Firewall¶
The firewall decides which network traffic gets in. With it on and at defaults, nothing can connect to the machine unless a rule allows it. With it off, every listening port is reachable. And with logging on, you can see who tried.
Check the state¶
netsh advfirewall show allprofiles state
Domain Profile Settings:
State ON
Private Profile Settings:
State ON
Public Profile Settings:
State OFF
All three profiles should be ON. A machine can be on any of the three depending on how it classifies the network it's plugged into.
Per-profile settings¶
The benchmark specifies the same things for each profile: Domain 9.1.1 to 9.1.7, Private 9.2.1 to 9.2.7, Public 9.3.1 to 9.3.9 (state, inbound, outbound, notification, log name, log size, log dropped, log allowed, and for Public the two local-rules settings). Set them in wf.msc → right-click Windows Defender Firewall with Advanced Security → Properties → one tab per profile.
| Setting | Set to | Why |
|---|---|---|
| Firewall state | On | |
| Inbound connections | Block (default) | Nothing gets in without a rule |
| Outbound connections | Allow (default) | |
| Settings → Display a notification | No | Users don't get a "allow this app?" pop-up they can click through. Blocked means blocked. |
| Logging → Name | %SystemRoot%\System32\logfiles\firewall\domainfw.log (and privatefw.log, publicfw.log) |
One log per profile |
| Logging → Size limit | 16384 KB or more | Room for a day's traffic |
| Logging → Log dropped packets | Yes | What was blocked, and from where |
| Logging → Log successful connections | Yes | What got through |
Public profile has one extra: Settings → Apply local firewall rules: No, and Apply local connection security rules: No. On a public network, only policy-defined rules apply; a user or installer can't add one.
Apply from the command line¶
netsh advfirewall set allprofiles state on
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
netsh advfirewall set allprofiles settings inboundusernotification disable
netsh advfirewall set domainprofile logging filename %SystemRoot%\System32\logfiles\firewall\domainfw.log
netsh advfirewall set privateprofile logging filename %SystemRoot%\System32\logfiles\firewall\privatefw.log
netsh advfirewall set publicprofile logging filename %SystemRoot%\System32\logfiles\firewall\publicfw.log
netsh advfirewall set allprofiles logging maxfilesize 16384
netsh advfirewall set allprofiles logging droppedconnections enable
netsh advfirewall set allprofiles logging allowedconnections enable
netsh advfirewall set publicprofile settings localfirewallrules disable
netsh advfirewall set publicprofile settings localconsecrules disable
If the switch in Windows Security is greyed out, a policy is forcing it off: gpedit.msc → Computer Configuration → Administrative Templates → Network → Network Connections → Windows Defender Firewall → set Protect all network connections to Not Configured or Enabled.
Review the allowed apps¶
Windows Security → Firewall & network protection → Allow an app through firewall → Change settings.
Allow programs, not ports. An allowed program can receive traffic only for itself; an open port lets anything listening on it receive traffic.
| Exception | Keep? |
|---|---|
| Core Networking | Yes, all profiles |
| File and Printer Sharing | Only if the machine shares files or printers |
| Remote Desktop | Only if the README requires RDP |
| Remote Assistance | No |
| Remote Event Log Management, Remote Scheduled Tasks Management, Remote Service Management, Remote Volume Management, Windows Remote Management | No, on a workstation |
| Network Discovery | Private profile only, if at all |
| UPnP, SSDP | No |
| Anything you don't recognize | Look it up, then usually no |
Review the rules¶
wf.msc → Inbound Rules. Sort by Enabled. Look for rules that allow a port with no program, rules for programs you removed, and rules that allow on all profiles when they shouldn't.
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Where { $_.Group -eq "" } | Select DisplayName, Profile
Rules with an empty Group were added by hand or by an installer. Each one needs a reason.
Read the log¶
Get-Content C:\Windows\System32\logfiles\firewall\publicfw.log -Tail 30
Each line: date, time, action (DROP or ALLOW), protocol, source IP, destination IP, source port, destination port. Repeated DROPs from one source across many ports is a port scan.
Verify¶
netsh advfirewall show allprofiles
Check State, Firewall Policy, InboundUserNotification, and the Logging block for each profile.
Example¶
The Public profile is OFF and there's an inbound rule "Allow 4444" with no program attached. Turn the profile on, delete the rule, and check whether anything was listening on 4444 (Listening Ports). Then turn on logging so the next attempt is recorded.