another tool that we'll use
for managing our windows 10 security
is going to be the windows firewall now
just like windows defender we don't want
this to be the only thing we're using
we do want to use a windows firewall but
we want other firewalls and other places
on our network to provide overall
network protection as well
so this is not a
solution to every firewalling issue
but it is a good useful tool to have
and you don't if at all possible we
don't want to turn it off
because we want that protection in case
something gets through
our network-based firewall so let's look
at how we can manage it so i'm here
under settings
and update and security and then windows
security
and here is my firewall and network
protection
so i'm going to click on that and i'm
going to have
a simple way to deal with a firewall and
then we call it windows firewall with
advanced security for more detailed
information
so here is our firewall and network
protection you see we have different
domain pro or different network profiles
the domain network the private network
and the public network
and then this right here tells me that
i'm currently on the private network
profile
and currently the firewall is on now let
me go ahead and click on that
and i've got a couple of options here so
i can turn off my firewall now i don't
recommend doing this as a long-term
solution
but if you need to turn off the firewall
while you're troubleshooting an issue
that actually can be useful
something's not working i'm trying i'm
having a network connectivity issue let
me turn off my firewall
see if that fixes the problem now if
that does i don't want to leave my
firewall
off but now i know there's a firewall
setting that i'm going to need to adjust
so i'm going to try to find that
firewall setting so that i can
bring my firewall back up but allow that
particular application through the
firewall
so this turns it off
and then back on and it's now paranoid
because i turned his firewall off
i'm going to turn his firewall back on
that'll make it happy again
okay now so this is this
on or off all or nothing thing the other
all or nothing thing is this one right
here
so a firewall will control data coming
into your computer and data going
out from your computer and by default
windows firewall is going to allow
some things going out block most things
coming in unless they're specifically
allowed
what this does is this blocks all
incoming connections
and again this is going to be a
temporary thing this is not permanent
right
so i'm down at starbucks
i'm probably going to be on a public
network not a private network but i'm
down at starbucks
and for some reason i i just think you
know what i'm on the
network i'm on the network i'm surfing
the internet uh i'm working on a
document
but i really don't want
any access to my computer across this
network
so i can come in here and say just block
all incoming connections
including those who would otherwise be
allowed and that's just gonna you know
slam the door shut
so when we turn off windows defender you
know
get rid of all the locks on the doors
throw open the windows knock down the
walls just let anybody come in
this is the exact opposite go complete
lockdown
okay those are our two all or nothing
options and we can do that for
any one of these three profiles so i can
send my public network i want to block
all incoming connections while still
leaving incoming connections allowed on
a private network that i trust
a little bit better all right now
those are all or nothing most of the
time we don't want all or nothing
most of the time we're going to want
specific things and that's
here allow an app through the firewall
so let me bring this up and this is
going to show
a bunch of apps that are already allowed
through my firewall
and so you'll see the list of apps here
and a bunch of these are going to be
microsoft
apps but there are some of them that are
not going to be microsoft apps
like i have packet tracer installed on
my system
and so packet tracer created a rule for
the firewall
and it said hey go ahead and allow this
and i didn't do that right when i
installed the software the software did
that
for me so that actually makes this
easier to work with but if for some
reason
i decide that there's an app that i
don't want access to
after all then i can come in here and i
can change that
so we'll do that by going to change
settings and let's look at this one
right here
paint 3d so paint 3d is currently
allowed for both the private and the
public network
now if i want to change which networks
it's allowed on i can just
click that and uncheck or check those
boxes if i want to turn it off entirely
i check the box over here pretty
straightforward
if i don't see the app in here that i
want so let's say i'm having a problem
with a particular application connecting
through my network
i've proven that because i turned off
the firewall and it worked fine turned
the firewall back on it stopped working
okay so that told me where the problem
was so now what i can do
is i can come in and add another app
so i allow my other app i browse to
wherever it is blah blah blah i find my
app i'm already in packet tracer go to
click that just for the fun of it
so i'm going to pack a tracer and then
i'm going to choose network types public
or private network
and then go and cancel that because i
don't need it
that will add that executable to
this particular firewall rules to allow
them
out either public or private networks
so this is the easy way to manage it
this is not the detailed way
this it does it based on application
not on specific port number now if we
want it on specific port number
and i want more detailed settings that's
where i go to
my advanced settings so i'm going to
click my advanced settings
and here is my windows firewall with
advanced security
now over here i've got different types
of rules inbound rules
outbound rules connection security rules
here's my little overview
and specific actions i can take so for
each of these profiles
the windows defender firewall is on
inbound connections
do not match rule are blocked outbound
connections do not match rule are
allowed
now obviously i can change these however
i want as well by going to windows
defender firewall properties
and so then for let me go to my public
profile and from my public profile i can
say
firewall state is on inbound connections
blocked by default
outbound connections i'm going to block
outbound connections
now obviously i don't want to actually
do that but
if i did want to you know completely
block any access
to this uh in or out of this computer
while i'm on that public network that
would be a way to do it this is going to
block my outbound connections
so nothing originating on my computer
going out will work
and then on my inbound connections i can
block default
block all connections or allow all
connections
allow all connections no security block
all connections
at this point i would go into complete
isolation mode
let me go and apply that because i'm not
on this network anyway
and we'll see right here windows
defender firewall is on and we are
blocking
everything so if i ever switch my
network profile to public
it's my firewall goes into complete
lockdown
so let me go to
get my right profile here again to reset
that
okay so those are very very similar to
some of the things we were looking at
when we were looking at the basic setup
view and create firewall rules all right
let's take a look at our inbound and
outbound rules inbound rules impact
traffic coming
in outbound rules impact traffic going
out let's start with inbound rules
here are all of my inbound rules let me
go and maximize this give us a little
more real estate here
so let's take a look at this packet
tracer executable
what profile we're looking at is an
enabled
what action does it take block or allow
what program does it entail
what's the local address what's the
remote address
and then as we scroll over what protocol
what port number what remote
port local and remote port number are
there any authorized users or computers
or
as you can tell these can get fairly
detailed maybe the best way to look at
this
is going to be to go and create a new
rule so i'm going to come over here and
click new
new rule and i can do this based on a
particular program a particular port
number a predefined rule or a custom
rule
let me start with a port number let's
say i want to allow
port 25 for smtp connections
in only be relevant if i'm running a
mail server i'm not but
we're not going to save the rule anyway
so let's click on we're going to do a
port rule and we're going to go next
is this going to be a tcp or udp port as
you can tell
right away in order to do this you need
to know which port numbers you're
working with what protocols you're
working with
so this for a mail server is going to be
tcp port 25
so i'm going to specify port 25 i really
don't want to specify all local ports
that's opening things up way too much
and notice i can set up more than one
port here you see their examples
separated by commas or a dash for a
range
i'm going to do port 25 and then
i have three options here i can allow
the connection allow
only if it's secure so these are ipsec
connections
or i can block the connection now
blocking connections is kind of weird
normally you don't need to block
connections
you just don't allow it if it's not
allowed it's blocked
but sometimes you'll have another rule
somewhere that's allowing something
and this particular type of traffic is
part of what's being allowed
but you really don't want this in that
case you might need to use
a block rule but your better option is
to
only create rules for the data that you
want allowed
and just let everything else be
automatically blocked
so i'm going to allow this because i'm
going to be running a local mail server
and then what profile do these apply to
domain private public
and i'm only going to run this when i'm
on a domain network
and click next and then i'm going to set
the name in the description for the rule
and click finish and that will
create the rule for me i'm going to
cancel that because i don't want to
actually do that
let's open up another rule here so that
we can look at once we get it created
this is going to be all the details for
it so this is a
rule 4 packet tracer so we got the name
of it the description whether it's
enabled
or not what it does it allows the
connection
we can look at the programs and services
that are allowed to use this
and then any remote computers are there
only specific computers that we want
are we going to make exceptions so by
default it's going to allow anything
but i can say you know what only allow
these specific computers
or skip this rule for these specific
computers
so i want packages to work with
everybody except
and then i can specify my specific
exceptions you can also identify
specific
uh protocols and ports so what if i
don't want packet tracer to use
all ports well i could specify specific
ports it would be allowed to use
obviously i'd have to modify the rule
but
um you see here where we can set it
we can set the scope so local ip
addresses remote ip addresses that we're
going to be connecting to
so i can say only allow packet tracer to
connect to specific remote i p
addresses rather than any of them and
then
the profiles the interface types
local principles are the specific users
that are allowed to do this
or not or are there remote users that
are allowed to use this rule or not
so you can see we can actually get very
very precise
in our windows firewall rules
which is great because it gives us
this screen with the windows firewall
with advanced security which gives us
very very detailed by the way
outbound rules work basically the same
way as inbound rules
except that outbound rules filter
traffic because it's leaving your
computer
inbound rules filter traffic is coming
into your computer
so these are probably the inbound rules
are probably going to be your little
more
important ones but one of the nice
things with windows defender firewall
is that it does give you the ability to
be
very very detailed here if you're doing
advanced security
but using your basic options
it still allows you to kind of customize
your network protection
your firewall protection a little bit
without being so overwhelming that
somebody who's not comfortable with
networking and firewalls is going to be
overwhelmed
and not do it