How to Enable ICMP (Ping) on Windows Public Firewall

This guide explains how to allow ICMP (Ping) traffic on a Windows machine using the Public firewall profile. This is useful for network troubleshooting, monitoring, and connectivity testing.

⚠️ Important: This only makes the Windows host pingable. It does not affect routers, public IPs on firewalls (e.g. MikroTik), or tunnel brokers like Hurricane Electric if the IP is not terminating on Windows.

---

What is ICMP?

ICMP (Internet Control Message Protocol) is a network-layer protocol used for diagnostics and error reporting. Common tools like ping rely on ICMP Echo Request and Echo Reply messages.

• ICMP is not TCP
• ICMP is not UDP
• ICMP runs directly over IP

---

Prerequisites

• Windows 10 / 11 or Windows Server
• Administrator privileges
• Windows Defender Firewall enabled

---

Method 1: Enable ICMP via Windows Firewall (GUI)

1. Press Win + R, type wf.msc, and press Enter
2. Click Inbound Rules
3. In the right pane, click New Rule…
4. Select Custom → Next
5. Program: Select All programs → Next
6. Protocol and Ports:
   • Protocol type: ICMPv4
   • Click Customize…
   • Select Specific ICMP types
   • Check Echo Request
   • Click OK → Next
7. Scope:
   • Local IP addresses: Any
   • Remote IP addresses: Any (or restrict if needed)
8. Action: Select Allow the connection
9. Profile: Check Public (optionally uncheck Private/Domain)
10. Name the rule:Allow ICMPv4 Ping (Public)
11. Click Finish

---

Method 2: Enable ICMP via Command Prompt (Recommended)

Run Command Prompt as Administrator, then execute:

netsh advfirewall firewall add rule name="Allow ICMPv4 Public" protocol=icmpv4:8,any dir=in action=allow profile=public

(Optional) Enable IPv6 Ping

netsh advfirewall firewall add rule name="Allow ICMPv6 Public" protocol=icmpv6:128,any dir=in action=allow profile=public

---

Verify the Rule

To confirm the rule exists:

netsh advfirewall firewall show rule name="Allow ICMPv4 Public"

From another machine, test:

ping <windows-ip-address>

---

Common Mistakes

• ❌ Using PowerShell backticks (`) in Command Prompt
• ❌ Expecting this to make a router or public IP pingable
• ❌ Confusing ICMP with TCP/UDP rules

---

Security Considerations

Allowing ICMP is generally safe but can:

• Expose host reachability
• Be abused for network scanning

Best practice:

• Restrict remote IPs if possible
• Enable only when needed

---

Summary

• ICMP is required for ping
• Windows blocks ICMP by default on Public profile
• You can enable it safely via GUI or netsh
• This affects Windows only, not routers or tunnels

---

Related Topics

• Enabling ICMP on MikroTik
• IPv6 and ICMPv6 differences
• Hurricane Electric IPv6 tunnel requirements

---

Author: Stephen Ndegwa