Migrate to RunxBuild and earn up to $50 in hosting credit on your first deposit.

Calculate your savings
unxBuild
Log in Get Started
Back to Blog Troubleshooting

Allow Chrome Through Your Firewall: Windows, macOS, and Linux

Sean

Platform Writer

Jul 07, 2026
5 min read

Allow Chrome through the firewall means: Chrome is allowed to make outbound connections on TCP 80 (HTTP), TCP 443 (HTTPS), and UDP 443 (QUIC). On Windows, the easiest path is Windows Defender Firewall -> Allowed apps. On macOS, the Application Firewall auto-allows signed Apple apps. On Linux, ufw and iptables need explicit rules. The team that has Chrome blocked by a corporate firewall asks the firewall admin; the team that has it blocked by a personal firewall configures the OS to allow chrome.exe / Google Chrome.

Allow Chrome Through Your Firewall: Windows, macOS, and Linux

Table of contents

What ports Chrome needs

Outbound:

  • TCP 80 (HTTP, legacy)

  • TCP 443 (HTTPS, primary)

  • UDP 443 (QUIC, optional - speeds up some connections)

Chrome also opens ephemeral outbound ports for WebRTC (voice/video) but the firewall config is about the server-side ports.

Inbound: typically nothing. Chrome is a client, not a server. The team that runs a web server on the same machine that uses Chrome does not need to allow inbound for Chrome - the web server has its own allow rule.

Windows: Windows Defender Firewall

  1. Open wf.msc (Windows Firewall with Advanced Security).

  2. Inbound Rules -> New Rule -> Program -> C:\Program Files\Google\Chrome\Application\chrome.exe -> Allow the connection -> Domain, Private, Public (or just Private for a work laptop).

  3. Repeat for Outbound Rules if the firewall is in a restrictive mode.

Or the simpler path: wf.msc -> Allowed Apps -> Change settings -> check Google Chrome for the network types you want.

The team that uses the Windows Security GUI: Settings -> Privacy & Security -> Windows Security -> Firewall & network protection -> Allow an app through firewall.

macOS: Application Firewall

macOS auto-allows signed Apple apps. Google Chrome is signed by Google, so it should be allowed by default. The team that has Chrome blocked has either:

  1. A third-party firewall (Little Snitch, LuLu) that blocked it manually.

  2. A custom pf rule blocking it.

For pf: edit /etc/pf.conf (or your anchor file) and add Chrome’s executable to the pass rules. The team that uses LuLu gets a popup on first launch and clicks Allow.

Linux: ufw and iptables

ufw (the Ubuntu default):


sudo ufw allow out 80,443/tcp

sudo ufw allow out 443/udp   # QUIC

iptables:


sudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

sudo iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

sudo iptables -A OUTPUT -p udp --dport 443 -j ACCEPT

The team that has a default-deny OUTPUT policy needs these explicit rules. The team that has a default-allow policy does not.

Why Chrome gets blocked in the first place

Common causes:

  1. Corporate firewall with TLS inspection - the firewall intercepts Chrome’s HTTPS to a MITM proxy. Chrome detects the untrusted cert and blocks. The team that has this is in a corporate environment; the fix is the IT department’s cert installed in Chrome’s trust store.

  2. Personal firewall over-blocking - the firewall was configured to allow only specific apps. The team that added Chrome to the deny list by mistake re-adds it to the allow list.

  3. Network-level filter (school, public WiFi) - blocks Chrome specifically to force users to use a captive portal browser. The team that hits this is at a coffee shop; the fix is to authenticate on the captive portal.

  4. Antivirus with a built-in firewall - Norton, Kaspersky, etc. The team that disables the AV’s web shield temporarily confirms this is the cause.

FAQ

Why does Chrome say NET::ERR_CERT_AUTHORITY_INVALID on some networks?

The network is intercepting HTTPS with a corporate proxy. Chrome does not trust the proxy’s certificate. The fix: install the corporate CA cert in Chrome’s trust store, or have IT exclude your site from TLS inspection.

Can I block Chrome on my network?

Yes, by blocking the user-agent on the proxy, or by blocking the Chrome update servers (which Chrome uses to keep itself up). The team that does this in a corporate environment usually also blocks the alternative browsers.

What is the difference between allowing Chrome and allowing the browser in general?

Some firewalls work at the executable level (allow chrome.exe). Some work at the port level (allow 443). The team that wants Chrome specifically allowed but other browsers blocked uses the executable-level rule.

Does Chrome need inbound ports open?

No - Chrome is a client. The team that opens inbound ports for Chrome is wrong. The exception: if you are running Chrome Remote Desktop, inbound port 443 (or the configured port) is needed for the host machine.

Why does my firewall log Chrome repeatedly?

Modern Chrome opens many concurrent connections (HTTP/2 multiplexing, preconnects, prefetching). A firewall log shows each one. The team that sees a flood of Chrome entries has a noisy log, not a real issue.

How this fits the rest of the stack

For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.

Useful related references:

#firewall#chrome#windows#macos