Skip to main content

Feedback on the firewall exercise

Here is the summary of the 6 documents submitted on Omnivox. You did a great job!

What is a firewall?​

A firewall is a hardware or software device that sits between a device (or a network) and the rest of the world to filter traffic according to a set of rules. It allows:

  • blocking unsolicited connections (intrusions, port scans, exploits).
  • controlling which applications or services can initiate connections.
  • automatically adjusting its protection level to the network profile (public, private, domain).

General operation of the Windows firewall​

Stateful inspection​

The Windows firewall is stateful: it tracks the state of each TCP/UDP connection and automatically allows response traffic to an already permitted outgoing connection. A connection is a quadruplet of IP addresses and ports (source and destination). For example, for an outgoing connection with an HTTPS server, the quadruplet could be:

192.168.2.10:50600 → 142.251.41.78:443

where 192.168.2.10 is the computer's IP address, 50600 is an ephemeral port assigned by the operating system, 142.251.41.78 is the IP address of the Google server, and 443 is the server's HTTPS port.

Inbound vs outbound rules​

DirectionRoleDefault strategy
InboundControls what arrives from outside to the computer.Blocked (except expressly allowed exceptions).
OutboundControls what leaves the computer to the network.Allowed (except blocking rules created by the user or administrator).

An inbound rule can, for example, allow port 3389 (RDP) for remote desktop; an outbound rule can block chrome.exe to prevent web browsing.

This default strategy "block all incoming, allow all outgoing" drastically limits the attack surface while maintaining normal Internet use.

Rule configuration: protocols, ports, and applications​

Protocols​

It is possible to filter traffic according to the protocol used. The most common are:

  • TCP: reliable (acknowledgments), used for HTTP(S), SMTP, FTP, RDP…
  • UDP: unreliable but fast, used for DNS, VoIP, online games, streaming…

Port ranges​

Similarly, it is possible to filter traffic according to the port used. Ports are numbered from 0 to 65535 and are classified into three categories:

  • 0-1023: well-known ports (HTTP 80, HTTPS 443, FTP 21, etc.).
  • 1024-49151: registered ports (e.g., MySQL 3306).
  • 49152-65535: dynamic/ephemeral ports automatically assigned by Windows.

Targeting by application​

A rule can target the full path of the executable (e.g., C:\Program Files\VideoLAN\VLC\vlc.exe) rather than a fixed port: safer and more flexible, especially if the application opens multiple ports on demand.

Network profiles and impact​

ProfileTypical contextsLevel of trustBehavior
Public (default)Café Wi-FiLowNetwork discovery and sharing disabled, strict filtering.
PrivateHome networkMediumFile/printer sharing possible, slightly more open rules.
DomainEnterprise, Active DirectoryAdmin-controlledRules pushed by group policy (GPO).

Management interfaces​

  • Graphical interface: Windows Defender Firewall with Advanced Security.

  • PowerShell: NetSecurity module (cmdlets Get-NetFirewallRule, New-NetFirewallRule, etc.) for automation, mass deployment, and scripting.

    # Allow VLC for all profiles
    New-NetFirewallRule -DisplayName "VLC In" -Direction Inbound `
        -Program "C:\Program Files\VideoLAN\VLC\vlc.exe" -Action Allow -Profile Any
    # Block Chrome outbound
    New-NetFirewallRule -DisplayName "Block Chrome Out" -Direction Outbound `
        -Program "C:\Program Files\Google\Chrome\Application\chrome.exe" -Action Block

Allow or block an application​

Graphical method​

Windows Security ▸ Firewall & network protection ▸ Allow an app

PowerShell method​

# Allow (inbound)
New-NetFirewallRule -DisplayName "Allow MyApp" `
  -Direction Inbound -Program "C:\Path\MyApp.exe" -Action Allow
# Block (outbound)
New-NetFirewallRule -DisplayName "Block MyApp" `
  -Direction Outbound -Program "C:\Path\MyApp.exe" -Action Block

Logging and troubleshooting​

  • Enable logs:

    Set-NetFirewallProfile -Profile Domain,Private,Public -LogAllowed True -LogBlocked True

  • Default path of logs: C:\Windows\System32\LogFiles\Firewall\firewall.log

  • In the graphical console: Windows Defender Firewall > Advanced settings > Firewall Properties > Logging. Logs indicate the time, protocol, source/destination address, port, and action (ALLOW/BLOCK), useful for diagnosing connection issues.