VPN app blocked by Windows Defender Firewall – quick fix

Quick answer

Open Windows Defender Firewall with Advanced Security, create an inbound rule that allows the VPN app (.exe) through, then restart the VPN. That's it.

Why this happens

Windows Defender Firewall is aggressive by design. It treats any app that tries to change network settings or create tunnels as suspicious – and that's exactly what a VPN does. The error "Windows Defender Firewall has blocked some features of this app" pops up when the firewall sees your VPN client trying to create a virtual network adapter or route traffic. This is common with OpenVPN-based clients, WireGuard, and even some branded VPNs like NordVPN or ExpressVPN after an update. The firewall doesn't know the app is trusted, so it slaps a block on it.

The real fix isn't disabling the firewall (that's dumb). You need to tell Windows: "Hey, this VPN app is safe, let it through." That's what we're doing below.

Step-by-step fix: add a firewall rule for the VPN app

These steps work on Windows 10 (all versions) and Windows 11 (all versions).

1. Find your VPN app's exact install location.
   Right-click the VPN app shortcut (on your desktop or Start menu) and select Open file location. If the location opens, note the folder path – like C:\Program Files\NordVPN. If you don't have a shortcut, check C:\Program Files or C:\Program Files (x86) for the VPN folder. Inside, you'll see an .exe file – that's the main app.
2. Open Windows Defender Firewall with Advanced Security.
   Press Win + R, type wf.msc, and hit Enter. After a second, the firewall console opens. You should see three panels – left, middle, right.
3. Create a new inbound rule.
   In the left panel, click Inbound Rules. Then in the right panel, click New Rule.... A wizard pops up.
4. Choose Rule Type: Program.
   Select Program, then click Next.
5. Browse to your VPN app's .exe file.
   Click Browse..., find the .exe file from step 1, select it, and click Next. After clicking Next, you should see the path filled in, like C:\Program Files\NordVPN\NordVPN.exe.
6. Allow the connection.
   Select Allow the connection, click Next.
7. Apply to all profiles.
   Check all three boxes: Domain, Private, Public. Click Next. This ensures the firewall allows the VPN regardless of your network type (home, work, or public Wi-Fi).
8. Name the rule.
   Give it a clear name like Allow VPN App - NordVPN. You can also add a description. Click Finish.
9. Now create an outbound rule.
   Repeat steps 3 through 8, but this time in step 3 click Outbound Rules instead. Same settings – allow the same program, all profiles. Outbound rules aren't always needed, but VPN apps often send data out, and a strict firewall can block that too.
10. Restart your VPN app.
    Close the VPN client completely. Right-click its system tray icon and select Exit or Quit. Then relaunch it from the Start menu. The error should be gone. Connect to a server to confirm.

Expected outcome: After restarting the VPN app, the firewall block message won't appear. Your VPN should connect without errors. If it still shows the error, move to the alternative fixes below.

Alternative fixes if the main one fails

Fix 1: Run the VPN app as administrator

Some VPNs need admin rights to install virtual adapters. Right-click the VPN shortcut, select Run as administrator. If that works, set it to always run as admin: right-click shortcut > Properties > Compatibility tab > check Run this program as an administrator > Apply.

Fix 2: Disable IPv6 or check your network adapter

Sometimes the firewall blocks the TAP adapter (used by OpenVPN). Go to Control Panel > Network and Sharing Center > Change adapter settings. Find the TAP adapter (it's usually named "TAP-Windows Adapter V9" or similar). Right-click it, select Properties. Uncheck Internet Protocol Version 6 (TCP/IPv6), click OK. Then restart the VPN. This often fixes connection drops.

Fix 3: Reset Windows Defender Firewall

If you've messed up firewall rules in the past, they could conflict. Open Command Prompt as admin (Win + R, type cmd, press Ctrl + Shift + Enter). Run:

netsh advfirewall reset

Fix 4: Reinstall the VPN app

Corrupted app files can trigger false firewall blocks. Uninstall the VPN from Settings > Apps > Apps & features. Reboot, then download a fresh installer from the VPN's official site and install it. Then add the firewall rule again using the steps above.

Prevention tip

To stop this from happening again after VPN updates: after each major update, check if the app's .exe path changed (some VPNs update to a new folder). If it did, delete the old firewall rule and create a new one pointing to the new path. Also, set your VPN to auto-start as admin – it solves 90% of firewall issues.