SECURITY
Firewall basicsWhat a firewall does and how Windows profiles work
A firewall controls which network connections are allowed in and out of a device or network, based on rules about addresses, ports and direction. Modern firewalls are stateful: they track connections so replies to allowed outbound traffic return automatically. Windows Defender Firewall applies different rule sets per network profile: Domain, Private and Public.
What a firewall does
A firewall sits between a device (or network) and the rest of the world and decides which connections to allow. Rules match on source and destination address, port and protocol, and direction. The default posture for most host firewalls is block unsolicited inbound, allow outbound, so the machine can reach out but is not reachable unless a rule permits it.
Stateful filtering
A stateful firewall tracks active connections. When you make an allowed outbound request, the firewall remembers it and lets the reply back in automatically, without needing an explicit inbound rule for the response. This is why you can browse the web without opening inbound ports. A stateless filter, by contrast, evaluates each packet in isolation and needs rules for both directions.
Inbound and outbound
The two directions are evaluated separately:
- Inbound rules decide what may connect to the machine. This is where you allow a service such as RDP or SMB, ideally scoped to specific source networks.
- Outbound rules decide what the machine may connect to. Allowed by default on Windows; restricting them contains compromised software.
Windows Defender Firewall profiles
Windows classifies each network connection into a profile and applies that profile's rules:
| Profile | When | Typical posture |
|---|---|---|
| Domain | A domain controller is reachable | Rules pushed by Group Policy |
| Private | A network you marked as trusted (home, office) | File sharing and discovery may be allowed |
| Public | Untrusted (public Wi-Fi) | Most inbound blocked |
Because rules are per profile, a laptop can share files at home (Private) and automatically clam up on café Wi-Fi (Public). Scope inbound rules to the narrowest profile and source range that works; a rule allowing 3389 on all profiles from any address is a common mistake.
Configuring
- wf.msc — the graphical "Windows Defender Firewall with Advanced Security".
- netsh advfirewall firewall — command line.
- PowerShell —
New-NetFirewallRule,Get-NetFirewallRule,Set-NetFirewallProfile.
Good practice
- Allow only what is needed, scoped to source networks and the right profile.
- Do not disable the firewall to "fix" a connectivity problem; add a precise rule instead.
- Confirm what is actually listening with netstat before opening a port; see open ports and exposure.
- Remember a firewall controls reachability, not the security of the service behind it. An allowed but unpatched service is still exposed.
Frequently asked questions
What is the difference between the Windows firewall profiles?
Windows assigns each network a profile: Domain (a network with a reachable domain controller), Private (a home or work network you trust) or Public (untrusted, such as café Wi-Fi). Each profile has its own rules, so file sharing might be allowed on Private but blocked on Public automatically.
Is a firewall the same as NAT?
No, though NAT has a firewall-like side effect. NAT translates addresses and incidentally blocks unsolicited inbound traffic because it has no mapping for it. A firewall applies explicit policy, logs, and controls outbound traffic too. See the NAT record.
Should I block outbound traffic?
Home users rarely need to; the default of allowing outbound is convenient. In managed environments, restricting outbound traffic limits what malware can do (contacting command servers, exfiltrating data) and is good practice, at the cost of maintenance.