🔥 Windows Firewall Configuration
Your First Line of Defense — Enable, Verify, Lock Down
Windows Firewall is on by default but most people don't verify or configure it correctly. This guide walks you through enabling it for all 3 network profiles (Domain, Private, Public), locking down Public networks, allowing specific apps, and using Advanced Security (wf.msc) for granular rules.
Why the Firewall Matters
The Windows Firewall — officially Microsoft Defender Firewall — filters network traffic entering and leaving your PC. Its primary job is to block unauthorized incoming connections from other machines on your network or the internet, while allowing the connections you explicitly want (browsing, updates, apps you use).
The firewall is a reactive defense: it enforces rules about what traffic is allowed. It does not detect malware, phishing, or exploits inside allowed traffic. That's why you pair it with Microsoft Defender Antivirus — the firewall filters the network layer, Defender inspects file and process behavior. Together they cover the two most common intrusion paths.
- Blocks: unsolicited inbound connections (network probes, exploit attempts against listening services)
- Allows: outbound connections you initiate (web browsing, DNS, updates) and inbound traffic for explicitly permitted apps
- Does not block: malicious content inside allowed traffic — that's Defender's job
💡 On by Default — But Verify
Windows 11 ships with the firewall enabled for all 3 profiles. But installers, VPN clients, gaming tools, and legacy troubleshooting steps can silently disable it. Always verify — don't assume.
3 Network Profiles Explained
Windows applies different firewall rules depending on the type of network you're connected to. There are 3 profiles, and only one is active at a time based on the current network:
- Domain network — automatically applied when your PC is joined to an Active Directory domain and can reach a domain controller. Rules assume a managed corporate environment. If you're not on a domain-joined PC, this profile is never active.
- Private network — home or trusted networks. Allows discoverable services like file sharing, printer sharing, and network discovery. Choose this only for networks you own or fully trust.
- Public network — coffee shops, airports, hotels, conferences, or any network where you don't know who else is connected. Lock it down. This is the profile where the firewall has to do its hardest work.
💡 The Active Profile Determines the Rules
When you connect to a new Wi-Fi network, Windows asks whether it's a Private or Public network. That choice determines which firewall profile is applied and therefore which rules are in effect. When in doubt, choose Public. You can always relax the setting later — you cannot unring the bell if you exposed file sharing to a hotel LAN.
Step 1: Verify All 3 Profiles Are ON
Start by confirming the firewall is enabled for every profile — not just the currently active one. A disabled profile becomes a silent liability the moment you connect to that type of network.
1 Check firewall status in Windows Security:
- Open Start > Windows Security
- Click Firewall & network protection
- You will see three entries: Domain network, Private network, Public network
- Each one must read "Firewall is on" — if any says "off", click it and toggle Microsoft Defender Firewall to On
Confirm the same from PowerShell — this is the fastest way to audit all 3 profiles at once and the command you should run any time you suspect an installer has changed something:
All three rows (Domain, Private, Public) must show Enabled : True. Anything else, fix it before continuing.
Step 2: Lock Down Public Networks
On a Public network you are one of possibly hundreds of untrusted devices sharing the same LAN. Any listening service on your PC — a background updater, a media server, a dev tool — is potentially reachable by everyone else on that Wi-Fi. Turn on the "block all incoming" toggle to slam the door.
2 Enable "Blocks all incoming connections" for Public:
- Open Windows Security > Firewall & network protection
- Click Public network
- Toggle "Blocks all incoming connections, including those in the list of allowed apps" to ON
This is critical at coffee shops, airports, hotels, and conferences. Outbound traffic (browsing, email, apps you use) still works normally — you can still get things done. What changes is that nothing on the network can initiate a connection to your PC, even for apps you have otherwise allowed.
⚠️ Tradeoff — Some Legit Apps May Not Work
With "Block all incoming" ON, features like AirDrop-style file sharing, casting to a TV, or a printer on the same LAN will not work. On a Public network, that's exactly what you want. If you actually need those features, you're on the wrong profile — it's not really a public network.
Step 3: Review Allowed Apps
Every time you install an app that wants to accept inbound connections, Windows either prompts you or silently adds an exception. Over months and years, that list grows — and old, forgotten apps become unnecessary attack surface.
3 Audit your allowed apps list:
- Open Windows Security > Firewall & network protection
- Click "Allow an app through firewall"
- Click Change settings (requires admin)
- Scan the list — for each entry, check whether the app is still installed and whether it needs inbound access
- Anything you don't recognize? Remove it or uncheck both Private and Public
Pay particular attention to high-risk entries — these should almost never be checked for Public:
- Remote Desktop — allows inbound RDP. Only enable on trusted networks; ideally reach RDP via VPN, never expose to Public.
- File and Printer Sharing — SMB inbound. Fine on a home network, dangerous on Public.
- Network Discovery — advertises your PC to the LAN. Public: off.
- Any dev tool or game listener you no longer use.
Step 4: Advanced — wf.msc for Granular Rules
The Windows Security UI only exposes basic on/off toggles. For real control — specifying ports, protocols, programs, remote IP ranges, and outbound rules — you need the classic Windows Defender Firewall with Advanced Security console.
4 Open Advanced Security:
- Press Win + R, type wf.msc, press Enter
- You'll see three rule categories in the left pane:
- Inbound Rules — control connections coming into your PC (this is where most tuning happens)
- Outbound Rules — control connections leaving your PC (default is allow-all outbound; you can add blocks)
- Connection Security Rules — IPsec authentication and encryption between machines (advanced)
A common use case is blocking a specific application from calling home — for example, an app that phones back to telemetry servers you don't want to allow. From an elevated PowerShell you can create the rule in one line:
The rule shows up immediately in wf.msc under Outbound Rules. To remove it later, either delete it in the console or run Remove-NetFirewallRule -DisplayName "Block MyApp Outbound".
Step 5: Enable Logging (Optional but Valuable)
By default, Windows Firewall does not log anything. That means if a suspicious inbound connection is being blocked repeatedly, you have no record of it. Turning on logging — especially dropped packets — gives you visibility into what the firewall is actually doing.
5 Turn on firewall logging per profile:
- Open wf.msc
- Right-click Windows Defender Firewall with Advanced Security on Local Computer at the top of the left pane, choose Properties
- You'll see tabs: Domain Profile, Private Profile, Public Profile
- On each tab, click Customize… under Logging
- Set Log dropped packets to Yes (and optionally Log successful connections)
- Confirm the log path: %systemroot%\System32\LogFiles\Firewall\pfirewall.log
- Increase the size limit (default 4 MB is tiny — bump to 32768 KB or more)
Once enabled, the log becomes useful when investigating "why does this network keep failing" or "is something on the LAN scanning me". Open pfirewall.log in Notepad or parse it in PowerShell to see blocked source IPs, ports, and timestamps.
⚠️ Common Mistakes
- Turning off the firewall to fix an app issue — never do this. Add a targeted exception for that app instead, then remove it when you're done troubleshooting.
- Setting a coffee shop as "Private network" — this defeats the entire point. When Windows asks, choose Public unless you personally own the router.
- Ignoring the Domain network profile if you have a hybrid work setup — it can silently be disabled while Private/Public look fine, leaving you exposed the next time you connect to the corporate LAN or VPN.
- Never reviewing "Allow an app through firewall" — old apps accumulate and become forgotten inbound holes.
- Assuming outbound is filtered — by default Windows allows all outbound. If you want to block a specific app from phoning home, you have to add the rule yourself.
✅ You're Done
Your Windows Firewall is now verified, hardened, and observable.
- All 3 profiles (Domain, Private, Public) are confirmed On
- Public networks are locked down with Block all incoming connections
- The allowed apps list has been audited — nothing unrecognized, nothing exposed to Public that shouldn't be
- You know how to open wf.msc and create granular inbound / outbound rules with PowerShell
- Dropped-packet logging is enabled so you can investigate suspicious blocks later
The firewall is your first line of defense. Pair it with Microsoft Defender hardening for full protection at both the network and process layers.