FWP_RANGE 0XC0220020 firewall rule error fix

You're probably seeing 0XC0220020 when trying to add a firewall rule that uses a port range — something like netsh advfirewall firewall add rule ... protocol=tcp localport=1000-2000,3000-4000. The error pops up immediately, no log entry, just a blunt “The parameter is incorrect.” It's especially common on Windows 10 20H2 and later, and Windows Server 2019/2022 when you try to be clever with a comma-separated list of ranges.

What's actually happening here is that the Windows Filtering Platform (WFP) engine validates every port range against its internal FWPM_FILTER0 structure. That structure expects a single contiguous range per filter condition — start and end, inclusive. It does NOT allow comma-separated ranges or overlapping ranges in one localport parameter. The moment you pass something WFP can't map to a single [low, high] pair, it throws FWP_RANGE (0xC0220020).

The root cause is almost always one of three things:

• You used a comma to list multiple ranges (like 80,443,8000-9000). WFP sees that as an invalid range structure.
• You specified a start port higher than the end port (like 5000-1024). That's a degenerate range.
• You accidentally included a non-numeric character in the port string (like a space or letter).

How to fix it

You've got two paths depending on what you actually need. I'll give you the netsh route first because it's what most people hit this error with.

1. Check your port range syntax.
   If you're using netsh, the localport parameter accepts only one port or one range. No commas, no spaces. Valid: localport=80 or localport=1000-2000. Invalid: localport=80,443 or localport=1000-2000,3000-4000.
2. Split multiple ranges into separate rules.
   If you need ports 80, 443, and 1000-2000, you must create three rules. WFP doesn't batch them. Here's the real fix — a PowerShell script that does it cleanly:

$ports = @(80, 443, 1000..2000)
foreach ($p in $ports) {
  if ($p -is [int]) {
    New-NetFirewallRule -DisplayName "MyApp TCP $p" -Direction Inbound -Protocol TCP -LocalPort $p -Action Allow
  }
}

That loops over each port or range and creates individual rules. No overlap, no FWP_RANGE.

3. Use PowerShell directly — skip netsh for complex ranges.
   PowerShell's New-NetFirewallRule handles ranges better because you can pass multiple -LocalPort values as an array. But notice: even then, each port is still a single port — the cmdlet just creates multiple conditions under the hood. If you need a true contiguous range, pass 1000-2000 as a string (yes, that works in PowerShell too):
   New-NetFirewallRule ... -LocalPort "1000-2000"
4. If you must use netsh for a single range, double-check your numbers.
   Example that works:
   netsh advfirewall firewall add rule name="Test" dir=in protocol=tcp localport=5000-6000 action=allow
   This succeeds because it's one range, no commas, and 5000 < 6000.

What to check if it still fails

If you've done all that and still get 0xC0220020, check these:

• Is a third-party firewall (like Symantec Endpoint Protection, McAfee, or Windows Defender Firewall with Advanced Security) interfering? Some security software hooks into WFP and blocks certain range patterns. Temporarily disable it and retry.
• Are you running as Administrator? This sounds dumb, but I've seen it. WFP rules require elevation. The error message is not helpful here — it'll still say parameter is incorrect.
• Check the event log for WFP details. Open Event Viewer → Applications and Services Logs → Microsoft → Windows → Filtering Platform. Look for Event ID 5447 or 5440. Those often contain the exact filter details that failed — including the raw range data.
• Is the port already in use by another rule? That doesn't cause FWP_RANGE per se, but overlapping ranges can confuse WFP's validation in certain builds. Run netsh advfirewall firewall show rule name=all verbose | findstr "LocalPort" to see existing ranges.

Bottom line: WFP is picky about range format. Give it one clean range per rule, and you'll never see this error again. If you need multiple ports, multiple rules — that's just how the platform works.

A note on Windows Server Core: You might only have netsh available there. Same rules apply. If you really need multiple ranges, consider switching to a GUI-based server or writing a PowerShell script to generate the netsh commands for you. It's a pain, but it's the only clean way.