Section 7: Windows Firewall Implementation

The Big Picture: A Rule-Based Gatekeeper

A firewall is a gatekeeper: it looks at network traffic and decides whether to let it through. The previous chapter explained ports and why you do not want every port open to the world. Windows Defender Firewall is the gatekeeper built into Windows. This section shows what it is made of.

7.1 WFP (Windows Filtering Platform)

What it is: As Section 2 showed, the Windows Filtering Platform (WFP) is the set of hooks inside the networking stack where filters can inspect traffic. The firewall is not a separate wall around the PC. It is a set of rules loaded into WFP, and WFP enforces them in the kernel for every packet and every connection.

The parts, and who does what:

  You / Group Policy / apps                 USER MODE
        │ create or change rules
        ▼
  ┌──────────────────────────┐
  │ MpsSvc (Windows Firewall)│  reads rules (stored in the registry)
  └────────────┬─────────────┘
               ▼
  ┌──────────────────────────┐
  │ BFE (Base Filtering Eng.)│  keeps the list of filters
  └────────────┬─────────────┘
  ═════════════╪═══════════════════════════════════
               ▼                            KERNEL MODE
  ┌──────────────────────────┐
  │ WFP layers in the stack  │  ◄── every packet / connection is checked
  │ (allow / block)          │
  └──────────────────────────┘

Rules live in the registry (the database where Windows keeps its settings), so they survive a restart. The firewall settings are kept per profile (Section 8).

Important: The Base Filtering Engine (BFE) is needed by the firewall, and by many VPN and security programs. If BFE is stopped, the firewall cannot work and some network features fail. Do not disable it.

Check them (read-only):

Get-Service BFE,mpssvc
Get-NetFirewallProfile
netsh advfirewall show allprofiles

Get-NetFirewallProfile shows each profile (Domain, Private, Public) and whether it is Enabled, plus the default action for inbound and outbound traffic. Get-NetFirewallRule lists the rules themselves (there are many, so add | Select-Object -First 10). You can also open Windows Security → Firewall & network protection, or the classic Windows Defender Firewall with Advanced Security (wf.msc) to look at them.

Other programs can add WFP filters. Antivirus suites, VPN clients and some security tools install their own filters. If you install a third-party firewall, Windows Defender Firewall can be turned off while the other one takes over.

7.2 Rule Processing Order

What a rule contains: A firewall rule describes what traffic it matches and what to do:

Default behaviour (the "if no rule matches" part):

• Inbound: blocked by default. Traffic that you did not ask for is dropped. A rule must allow it (for example, a rule created when you answered "Allow access" in the pop-up).
• Outbound: allowed by default. Your programs can reach out freely unless a rule blocks them.
• Replies to your own requests are allowed automatically. The firewall is stateful: it remembers connections you started and lets the answers back in.

Which rule wins. In general, rules are not checked "top to bottom" like a list. Windows evaluates them by how they combine, with this general order of strength (simplified, hedge: the full logic is detailed):

  Strongest ──────────────────────────────────────► Weakest
  1. Connection security / IPsec rules (when used)
  2. Block rules that match   (an explicit Block normally wins ...)
  3. Allow rules that match   (... over an Allow)
  4. The profile's default action (if nothing matched)

Two practical points to remember:

1. A matching Block rule normally beats a matching Allow rule. (There is a special "override block" kind of Allow rule, used with IPsec, that is rare for home users.)
2. More specific is not "stronger", unlike in routing. Any matching Block is enough.

Pop-ups: When a new program tries to listen for incoming connections, Windows may show "Allow this app through the firewall?" If you pick Allow, Windows creates Allow rules for the profile types you ticked (Private, Public).

Group Policy and managed PCs: On company PCs, rules may be set by an administrator and cannot be changed by you.

Windows tip: If a program works on your home Wi-Fi but not at a cafe, the profile is the likely reason (Section 8). Rules often apply to Private only, and the cafe network is Public.

Safety: Do not turn the firewall off to "see if it fixes things". Test with a specific allow rule instead, and turn it back on if you do disable it for a quick test.

Summary