Configuring Windows Defender Firewall

another tool that we'll use

for managing our windows 10 security

is going to be the windows firewall now

just like windows defender we don't want

this to be the only thing we're using

we do want to use a windows firewall but

we want other firewalls and other places

on our network to provide overall

network protection as well

so this is not a

solution to every firewalling issue

but it is a good useful tool to have

and you don't if at all possible we

don't want to turn it off

because we want that protection in case

something gets through

our network-based firewall so let's look

at how we can manage it so i'm here

under settings

and update and security and then windows

security

and here is my firewall and network

protection

so i'm going to click on that and i'm

going to have

a simple way to deal with a firewall and

then we call it windows firewall with

advanced security for more detailed

information

so here is our firewall and network

protection you see we have different

domain pro or different network profiles

the domain network the private network

and the public network

and then this right here tells me that

i'm currently on the private network

profile

and currently the firewall is on now let

me go ahead and click on that

and i've got a couple of options here so

i can turn off my firewall now i don't

recommend doing this as a long-term

solution

but if you need to turn off the firewall

while you're troubleshooting an issue

that actually can be useful

something's not working i'm trying i'm

having a network connectivity issue let

me turn off my firewall

see if that fixes the problem now if

that does i don't want to leave my

firewall

off but now i know there's a firewall

setting that i'm going to need to adjust

so i'm going to try to find that

firewall setting so that i can

bring my firewall back up but allow that

particular application through the

firewall

so this turns it off

and then back on and it's now paranoid

because i turned his firewall off

i'm going to turn his firewall back on

that'll make it happy again

okay now so this is this

on or off all or nothing thing the other

all or nothing thing is this one right

here

so a firewall will control data coming

into your computer and data going

out from your computer and by default

windows firewall is going to allow

some things going out block most things

coming in unless they're specifically

allowed

what this does is this blocks all

incoming connections

and again this is going to be a

temporary thing this is not permanent

right

so i'm down at starbucks

i'm probably going to be on a public

network not a private network but i'm

down at starbucks

and for some reason i i just think you

know what i'm on the

network i'm on the network i'm surfing

the internet uh i'm working on a

document

but i really don't want

any access to my computer across this

network

so i can come in here and say just block

all incoming connections

including those who would otherwise be

allowed and that's just gonna you know

slam the door shut

so when we turn off windows defender you

know

get rid of all the locks on the doors

throw open the windows knock down the

walls just let anybody come in

this is the exact opposite go complete

lockdown

okay those are our two all or nothing

options and we can do that for

any one of these three profiles so i can

send my public network i want to block

all incoming connections while still

leaving incoming connections allowed on

a private network that i trust

a little bit better all right now

those are all or nothing most of the

time we don't want all or nothing

most of the time we're going to want

specific things and that's

here allow an app through the firewall

so let me bring this up and this is

going to show

a bunch of apps that are already allowed

through my firewall

and so you'll see the list of apps here

and a bunch of these are going to be

microsoft

apps but there are some of them that are

not going to be microsoft apps

like i have packet tracer installed on

my system

and so packet tracer created a rule for

the firewall

and it said hey go ahead and allow this

and i didn't do that right when i

installed the software the software did

that

for me so that actually makes this

easier to work with but if for some

reason

i decide that there's an app that i

don't want access to

after all then i can come in here and i

can change that

so we'll do that by going to change

settings and let's look at this one

right here

paint 3d so paint 3d is currently

allowed for both the private and the

public network

now if i want to change which networks

it's allowed on i can just

click that and uncheck or check those

boxes if i want to turn it off entirely

i check the box over here pretty

straightforward

if i don't see the app in here that i

want so let's say i'm having a problem

with a particular application connecting

through my network

i've proven that because i turned off

the firewall and it worked fine turned

the firewall back on it stopped working

okay so that told me where the problem

was so now what i can do

is i can come in and add another app

so i allow my other app i browse to

wherever it is blah blah blah i find my

app i'm already in packet tracer go to

click that just for the fun of it

so i'm going to pack a tracer and then

i'm going to choose network types public

or private network

and then go and cancel that because i

don't need it

that will add that executable to

this particular firewall rules to allow

them

out either public or private networks

so this is the easy way to manage it

this is not the detailed way

this it does it based on application

not on specific port number now if we

want it on specific port number

and i want more detailed settings that's

where i go to

my advanced settings so i'm going to

click my advanced settings

and here is my windows firewall with

advanced security

now over here i've got different types

of rules inbound rules

outbound rules connection security rules

here's my little overview

and specific actions i can take so for

each of these profiles

the windows defender firewall is on

inbound connections

do not match rule are blocked outbound

connections do not match rule are

allowed

now obviously i can change these however

i want as well by going to windows

defender firewall properties

and so then for let me go to my public

profile and from my public profile i can

say

firewall state is on inbound connections

blocked by default

outbound connections i'm going to block

outbound connections

now obviously i don't want to actually

do that but

if i did want to you know completely

block any access

to this uh in or out of this computer

while i'm on that public network that

would be a way to do it this is going to

block my outbound connections

so nothing originating on my computer

going out will work

and then on my inbound connections i can

block default

block all connections or allow all

connections

allow all connections no security block

all connections

at this point i would go into complete

isolation mode

let me go and apply that because i'm not

on this network anyway

and we'll see right here windows

defender firewall is on and we are

blocking

everything so if i ever switch my

network profile to public

it's my firewall goes into complete

lockdown

so let me go to

get my right profile here again to reset

that

okay so those are very very similar to

some of the things we were looking at

when we were looking at the basic setup

view and create firewall rules all right

let's take a look at our inbound and

outbound rules inbound rules impact

traffic coming

in outbound rules impact traffic going

out let's start with inbound rules

here are all of my inbound rules let me

go and maximize this give us a little

more real estate here

so let's take a look at this packet

tracer executable

what profile we're looking at is an

enabled

what action does it take block or allow

what program does it entail

what's the local address what's the

remote address

and then as we scroll over what protocol

what port number what remote

port local and remote port number are

there any authorized users or computers

or

as you can tell these can get fairly

detailed maybe the best way to look at

this

is going to be to go and create a new

rule so i'm going to come over here and

click new

new rule and i can do this based on a

particular program a particular port

number a predefined rule or a custom

rule

let me start with a port number let's

say i want to allow

port 25 for smtp connections

in only be relevant if i'm running a

mail server i'm not but

we're not going to save the rule anyway

so let's click on we're going to do a

port rule and we're going to go next

is this going to be a tcp or udp port as

you can tell

right away in order to do this you need

to know which port numbers you're

working with what protocols you're

working with

so this for a mail server is going to be

tcp port 25

so i'm going to specify port 25 i really

don't want to specify all local ports

that's opening things up way too much

and notice i can set up more than one

port here you see their examples

separated by commas or a dash for a

range

i'm going to do port 25 and then

i have three options here i can allow

the connection allow

only if it's secure so these are ipsec

connections

or i can block the connection now

blocking connections is kind of weird

normally you don't need to block

connections

you just don't allow it if it's not

allowed it's blocked

but sometimes you'll have another rule

somewhere that's allowing something

and this particular type of traffic is

part of what's being allowed

but you really don't want this in that

case you might need to use

a block rule but your better option is

to

only create rules for the data that you

want allowed

and just let everything else be

automatically blocked

so i'm going to allow this because i'm

going to be running a local mail server

and then what profile do these apply to

domain private public

and i'm only going to run this when i'm

on a domain network

and click next and then i'm going to set

the name in the description for the rule

and click finish and that will

create the rule for me i'm going to

cancel that because i don't want to

actually do that

let's open up another rule here so that

we can look at once we get it created

this is going to be all the details for

it so this is a

rule 4 packet tracer so we got the name

of it the description whether it's

enabled

or not what it does it allows the

connection

we can look at the programs and services

that are allowed to use this

and then any remote computers are there

only specific computers that we want

are we going to make exceptions so by

default it's going to allow anything

but i can say you know what only allow

these specific computers

or skip this rule for these specific

computers

so i want packages to work with

everybody except

and then i can specify my specific

exceptions you can also identify

specific

uh protocols and ports so what if i

don't want packet tracer to use

all ports well i could specify specific

ports it would be allowed to use

obviously i'd have to modify the rule

but

um you see here where we can set it

we can set the scope so local ip

addresses remote ip addresses that we're

going to be connecting to

so i can say only allow packet tracer to

connect to specific remote i p

addresses rather than any of them and

then

the profiles the interface types

local principles are the specific users

that are allowed to do this

or not or are there remote users that

are allowed to use this rule or not

so you can see we can actually get very

very precise

in our windows firewall rules

which is great because it gives us

this screen with the windows firewall

with advanced security which gives us

very very detailed by the way

outbound rules work basically the same

way as inbound rules

except that outbound rules filter

traffic because it's leaving your

computer

inbound rules filter traffic is coming

into your computer

so these are probably the inbound rules

are probably going to be your little

more

important ones but one of the nice

things with windows defender firewall

is that it does give you the ability to

be

very very detailed here if you're doing

advanced security

but using your basic options

it still allows you to kind of customize

your network protection

your firewall protection a little bit

without being so overwhelming that

somebody who's not comfortable with

networking and firewalls is going to be

overwhelmed

and not do it