Section 7: Windows Firewall

The Big Picture: A Doorman for Network Traffic

Your PC talks over the network all the time. Programs listen for connections, and other computers try to connect. Some of that traffic is welcome (a web page you asked for). Some is not (a stranger on the café Wi-Fi trying to reach a service on your PC).

A firewall is a doorman that looks at network traffic and decides: let it through, or drop it. Windows Defender Firewall is built into Windows and runs by default. It is a host firewall: it protects this one PC, rather than a whole network (a router's firewall protects the network edge).

Network words, explained:

Stateful. The Windows firewall is stateful: it remembers the connections your PC started. If you open a website (outbound), the reply coming back (inbound) is automatically allowed because it belongs to a conversation you began. An unrelated, unrequested packet from the outside is a different matter.

 Outbound request  ──────────►  Internet
 (you asked for a page)
 Reply (inbound)   ◄──────────  Internet     allowed: matches your request

 Stranger knocks (inbound, unrequested)  ──►  BLOCKED by default

Networking is covered in more depth later in the course. Here we only need the idea of packets, ports and who started the conversation.

7.1 Inbound/Outbound Rule Model

What it is: The firewall is a list of rules. Each rule says: for traffic that matches these conditions, do Allow or Block.

The defaults (very important):

Why this way? Incoming connections are the main way attackers reach a PC, so everything is closed by default. Outgoing traffic is mostly your programs doing things you wanted, so it is open by default. (Some companies and security tools switch outbound to block by default, but that takes much more rule-writing.)

What a rule can match on:

How rules are evaluated:

 Packet arrives (inbound)
        │
        ▼
 ┌───────────────────────────────┐
 │ Part of a connection you      │── yes ──► ALLOW (stateful)
 │ already started?              │
 └──────────────┬────────────────┘
                │ no
 ┌──────────────▼────────────────┐
 │ Any BLOCK rule matches?       │── yes ──► BLOCK (block beats allow)
 └──────────────┬────────────────┘
                │ no
 ┌──────────────▼────────────────┐
 │ Any ALLOW rule matches?       │── yes ──► ALLOW
 └──────────────┬────────────────┘
                │ no
                ▼
        PROFILE DEFAULT: BLOCK (inbound)

In general, a matching Block rule wins over an Allow rule. (The full ordering has extra steps, such as IPsec-related rules and service-hardening rules, but the idea above is the one to remember.)

Where rules come from:

• Built in: Windows ships with hundreds of rules, mostly turned off (for example, File and Printer Sharing). Turning one on opens a door.
• Installed programs: Many apps add their own rules when installed.
• The pop-up: When a program tries to listen for incoming connections, Windows may ask "Allow access?". Your answer creates a rule. On a Public network, be especially careful.
• You or your organisation: through Windows Defender Firewall with Advanced Security (wf.msc), PowerShell, or Group Policy.

Under the hood. The firewall's rules are enforced by the Windows Filtering Platform (WFP), a set of kernel filtering hooks in the network stack. Other security products can also add filters to it. (This is a simplified view; depends on version.)

Useful commands:

Get-NetFirewallProfile                          # state of the 3 profiles
Get-NetFirewallRule -Enabled True -Direction Inbound | Select DisplayName, Action -First 10
netsh advfirewall show allprofiles              # older command, same idea

Windows tip: Rules named for something you do not recognise are not automatically bad. But if you see an Allow rule for a program you never installed, or a rule that opens a high port to Any address, look it up before deleting. Do not disable the firewall to "fix" a problem; add a narrow rule for the one program or port instead.

7.2 Profiles (Domain, Private, Public)

What it is: Not all networks are equally trustworthy. Your home Wi-Fi is not the same as an airport hotspot. Windows lets you have different firewall settings per network type, called profiles.

What changes between profiles:

Each profile has its own on/off switch and its own default actions. One network connection uses one profile at a time. If you have several network cards, each can use a different profile, with the most restrictive one being applied where needed.

   You join "Cafe-WiFi" ──► Windows asks: private or public?
                                     │
                        ┌────────────┼────────────┐
                        ▼            ▼            ▼
                   Public rules  Private rules  Domain rules
                   (strict)      (more open)    (company policy)

How to see and change it:

Safe habit: On any network you do not control, choose Public. Only use Private at home and at places where you trust every device.

Why the firewall matters even with antivirus. A firewall acts before a bad packet reaches a program, so a bug in a listening service never gets a chance to be attacked. Defender (Section 6) acts on files and behaviour. They protect different things; use both.

Summary