Install PortWall on Windows Server

PortWall is a web application firewall (WAF). It sits in front of your websites, inspects incoming HTTP traffic against a comprehensive set of attack rules, blocks attackers at the firewall, and passes clean traffic on — while staying out of the way of legitimate visitors.

This manual lives inside the console and ships with the build you are running (shown top-left), so it always matches your version. This page is about PortWall for Windows.

Which edition do you need?

PortWall comes in two editions. Both are licensed with a key and both are managed from a web console.

Choose PortWall for Windows when your sites are on IIS and you want protection on the same server. Choose the appliance when your sites run elsewhere or on something other than IIS, or when you would rather not change the web server itself. The appliance has its own Getting started page, in the manual inside its own console.

The rest of this page is for PortWall for Windows.

What you need

• Windows Server 2016 or later (64-bit), and an Administrator account.
• IIS. PortWall installs without it, but it is made to sit in front of IIS.
• At least 2 GB of free disk space on the drive you install to.
• Outbound HTTPS from the server to dl.portwall.net and PortWall's licence service, so the installer can check your licence and download the release. Updates come the same way.
• A licence key. See Licensing for where it comes from and what happens without one.

Installing

Download portwall-install.exe from portwall.net/download. It is a small file: it asks for your licence key, downloads the current release of PortWall for you, checks it, and opens the installer.

1. Run portwall-install.exe as Administrator. Enter your licence key and press Install. It downloads the installer (about 180 MB) and checks its checksum before running it.
2. The PortWall installer window opens with your licence key already filled in. Check the install folder (C:\portwall by default).
3. Leave Install the loopback origin adapter ticked. PortWall uses this adapter to reach IIS on a server with a single address, and sites cannot be put behind PortWall without it.
4. Press Check only if you want to see the preflight results first. It checks the things that would stop the install and changes nothing.
5. Press Install. When it finishes, it shows the console address and the first administrator's name and password. Press Copy details and keep them.

If the licence key is refused, check it against the one in your account at portwall.net/billing. After several wrong keys in a row the download service makes you wait a few minutes before trying again.

The commands in this section assume you saved portwall-install.exe to the Administrator's Downloads folder, C:\Users\Administrator\Downloads. If you saved it somewhere else, use that folder in the path. Commands that use PortWall's own tools assume the default install folder, C:\portwall; if you chose another, replace C:\portwall with it.

For scripts, run it without a window and wait for it to finish:

Start-Process C:\Users\Administrator\Downloads\portwall-install.exe -ArgumentList '--key <licence key> --quiet' -Wait

Any other option you add is passed on to the installer; C:\Users\Administrator\Downloads\portwall-install.exe --help lists them.

Windows warns about the installer

portwall-install.exe is not yet signed with a Windows code-signing certificate, so Windows does not know its publisher and may warn you before it runs. These warnings are expected:

• The browser says portwall-install.exe isn't commonly downloaded. In Microsoft Edge, open the download's … menu, choose Keep, then Keep anyway.
• Microsoft Defender SmartScreen says Windows protected your PC. Click More info, check that the app is portwall-install.exe, then click Run anyway.
• Open File – Security Warning says The publisher could not be verified. Click Run.

To skip these warnings, unblock the file once in PowerShell before you run it: Unblock-File C:\Users\Administrator\Downloads\portwall-install.exe.

Before you do, check that you have the genuine file. Compare its checksum with the SHA-256 shown on the download page:

Get-FileHash C:\Users\Administrator\Downloads\portwall-install.exe -Algorithm SHA256

Do not run the file if the checksums differ. Download it again from PortWall instead.

The missing certificate does not weaken what gets installed. portwall-install.exe checks the installer it downloads against the checksum PortWall's download service gives it, and the installer checks the release it carries against PortWall's release signature before it changes anything, refusing a release that has been altered. Every update is checked the same way. Installing does not move any site behind PortWall. It installs the protection that watches the server, and the console. Putting your sites behind the WAF is a separate step that you take in the console when you are ready, and your sites keep running as before until then.

On a server that has Plesk for Windows, PortWall recognises Plesk and switches on its Plesk support mode by itself. See Set up & cut traffic over to PortWall.

The pieces

PortWall runs as a few Windows services, each with the least privilege it needs:

• Data plane (portwall-dataplane) — the engine that actually serves and inspects traffic.
• Worker (portwall-worker) — ingests events, correlates attacks, programs firewall rules, refreshes feeds, and runs the health checks.
• Broker (portwall-broker) — the one privileged component; it makes the firewall/host changes the least-privilege worker asks for, over a local pipe.
• API + console (portwall-api) — the management API and this console, in one process, bound to loopback.

You reach the console over http://127.0.0.1:5000 on the box, or publish it over TLS from TLS / SSL. It does not answer on the server's other addresses until you do, so opening it from another computer times out.

First steps on a new install

1. Sign in. The installer creates an initial admin and shows its password at the end (it is also saved to C:\portwall\data\initial-admin-credentials.txt, readable by Administrators only). If you are locked out, reset it on the server with C:\portwall\control-plane\portwall-admin.exe reset-password — see the command-line reference.
2. Check the licence. Open Licence. It should say Licensed. If it does not, paste your key there. See Licensing.
3. Run the setup wizard (Set up PortWall). It finds your IIS sites, prepares the internal address PortWall uses to reach them, and — when you are ready — cuts your sites over to be served through PortWall. See Set up & cut traffic over to PortWall.
4. Check the Overview. The Protection status cards show, per feature, whether it is enabled and actually enforcing — a feature that is on but doing nothing is called out in red. See Protection status & the errors panel.
5. Watch first, then block. New sites start in DetectionOnly: attacks are logged, nothing is blocked. Use the Attack Feed to find false positives, then switch sites to blocking. See Sites & the WAF.
6. Set up alerts so you hear about incidents without watching the console. See Notifications & alert email.
7. Harden the console — turn on two-factor authentication for your operators, and use API keys instead of shared credentials for scripts.

A note on how PortWall fails

Two design rules run through the whole product, and it helps to know them:

• Nothing fails silently. If a protection you turned on stops actually enforcing, it turns red on the dashboard, in the top-right errors panel, and on that feature's page — it does not quietly stop working.
• Detection keeps running even when enforcement can't. If the licence lapses, or a switch-over needs a reboot, PortWall keeps recording attacks and preserves every block, and restores enforcement automatically once the condition clears.

Updates and update channels

When a new release is offered, a banner at the top of the console says so, and unless updates are set to install automatically (below), nothing is installed until an administrator approves it there. check for updates under the version number asks straight away instead of waiting for the next scheduled check.

Update Status (on the appliance, System) lets you choose which releases this server is offered:

• Stable (the default) — releases that have been tested and made available to everyone.
• Testing — new releases as soon as they are published, before they reach Stable. Use it on a server where you want to try fixes and features early.

A server is never moved back to an older version. If you switch from Testing to Stable while running a Testing release, the server stays on it until Stable has a newer one.

Automatic updates

Update Status (on the appliance, System) also decides what this server does about an offered update:

• Tell me (the default) — the banner above, and an update is installed only when an administrator presses Install.
• Install automatically — each new release is installed by itself, but only while your maintenance window is open, and only on the Stable channel (a server on Testing is always asked). You must set a maintenance window first; PortWall will not turn this on without one. An installation that has started is never cut off when the window closes. As with a manual install, a release that does not come up healthy is rolled back to the version you had, and Update Status shows what happened. That release is then not tried again automatically; a newer release is tried normally, and you can press Install to try the same one again.
• Don't tell me — no banner when an update is available. The update is still recorded, you can still install it, and Protection Status warns you if a release has been waiting for more than 30 days.

Installing restarts PortWall's services on Windows, so sites behind PortWall see a brief interruption: choose a quiet time for the window. A server on Tell me or Don't tell me that has had a newer release available for more than 30 days shows a PortWall updates warning on Protection Status.

Tip: the top-left version number is the running build. After an update, confirm it changed there — it is the one number that cannot be stale.

Removing PortWall

To take PortWall off a server, see Uninstalling PortWall (Windows).

If something goes wrong

See Troubleshooting. Start with C:\portwall\control-plane\portwall-admin.exe diagnose --all on the server.