Windows Firewall (also known as Windows Defender Firewall in the latest versions of Windows) is a local firewall software for Windows. A local firewall means that the firewall only protects the device itself, including attacks from the same local network.

It acts as a filter for both incoming (ingress) and outgoing (egress) data traffic, allowing or blocking connections based on predefined rules.

Firewall Profiles: Domain, Private and Public

Windows firewall has three main profiles that determine how the firewall behaves in different network conditions. These profiles are "Domain", "Private", and "Public". The settings for each profile can be configured separately to provide the appropriate level of protection depending on where and how the computer is used. Here's an explanation for each profile:

Domain profile is active when a computer is connected to a company or organization network that uses Active Directory management.

The private profile is intended for use in trustworthy private networks, such as home networks or small business networks.

Public (public) profile is intended for use in public networks, such as cafes, libraries, or airport Wi-Fi networks, which are not trusted.

How does Windows know if the network is private or public?

Windows does not know if you are connected to a Wi-Fi network in a cafe or in your home network. So, when you connect your computer to a new network, Windows usually asks if you trust this network or not. At this point, you can choose whether to keep the network public or private.

Domain profile can be deduced automatically from an Active Directory domain (a topic which is not covered in depth in this course).

Checking and enabling the state of Windows Firewall

You can open the firewall settings by typing "Windows Defender Firewall" into the Windows search bar and selecting the appearing application.

Check the status of the firewall to ensure that it is enabled.

If the firewall is not in use, you can enable it by clicking on the button "Turn Windows Defender Firewall on or off".

Select "Advanced settings" to access additional management options and navigate to "Inbound Rules" or "Outbound Rules" to add new rules.

Click "New Rule" to create a new rule. You can create a rule for a program, a port, a specific service, or a custom rule.

Define the rule settings, for example in the case of a port, which port is in question.

Tell Windows how to act when this kind of connection is detected. Should it be allowed or blocked (or only allowed within an IPSec tunnel)?

Specify which profiles you want the rule to apply to.

Finally, give a name and description to the rule.

If you want to edit or delete an existing rule, you can do so by navigating to that rule in the Advanced settings view, right-clicking it, and selecting "Properties" or "Delete".

The lab takes a couple of minutes to start up, please wait patiently and add more time if needed. You don't need to close the lab between switching modules in this course. You can log in to the server via RDP with the username "

Windows practice

Enable Windows firewall (turn it on). When that is done, run Check.ps1 and enter flag 1.

You are asked to open TCP port 80 (HTTP) so that a web application can be installed on the server. Open the port, then run Check.ps1 and enter flag 2.

## What is Windows Firewall?

Windows Firewall (also known as Windows Defender Firewall in the latest versions of Windows) is a local firewall software for Windows. A local firewall means that the firewall only protects the device itself, including attacks from the same local network.

It acts as a filter for both incoming (ingress) and outgoing (egress) data traffic, allowing or blocking connections based on predefined rules.

---

## Firewall Profiles: Domain, Private and Public

Windows firewall has three main profiles that determine how the firewall behaves in different network conditions. These profiles are "Domain", "Private", and "Public". The settings for each profile can be configured separately to provide the appropriate level of protection depending on where and how the computer is used. Here's an explanation for each profile:

### Domain profile

Domain profile is active when a computer is connected to a company or organization network that uses Active Directory management.

### Private profile

The private profile is intended for use in trustworthy private networks, such as home networks or small business networks.

### Public profile

Public (public) profile is intended for use in public networks, such as cafes, libraries, or airport Wi-Fi networks, which are not trusted.

### How does Windows know if the network is private or public?

Windows does not know if you are connected to a Wi-Fi network in a cafe or in your home network. So, when you connect your computer to a new network, Windows usually asks if you trust this network or not. At this point, you can choose whether to keep the network public or private.

Domain profile can be deduced automatically from an Active Directory domain (a topic which is not covered in depth in this course).

Checking and enabling the state of Windows Firewall

---

## Windows Firewall Management

### Opening a Firewall

You can open the firewall settings by typing "Windows Defender Firewall" into the Windows search bar and selecting the appearing application.

![](sanity:image-39352546a8bb626c1dbbdcad818257db224c37bc-1322x1184-png)

### Checking Firewall Status

Check the status of the firewall to ensure that it is enabled.

### Enabling Firewall

If the firewall is not in use, you can enable it by clicking on the button "Turn Windows Defender Firewall on or off".

![](sanity:image-a96ff2ee181b2067847e6856db54879612716939-1660x1124-png)

![](sanity:image-48fe0fb5938610501c9633598de1264b2e0bf585-1226x898-png)

### **Creating a New Rule:**

- Select "Advanced settings" to access additional management options and navigate to "Inbound Rules" or "Outbound Rules" to add new rules.

![](sanity:image-f1d27b632fa9b3f82637596de667dd8e9193ce1d-1842x1058-png)

- Click "New Rule" to create a new rule. You can create a rule for a program, a port, a specific service, or a custom rule.

![](sanity:image-3eb64d1d00302f88baa86adbaa814edaa71f592e-1606x844-png)

- Define the rule settings, for example in the case of a port, which port is in question.

![](sanity:image-51aa6644f67c5336a07b604c9f3a66490f965fee-1034x456-png)

- Tell Windows how to act when this kind of connection is detected. Should it be allowed or blocked (or only allowed within an IPSec tunnel)?

![](sanity:image-7becbc818753ba300062cbddcf74bd53e217e02f-1368x612-png)

- Specify which profiles you want the rule to apply to.

![](sanity:image-eaf45a9af69ede0a306df906c6aae3d204b02d9c-1010x452-png)

- Finally, give a name and description to the rule.

### **Modifying or Deleting Rules:**

If you want to edit or delete an existing rule, you can do so by navigating to that rule in the Advanced settings view, right-clicking it, and selecting "Properties" or "Delete".

---

## Tasks

@exercise 60e1872c5098

### Enable Windows Firewall

Enable Windows firewall (turn it on). When that is done, run Check.ps1 and enter flag 1.

@exercise 9d377755ac57

### Open TCP port 80 to the Internet

You are asked to open TCP port 80 (HTTP) so that a web application can be installed on the server. Open the port, then run Check.ps1 and enter flag 2.

@exercise ae3829afb02d


Windows Firewall

In this course, we go through the basics related to managing Windows systems and maintaining information security.

In this course, we will go through the basics of Windows system administration and cybersecurity maintenance.

We familiarize ourselves with Windows virus protection, firewall, and automatic updates. We learn to use remote desktop connections, registry editor, PowerShell, server manager, and group policies.

The course does not go into great depth on Windows domains, attacks on them, or hardening. These more advanced topics are covered in the "Windows - Attack and Defense" course.

Windows Firewall

What is Windows Firewall?

Learn to hack — start here