:

Application Type Usually Needs
Web servers TCP only
VoIP / Video UDP (sometimes both)
Game servers UDP (sometimes both)
Database TCP only
File transfer TCP only

Wrong Way: Creating Duplicate Rules

Running the script twice creates redundant rules that clutter the firewall.

Correct Way: Check if the rule exists before creating it. All methods above include this check.

Wrong Way: Running Without Administrator Privileges

Modifying port policy requires elevation. Without it, commands fail with confusing errors.

Correct Way: Always check for elevation:

net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Run as Administrator.
    exit /b 1
)

Best Practices and Rules

1. Unique, Descriptive Rule Names

Always include context in the rule name:

VOIP_SERVICE_5000-5050_TCP
GAME_SERVER_27015-27020_UDP
MEDIA_PLEX_32400-32500_TCP_UDP

This makes it easy to identify and clean up rules later.

2. Verify After Creation

Check that the ports are actually open and the rule is configured correctly:

netsh advfirewall firewall show rule name="%RuleName%" verbose

3. Log the Reason

Document why the ports were opened. In an enterprise environment, undocumented open ports are a major audit failure:

echo [%date% %time%] Opened %PortRange% for VoIP upgrade - ticket #12345 >> firewall_audit.log

4. Use the Narrowest Range Possible

Ask your software vendor for the exact ports required. If they say "5000-5050 but we only use about 10 at a time," still open only 5000-5050, not 5000-6000 "just in case."

5. Combine with Program Path When Possible

A port range locked to a specific .exe (Method 3) is significantly more secure than a generic port range. Even if the ports are open, only your trusted application can use them.

6. Always Use setlocal / endlocal

Without setlocal, every variable your script creates persists in the parent shell session, causing potential conflicts when running multiple scripts in sequence.

Conclusions

Opening a port range via Batch script provides a clean, professional solution for managing the complex connectivity requirements of modern software. By moving beyond single-port management and utilizing targeted ranges locked to specific programs and profiles, you ensure your high-bandwidth applications function at peak performance. This automated precision allows you to maintain a balance between open functionality and robust system security in your Windows environment.

Navigation