Hardening Network Security with Windows Defender Firewall

By default, Windows Defender Firewall is configured in a “Permissive Outbound, Restrictive Inbound” state. While this blocks unauthorized incoming connections, it allows any local executable (including malware or telemetry scripts) to establish outgoing connections to the web unchecked.

To harden a workstation against data exfiltration and lateral malware movement, you must configure strict outbound rules, enable detailed traffic logs, and block unnecessary ports.

---

1. Setting Default Firewall Profiles

Windows divides connections into three Profiles: Domain (corporate networks), Private (home/office LAN), and Public (public hotspots).

To check active states and set default blocks, open PowerShell as Administrator:

# Query current configuration profile states
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

# Force all profiles to block inbound connections by default
Set-NetFirewallProfile -All -DefaultInboundAction Block

# Hardening: block outbound connections by default (for high-security environments)
# Note: Doing this will block all internet access until you create specific allow rules.
# Set-NetFirewallProfile -Profile Public -DefaultOutboundAction Block

---

2. Hardening Common Ports (Lateral Movement Defenses)

Many ransomware campaigns (like WannaCry) spread across local networks by targeting old protocols like SMB, RPC, or NetBIOS. Block these ports on Public profiles to prevent your PC from scanning or being scanned:

Block SMB (Port 445) Outbound

SMB is used for network file sharing. On a public network, you should never send credentials or query local SMB folders:

New-NetFirewallRule -DisplayName "Block Outbound SMB 445" `
    -Direction Outbound `
    -LocalPort 445 `
    -Protocol TCP `
    -Action Block `
    -Profile Public, Private

Block NetBIOS (Ports 137, 138, 139)

New-NetFirewallRule -DisplayName "Block Outbound NetBIOS" `
    -Direction Outbound `
    -LocalPort 137,138,139 `
    -Protocol TCP `
    -Action Block

---

3. Creating Application-Specific Outbound Rules

If you suspect an application of sending background telemetry or sharing sensitive logs, you can block its path entirely:

# Create rule to block a specific application's internet access
New-NetFirewallRule -DisplayName "Block Telemetry App Outbound" `
    -Direction Outbound `
    -Program "C:\Path\To\TelemetryApp.exe" `
    -Action Block

Block PowerShell from accessing the Web

Malware payloads frequently run raw PowerShell scripts that pull code down from external servers. You can block PowerShell from initiating outbound web requests:

New-NetFirewallRule -DisplayName "Restrict PowerShell Web Access" `
    -Direction Outbound `
    -Program "%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" `
    -Protocol TCP `
    -RemotePort 80, 443 `
    -Action Block

---

4. Enabling Dropped Packet Logging

To audit whether your rules are working or to debug connection failures, enable packet drop logging. This will write a text record every time the firewall drops an inbound or outbound connection.

Step 1: Configure log output

Set logging file parameters for the Private and Public profiles:

Set-NetFirewallProfile -Profile Private -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log" -LogBlocked True
Set-NetFirewallProfile -Profile Public -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log" -LogBlocked True

Step 2: Read the log entries

Open the log file using PowerShell to review blocked connections:

# Display the last 20 firewall blocks in real-time
Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log -Tail 20

Inside the log, entries will detail the timestamp, action (DROP), protocol (TCP/UDP), source IP, destination IP, and target ports, allowing you to trace unauthorized background network traffic.