Firewall¶

The firewall decides which network traffic gets in. With it on and at defaults, nothing can connect to the machine unless a rule allows it. With it off, every listening port is reachable. And with logging on, you can see who tried.

Check the state¶

netsh advfirewall show allprofiles state

Domain Profile Settings:
State                                 ON
Private Profile Settings:
State                                 ON
Public Profile Settings:
State                                 OFF

All three profiles should be ON. A machine can be on any of the three depending on how it classifies the network it's plugged into.

Per-profile settings¶

The benchmark specifies the same things for each profile: Domain 9.1.1 to 9.1.7, Private 9.2.1 to 9.2.7, Public 9.3.1 to 9.3.9 (state, inbound, outbound, notification, log name, log size, log dropped, log allowed, and for Public the two local-rules settings). Set them in wf.msc → right-click Windows Defender Firewall with Advanced Security → Properties → one tab per profile.

Setting	Set to	Why
Firewall state	On
Inbound connections	Block (default)	Nothing gets in without a rule
Outbound connections	Allow (default)
Settings → Display a notification	No	Users don't get a "allow this app?" pop-up they can click through. Blocked means blocked.
Logging → Name	`%SystemRoot%\System32\logfiles\firewall\domainfw.log` (and `privatefw.log`, `publicfw.log`)	One log per profile
Logging → Size limit	16384 KB or more	Room for a day's traffic
Logging → Log dropped packets	Yes	What was blocked, and from where
Logging → Log successful connections	Yes	What got through

Public profile has one extra: Settings → Apply local firewall rules: No, and Apply local connection security rules: No. On a public network, only policy-defined rules apply; a user or installer can't add one.

Apply from the command line¶

netsh advfirewall set <profile> <what> <value> is one command per setting. The profile is allprofiles, domainprofile, privateprofile, or publicprofile:

netsh advfirewall set allprofiles state on
netsh advfirewall set publicprofile logging filename %SystemRoot%\System32\logfiles\firewall\publicfw.log

From the table above, write the rest yourself: the inbound/outbound policy (firewallpolicy blockinbound,allowoutbound), the notification setting (settings inboundusernotification disable), a log file name per profile, logging maxfilesize 16384, logging droppedconnections enable, logging allowedconnections enable, and for the public profile only, settings localfirewallrules disable and settings localconsecrules disable. Read the result back with netsh advfirewall show allprofiles; the expected shape of one profile:

Public Profile Settings:
State                                 ON
Firewall Policy                       BlockInbound,AllowOutbound
LocalFirewallRules                    Disable
LocalConSecRules                      Disable
InboundUserNotification               Disable
Logging:
LogAllowedConnections                 Enable
LogDroppedConnections                 Enable
FileName                              %systemroot%\system32\logfiles\firewall\publicfw.log
MaxFileSize                           16384

If the switch in Windows Security is greyed out, a policy is forcing it off: gpedit.msc → Computer Configuration → Administrative Templates → Network → Network Connections → Windows Defender Firewall → set Protect all network connections to Not Configured or Enabled.

Review the allowed apps¶

Windows Security → Firewall & network protection → Allow an app through firewall → Change settings.

Allow programs, not ports. An allowed program can receive traffic only for itself; an open port lets anything listening on it receive traffic.

Exception	Keep?
Core Networking	Yes, all profiles
File and Printer Sharing	Only if the machine shares files or printers
Remote Desktop	Only if the README requires RDP
Remote Assistance	No
Remote Event Log Management, Remote Scheduled Tasks Management, Remote Service Management, Remote Volume Management, Windows Remote Management	No, on a workstation
Network Discovery	Private profile only, if at all
UPnP, SSDP	No
Anything you don't recognize	Look it up, then usually no

Review the rules¶

wf.msc → Inbound Rules. Sort by Enabled. Look for rules that allow a port with no program, rules for programs you removed, and rules that allow on all profiles when they shouldn't.

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Where { $_.Group -eq "" } | Select DisplayName, Profile

Rules with an empty Group were added by hand or by an installer. Each one needs a reason.

Read the log¶

Get-Content C:\Windows\System32\logfiles\firewall\publicfw.log -Tail 30

Each line: date, time, action (DROP or ALLOW), protocol, source IP, destination IP, source port, destination port. Repeated DROPs from one source across many ports is a port scan.

Verify¶

netsh advfirewall show allprofiles

Check State, Firewall Policy, InboundUserNotification, and the Logging block for each profile.

Example¶

The Public profile is OFF and there's an inbound rule "Allow 4444" with no program attached. Turn the profile on, delete the rule, and check whether anything was listening on 4444 (Listening Ports). Then turn on logging so the next attempt is recorded.

Try it¶

Turn the firewall on for all profiles with netsh and read it back with show allprofiles.
Add an inbound allow rule for port 4444, find it in wf.msc, then delete it with netsh advfirewall firewall delete rule.

Build it¶

A firewall.bat with the netsh lines you wrote from the table, and netsh advfirewall show allprofiles at the end. Then a separate script that lists enabled inbound allow rules so you can spot one that shouldn't be there.

Next¶

Name Resolution and Discovery