How to Allow an App Through a Firewall Safely

Eric DawsonByEric Dawson Computers & Software

To use the “allow app through firewall” option in Windows, open Windows Security, select Firewall & network protection, then choose Allow an app through firewall. Select Change settings, find the program, and choose the network types it needs. If the program is missing, select Allow another app and browse to its executable file.

Allow only a trusted, verified program that genuinely needs network access. Private access is generally safest for trusted home or work networks; Public applies to untrusted locations. An allowance can increase opportunities for unauthorized access, data leakage, or malware communication if the app is compromised. Remove the allowance when it is no longer needed rather than disabling the firewall.

Allow a Trusted App Through Windows Firewall

There, select Change settings, find the trusted app, and check the network types it needs.

Windows 11 also offers a route through Settings > Privacy and Security > Windows Security > Firewall and network protection > Allow an app through the firewall. Either route leads to the allowed-app controls, where you can select an existing entry or add an app that is missing from the list.

  1. Continue to the firewall controls.
  2. Select Allow an app through firewall to view the app list.
  3. Choose Change settings before changing the app’s allowance.
  4. Find the app you intend to allow, then select its checkbox.
  5. Check Private and/or Public beside that app, limiting the selection to the network types it needs.
  6. For a missing program, enter its path, select the required network types, and select Add.

Before selecting an entry, verify that it is the trusted program you intend to give network access. An allowance should serve a genuine need, not simply make an unfamiliar app’s connection request disappear. Unknown apps should not receive access. For an unlisted program, the Windows file you browse to is its executable, or .exe file.

Keep the change focused on the selected application rather than turning off the firewall. Use the appropriate network type for the app’s needs. Checking both options gives the app an allowance across both selected network categories, so match the selection to its actual needs.

If Allow an app through firewall is grayed out, first check that the firewall is enabled. Beneath each listed network, Windows Security should show “Firewall is on.” Advanced settings provides a separate place to review Inbound, Outbound, and Connection Security Rules when more detailed inspection is needed. Avoid restoring firewall defaults merely to reach the app list, because restoration removes configured settings for all network locations and may cause some apps to stop working.

Decide When an App Needs Firewall Access

A verified app or game that the firewall blocks may need an exception, but an unknown program should not receive one. Trust and necessity belong together: being familiar with an app does not, by itself, establish that it needs permission to communicate through the firewall.

Windows Defender Firewall filters network traffic entering and leaving your device to help protect against unauthorized external access. An app allowance permits network communication that the program needs, but that permission also carries security risks. Rather than disabling the firewall to accommodate a program, use its app rules to grant the needed allowance. Keep the decision focused on the verified program and the access required for it to work.

Remote-access programs and other software that accepts incoming connections are particularly relevant because their functions require network communication. Games can also need an exception when firewall filtering blocks the network access they require. Neither category deserves automatic approval: the same trusted-app requirement applies to both. Before granting permission, confirm that the application is verified as safe and that its function specifically depends on the network access being requested.

Unknown apps create a different problem: allowing them through the firewall can let malicious software access data or infect the computer. Even a trusted program can become risky if it contains a security vulnerability or becomes compromised. Permission is therefore a security decision, not merely a way to clear a block.

Unnecessary allowances retain potential risks without serving a current network requirement. Remove an exception when the application no longer needs access, rather than leaving permission in place simply because it was once useful. For an app that still needs an allowance, keep the scope tied to trusted networks where possible. Review remote-connection permissions with the same emphasis on verified need.

Choose Private, Public, or Domain Access

Choose the appropriate network category for each app. Treat Domain as an app-specific choice, not a requirement for every allowance. Private-only access is generally safest because it limits the allowance to trusted networks rather than also permitting communication on unfamiliar public networks. That distinction should guide which boxes remain selected beside each app.

Public access deserves a separate decision rather than an automatic checkmark alongside Private. An app used on a trusted home or work network does not necessarily need the same allowance while the computer is connected in a public place. Select Public only when that communication is genuinely needed. Keeping the scope narrow follows the same safety principle as allowing only trusted, verified apps that specifically need network access to work.

Network selection does not remove the risks associated with an allowance. Vulnerable apps can also create those risks. Restricting its allowance to Private networks is therefore the generally safer choice, but it is not a substitute for trusting the app itself.

Domain may also appear as an option in the Windows allowed-app dialog. CivilGEO, for example, instructs users to select Domain, Private, and Public for its LicenseServerConfiguration app. Those selections belong to that application’s vendor configuration, rather than a universal safe default for other programs.

Checking every available category should not be treated as the standard way to make an allowance. Instead, keep the distinction between application-specific instructions and general safety guidance clear.

For an app without that specific requirement, the general guidance remains to prefer Private and add Public only for necessary communication from public places. Consider each network category separately instead of treating the available checkboxes as a single package. A vendor’s instruction to enable all categories for one named app does not establish that another app needs identical access. Match the selected categories to the trusted app’s actual network needs.

If I were choosing between Private and both boxes, I would start with Private alone unless the app has a clear need to work on public networks. Selecting both does not make the app work better on a trusted home network.

It simply extends the same permission to another network category. Domain should not be checked merely for completeness either, because the article treats it as dependent on the particular app. The safer default is the narrowest network scope that still lets the verified app do its job.

Since 2023, I have had a Fujitsu ScanSnap iX1300 receipt scanner, which has taught me that a small convenience can still create an impressive amount of administrative clutter. In Choose Private, Public, or Domain Access, I would keep an app on Private unless its stated network need clearly reaches Public or Domain, because checking every box is the firewall equivalent of filing every receipt under later.

Add an App That Is Missing from the List

To add a missing app, open the allowed-app list, select Change settings, then choose Allow another app. Alternatively, enter its location in the Path field, select the required network types, and choose Add. Use this option only for a trusted app that genuinely needs network access, rather than adding an unfamiliar program simply because it is absent from the list.

Alternatively, open Start, search for Control Panel, and select System and Security. Both routes let you work with app allowances rather than disabling the firewall; the Control Panel route also uses Change settings followed by Allow another app.

Inside the add-app dialog, select Browse to locate the app’s .exe file. If you already have its file path, paste that location into the Path field instead. Before selecting Add, verify that the executable belongs to the trusted program you intend to allow. An unknown executable should not receive an allowance just to test whether it resolves a connection problem, because a vulnerable or compromised app can expose data or communicate with malware.

Network selection is part of adding the executable, so choose the types that match its required access before selecting Add. Keep the allowance limited to those needs rather than treating the new entry as permission for every network category. Public access applies to untrusted locations and should not be selected merely because the dialog offers that checkbox.

Related executables raise a separate question: no confirmation establishes that they need separate allowances for your particular app. Avoid assuming that adding one executable means every associated file should also be allowed. Apply the same trusted-app requirement to any additional executable before granting access, and use its own verified path if an allowance is needed. Remove each allowance when that executable no longer needs access.

Check Blocked Settings and Security Software

Check the firewall’s status and management, then review advanced rules if an app allowance is unavailable or does not appear to work. On a Mac, also check the global incoming-connection setting, which can interfere with an app’s allowance. Troubleshooting should focus on the rules and security software controlling network communication, rather than disabling the firewall. Keep the review limited to a trusted, verified app that genuinely needs access; an ineffective allowance is not a reason to grant broader access to unknown applications.

Windows firewall controls may be affected by a third-party antivirus or security app, a system issue, or group policy. If the firewall cannot be enabled, these are possible explanations, not confirmation of a particular cause.

A third-party security product that manages the firewall is also the place to address its firewall rules, using that product’s support documentation. Avoid assuming that changing an app’s Windows allowance addresses settings controlled elsewhere. Firewall allowances govern network communication, while antivirus or other security software may separately manage firewall settings.

For a closer Windows review, use that interface. There, review the relevant rules. Remote-access software deserves particular attention because its network communication can involve incoming connections, making inbound-rule review relevant.

An allowed-app entry should not replace that more granular inspection when reviewing remote-access exposure. Limit any allowance to the verified application’s actual need for network access.

Mac troubleshooting includes a separate global setting: Block all incoming connections. Under Apple menu > System Settings > Network > Firewall > Options, check that this setting is off if an app needs an allowance.

App-specific permissions use Allow incoming connections, but global settings also need consideration when an allowance appears ineffective. Keep this check distinct from the Windows advanced-rule review rather than looking for identically named controls across both systems. Use the firewall’s app-rule screen instead of turning off the firewall to accommodate an application.

Norton 360 rule questions should go to the product’s support documentation rather than a guessed sequence of menus. When third-party software manages the firewall, follow its documented approach to rule changes. Recheck the need for the exception, and remove the allowance once that verified application no longer requires network access.

Compare Windows and Mac App Allowances

Windows app allowances use network categories such as Private and Public, while Mac Firewall Options lets you allow or block an app’s incoming connections. Both systems provide a way to add a missing app and reverse its allowance, but their access controls should not be treated as interchangeable.

Select the app you want to permit and set it to Allow incoming connections. If the application is missing, select the + button, browse to the app, and select Open. Unlike the Windows procedure for adding an executable file, the Mac procedure directs you to browse to the app itself.

Control Windows Mac
Settings path Windows Security > Firewall & network protection > Allow an app through firewall Apple menu > System Settings > Network > Firewall > Options
Missing app Select Change settings > Allow another app…; browse to the .exe or enter its path, then select Add. Select +, browse to the app, then select Open.
Access scope Select the network types the app needs, generally Private only when possible. Set the app to Allow incoming connections.
Reversal Clear the app’s checkbox in the allowed-app list. Set the app to Block incoming connections.
Troubleshooting Check the global incoming-connection block; use Advanced settings to review rules. Check that Block all incoming connections is off when an allowance is needed.

Incoming-connection permission is the key distinction on the Mac side of this comparison. Private and Public describe Windows network categories, not the choices in the Mac procedure above. A Windows allowance can therefore be limited to the network types an app requires, while the Mac steps shown here set that app’s incoming-connection permission. Do not interpret Allow incoming connections as the Mac equivalent of selecting Private in Windows.

Before troubleshooting an allowed Mac app, check whether Block all incoming connections is enabled in the firewall options. That setting should be off when the app needs an incoming-connection allowance. Windows provides corresponding controls. These checks address firewall permissions rather than establishing that an application is safe to allow.

Regardless of platform, grant access only to a verified, trusted application with a genuine need for network communication. To reverse the Mac permission, return to Firewall > Options and set the app to Block incoming connections. Clearing the Windows app’s checkbox serves as its reversal step; neither procedure should be presented as complete instructions for disabling remote access.

Remove Unneeded Access and Review Remote Connections

Revoke an app’s firewall allowance when the app is removed, no longer needs network access, or becomes untrusted. Review inbound rules when remote-access exposure needs closer inspection, but treat that review as a firewall check rather than a complete procedure for turning off remote access to the computer.

Windows lets you block an app again by clearing its checkbox in the allowed-app list. To reverse it, clear the relevant checkbox in the allowed-app list.

Keep the decision tied to the app’s current need for communication: an allowance that was appropriate before deserves another review when that need changes. Removing permission is appropriate when continued access is no longer justified.

Remote-access applications deserve the same verification as any other app requesting firewall permission. Their need for network communication does not replace the requirement to confirm that the application is trusted and specifically needs that access. A vulnerable or compromised app still warrants careful scrutiny.

Limit any retained allowance to the network types the verified app needs, selecting the appropriate type for its current context. Public access should not remain selected merely because the app previously had it.

Closer inspection of remote-access exposure may require opening Advanced settings from Firewall & network protection. There, review the relevant rules for the app’s access. Use this more detailed view when the allowed-app list does not provide enough detail for the review. Verification still matters at this stage: retain access only for a trusted application with a genuine network requirement.

Blocking an app’s firewall access and reviewing inbound rules address firewall permissions, not every aspect of remote access. Neither action should be described as confirmation that remote access has been completely disabled. No complete remote-access shutdown procedure is established here for Windows or Mac beyond those firewall-focused actions.

This guide covers only Windows and Mac firewall controls rather than Norton 360 rules.

Frequently Asked Questions

Is It Safe to Allow an App Through the Firewall?

Only allow a trusted, verified app that genuinely needs network access, and never allow an unknown app. An allowance can increase opportunities for unauthorized access, data leakage, or malware communication if the app is vulnerable or compromised. Remove the allowance when it is no longer needed.

Should I Select Private or Public for an Allowed App?

Private is for trusted home or work networks, while Public is for untrusted locations. That is generally the safest choice. Allow access only on the network types the app needs.

What if My App Is Missing from the Allowed-App List?

Select Change settings, then Allow another app. Browse to the app’s executable file or enter its path, choose the network types it needs, and select Add. Only add an app you trust and have verified.

Why Is Allow an App Through Firewall Grayed Out?

First, check that the firewall is enabled: Windows Security should show “Firewall is on” beneath each listed network. A firewall that cannot be enabled may be controlled by third-party security software or group policy, or it may have a system issue.

Where Should I Change Rules if Third-Party Security Software Manages My Firewall?

Use the third-party security product’s support documentation to find where to change its firewall rules. Third-party security software can override app rules, so check its settings when troubleshooting an allowance.

How Do I Remove a Firewall Allowance on Windows or Mac?

On Windows, open Windows Security > Firewall & network protection > Allow an app through firewall, then clear the app’s checkbox. For Mac, go to Apple menu > System Settings > Network > Firewall > Options and set the app to Block incoming connections.

Keep the firewall enabled and use its app-rule screen to allow only a trusted, verified program that genuinely needs network access. Choose the network types the app needs. If an allowance does not work, check for global settings or third-party security software that can override app rules. Remove the exception when it is no longer needed.

References

Sources read in September 2026.

Eric Dawson

I'm Eric Dawson, and I write The Money Watch from north Columbus, Ohio. Most of what I cover comes from my own life: renting, a 2014 Honda Fit, parking, computers, food and the bills behind all of it. I spent four years in an apartment-property office and eleven on a distributor's operations desk, reading leases and invoices. Where you need real information, I research the maker's or agency's own page and independent sources and report what they publish. I don't give tax, investment, legal or medical advice.