Advanced Windows Firewall

If you’re managing a Windows system, you likely know about Windows Firewall. You may use it to permit certain applications, open ports, or block unwanted incoming connections. However, these familiar activities only scratch the surface of its capabilities.

For a deeper understanding, check out the Microsoft Learn module Understanding Advanced Windows Firewall. This resource goes beyond basic operations, presenting Windows Firewall as a robust tool for host-based segmentation, controlled access, safeguarding traffic, gathering operational data, and enhancing incident responses. Here’s what you’ll explore in the module:

• How to view active, enabled rules in the ActiveStore.
• Steps to check the filters for ports, addresses, applications, and services linked to a rule.
• Guidelines to create well-defined inbound rules for services such as HTTPS, WinRM, Remote Desktop, and WMI.
• How to enable, disable, modify, or delete existing rules using PowerShell.
• The importance of establishing a traffic contract before setting up a rule.
• How to accurately differentiate between local and remote ports and addresses.
• Steps to narrow down rules by protocol, address, application, user, and other criteria.
• How to restrict rules to stable executable paths, Windows services, or packaged application identities.
• Ways to limit access to important subnets, management hosts, and application tiers.
• How to create uniform rule names and groups for better management and automation.

• Applying varied policies for Domain, Private, and Public networks.
• Enabling the firewall to block unmatched inbound traffic across all profiles.
• Restricting administrative exceptions to only the required profiles.
• Inspecting active network profiles and their default behaviours.
• Designing security policies that stay intact during DNS or network failures.
• Testing how network outages influence profile selection.

• Creating a traffic matrix to outline allowed communication between devices and application tiers.
• Implementing a default-deny strategy for inbound segmentation.
• Blocking unnecessary communication between workstations.
• Ensuring approved traffic for management, monitoring, and application processes is maintained.
• Reducing unwanted lateral movement via controlled management paths.
• Distributing firewall policies through Group Policy for central management.
• Disabling local merging of firewall and connection-security rules.
• Organising staged enforcement through logging, pilots, and role-based deployment.
• Establishing success criteria while ensuring a solid rollback plan.

• Designing IPsec connection security rules to ensure peer authentication.
• Ensuring packet integrity, replay protection, and optional encryption.
• Choosing either Kerberos or certificate-based authentication for various trust scenarios.
• Protecting legacy plaintext applications without needing to alter the application.
• Coordinating secure firewall rules with suitable connection security settings.
• Utilising request-based authentication during deployment before enforcing mandatory authentication.
• Defining IPsec endpoints and traffic selectors accurately.
• Ensuring that authenticated traffic is a requirement for access.
• Authorising traffic based on Active Directory user-group memberships.
• Requiring both an authorized user and a managed device for access.
• Combining identity restrictions with network, service, application, and profile limitations.
• Creating tightly defined authenticated bypass rules.
• Designing identity exceptions that are consistently governed.
• Validating both successful and denied authorization processes.

• The role of stateful inspection in allowing response traffic.
• Avoiding unnecessary inbound rules for dynamic client ports.
• Identifying necessary dependencies before moving to an outbound default-deny strategy.
• Restricting high-risk applications, administrative tools, and services to approved destinations only.
• Considering dynamic cloud services and proxies when applying restrictions.
• Introducing outbound restrictions progressively through monitoring and narrow rule adjustments.

• Enabling logging for dropped packets and successful connections.
• How to set the log location and maximum size for each profile.
• Checking effective logging settings to ensure they meet your needs.
• Understanding log fields such as action, protocol, address, port, and direction.
• Using logged traffic to identify application dependencies.
• Distinguishing between observed and authorized traffic.
• Using dropped-packet logs to verify whether the traffic reached the firewall.
• Using successful-connection records to ensure firewall access was granted.
• Forwarding firewall evidence to secure central storage.
• Linking firewall data with application, process, and network telemetry.

• Following a systematic diagnostic path from the application listener through to firewall and IPsec state.
• Examining the merged runtime policy rather than solely focusing on an individual policy.
• Tracing effective rules back to their Group Policy or other origins.
• Identifying any conflicting or overriding block rules.
• Inspecting active IPsec rules and security associations.
• Diagnosing issues related to authentication, name resolution, and mismatched cryptographic settings.
• Capturing and analysing IPsec negotiation traffic on UDP ports 500 and 4500.
• Distinguishing between firewall access failures and application or identity-related failures.
• Making controlled policy adjustments without deactivating the firewall or creating unrestricted exceptions.

Windows Firewall is likely already part of your daily Windows operations. This module will broaden your view of the built-in security and diagnostic functions and teach you how to apply them effectively.

Start your learning journey: Understanding Advanced Windows Firewall