A firewall decides which network connections are allowed to reach your computer and which are blocked. Windows includes a built-in firewall, and in this lesson you will learn to turn it on and set sensible rules on your own practice VM.

Safety note: do this on your own practice VM from a snapshot. Firewall mistakes can cut off network or remote access to that VM.

How the firewall works

Network traffic uses ports, numbered doors that programs listen on. For example, web pages use port 80 (HTTP) and 443 (HTTPS), and Remote Desktop uses 3389. The firewall checks each connection against a list of rules.

  • Inbound rules control traffic coming into your computer.
  • Outbound rules control traffic leaving it.
  • By default, Windows blocks inbound connections that do not match an allow rule and allows outbound ones.

Windows has three profiles, which can have different settings:

  • Domain: when joined to a company network.
  • Private: trusted networks such as home.
  • Public: untrusted networks such as a cafe.

Turning it on and checking it

Open Windows Defender Firewall from the Start menu, or Windows Defender Firewall with Advanced Security by running wf.msc.

  • Click Turn Windows Defender Firewall on or off and make sure it is On for Domain, Private and Public profiles.
  • Open Windows Defender Firewall Properties in the advanced tool. For each profile set Inbound connections to Block (default).
  • Tick Block all incoming connections only if the machine offers no services at all.

From an administrator Command Prompt:

netsh advfirewall show allprofiles
netsh advfirewall set allprofiles state on
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound

The first command shows the state of every profile. The second turns the firewall on everywhere. The third blocks inbound traffic by default and allows outbound.

Reviewing rules

In the advanced console, click Inbound Rules and look through the list. Check the Enabled column and the Program and Local Port columns.

Questions to ask about any rule:

  • Does the scenario need this service?
  • Does the rule allow any program from any address when it could be limited?
  • Is the program a real, known application?

To disable a rule you do not need (for example, a Remote Assistance or Telnet rule), right-click it and choose Disable Rule. From the command line, you can review and change by name:

netsh advfirewall firewall show rule name=all
netsh advfirewall firewall set rule name="Telnet Server" new enable=no

To add a rule that blocks an unwanted port on your practice VM:

netsh advfirewall firewall add rule name="Block Telnet" dir=in action=block protocol=TCP localport=23

Good habits

  • Keep the firewall on at all times.
  • Allow only the ports your machine needs.
  • Test after changes by confirming that needed services still work.
  • Write down every rule you change.

You can confirm which ports are listening with netstat -ano, which shows listening ports and the process ID using each one.

Check your understanding

1. What does an inbound rule control?

  • Traffic leaving the computer
  • Traffic coming into the computer
  • Screen brightness
  • User passwords

Answer: Traffic coming into the computer. Outbound rules control traffic leaving it.

2. Which firewall profiles should have the firewall turned on?

  • Only Public
  • Only Domain
  • Domain, Private and Public
  • None

Answer: Domain, Private and Public. Network location can change, so all profiles should be protected.

3. What command shows the state of every firewall profile?

  • netsh advfirewall show allprofiles
  • net user
  • ping localhost
  • gpupdate

Answer: netsh advfirewall show allprofiles. It lists whether each profile is on and its default policy.

4. Port 3389 is normally used by which service?

  • Web browsing
  • Email
  • Remote Desktop
  • DNS

Answer: Remote Desktop. If a machine does not need remote access, that port should stay blocked.

PreviousNext