LINESERVE
Get Started
All tutorials
WindowsAll levels

How to Enable ICMP (Ping) on Windows Public Firewall

Allow ICMP ping on the Windows Public firewall profile using the wf.msc GUI or a netsh advfirewall rule for ICMPv4 Echo Request, with optional IPv6 support.

Stephen NdegwaPublished Last updated 2 min read
Share

This guide explains how to allow ICMP (Ping) traffic on a Windows machine using the Public firewall profile. This is useful for network troubleshooting, monitoring, and connectivity testing.

Important: This only makes the Windows host pingable. It does not affect routers, public IPs on firewalls (e.g. MikroTik), or tunnel brokers like Hurricane Electric if the IP is not terminating on Windows.

What is ICMP?

ICMP (Internet Control Message Protocol) is a network-layer protocol used for diagnostics and error reporting. Common tools like ping rely on ICMP Echo Request and Echo Reply messages.

  • ICMP is not TCP
  • ICMP is not UDP
  • ICMP runs directly over IP

Prerequisites

  • Windows 10 / 11 or Windows Server
  • Administrator privileges
  • Windows Defender Firewall enabled

Method 1: Enable ICMP via Windows Firewall (GUI)

  1. Press Win + R, type wf.msc, and press Enter
  2. Click Inbound Rules
  3. In the right pane, click New Rule…
  4. Select Custom then Next
  5. Program: Select All programs then Next
  6. Protocol and Ports:
    • Protocol type: ICMPv4
    • Click Customize…
    • Select Specific ICMP types
    • Check Echo Request
    • Click OK then Next
  7. Scope:
    • Local IP addresses: Any
    • Remote IP addresses: Any (or restrict if needed)
  8. Action: Select Allow the connection
  9. Profile: Check Public (optionally uncheck Private/Domain)
  10. Name the rule:Allow ICMPv4 Ping (Public)
  11. Click Finish

Run Command Prompt as Administrator, then execute:

netsh advfirewall firewall add rule name="Allow ICMPv4 Public" protocol=icmpv4:8,any dir=in action=allow profile=public

(Optional) Enable IPv6 Ping

netsh advfirewall firewall add rule name="Allow ICMPv6 Public" protocol=icmpv6:128,any dir=in action=allow profile=public

Verify the Rule

To confirm the rule exists:

netsh advfirewall firewall show rule name="Allow ICMPv4 Public"

From another machine, test:

ping <windows-ip-address>

Common Mistakes

  • Using PowerShell backticks (`) in Command Prompt
  • Expecting this to make a router or public IP pingable
  • Confusing ICMP with TCP/UDP rules

Security Considerations

Allowing ICMP is generally safe but can:

  • Expose host reachability
  • Be abused for network scanning

Best practice:

  • Restrict remote IPs if possible
  • Enable only when needed

Summary

  • ICMP is required for ping
  • Windows blocks ICMP by default on Public profile
  • You can enable it safely via GUI or netsh
  • This affects Windows only, not routers or tunnels
  • Enabling ICMP on MikroTik
  • IPv6 and ICMPv6 differences
  • Hurricane Electric IPv6 tunnel requirements

Author: Stephen Ndegwa

Back to tutorialsTalk to our team