Draft:Firewall Auditing - Beginner

This draft is ready for review. If you're the author, click below to notify a reviewer. A reviewer will check it for structure, sourcing, and accuracy. You may continue editing while you wait.Request reviewApprove draftReject draft

Author(s): brody001301

Last Updated: 07-06-2026

Recommended Prerequisites (click to expand)
None

What is a firewall?

A firewall is a system that monitors and controls incoming and outgoing network traffic based on a set of rules.

Windows ships with a built-in firewall, officially called Windows Defender Firewall with Advanced Security, often referred to as WFAS, or simply "Windows Firewall". Windows Firewall runs as a service in the background and filters traffic before it ever reaches the applications running on the system. See the services section to understand how Windows services run.

Why do we need to audit the firewall?

A firewall is only as strong as its configuration. A firewall with no rules, overly permissive rules, or rules that were added by malware or a careless administrator can leave a system just as exposed as having no firewall at all. Issues commonly found during an audit include:

Rules that allow traffic from any address ("Any" or 0.0.0.0/0) when only a specific IP or subnet should be trusted
Unnecessary inbound rules left enabled for programs or ports that are no longer in use
Rules created by an installed application that are broader than the application actually needs
The firewall being disabled entirely on one or more profiles (see below)
Logging being disabled, meaning there is no record of blocked or allowed connections to investigate later

Just like with services, the goal of a firewall audit isn't to lock everything down blindly. Some inbound and outbound rules are required for the system to function correctly (file sharing, remote management, Windows Update, etc.). The goal is to make sure every rule that exists is necessary, scoped as tightly as possible, and matches what the benchmark or policy for your environment requires.

A great place to start is a STIG or CIS benchmark, which will typically have a section dedicated to firewall configuration and can tell you exactly what should be enabled, disabled, or configured a certain way. A link to at least one benchmark is in the References & Further Reading section below.

How does the firewall work?

Profiles

Windows Firewall uses the concept of profiles to apply different rules depending on the type of network the computer is connected to. There are three profiles:

Domain - Applied automatically when the computer is connected to a network where it can authenticate to a domain controller (i.e. a corporate/managed network)
Private - Applied to networks the user has manually marked as trusted, such as a home or small office network
Public - Applied to untrusted networks, such as coffee shop Wi-Fi or any network not marked as Private

Each profile can have its own independent settings: whether the firewall is on or off, the default action for inbound/outbound traffic, and which rules apply. This allows a laptop to be locked down tightly on Public networks but allow more traffic on its home Private network.

Rules

The firewall's behavior is defined by rules. Each rule can specify things like:

Direction: Inbound traffic coming into the machine, or Outbound traffic leaving the machine
Action: Allow or block a connection
Program: Restrict the rule to a specific executable
Protocol and Ports: e.g. TCP port 443, UDP port 53
Scope: Which local and remote IP addresses the rule applies to
Profile: Which of the three profiles (Domain/Private/Public) the rule applies to

By default, Windows Firewall blocks all unsolicited inbound traffic and allows all outbound traffic, then specific rules can be added on top of that baseline. Many built-in rules already exist for core Windows features such as file and printer sharing, remote desktop, network discovery, etc. Rules like these are typically disabled until the corresponding feature is turned on.

Logging

The firewall can be configured to log dropped packets, successful connections, or both, to a log file. This log is extremely valuable during an audit or an incident investigation, since it provides a record of what the firewall has actually been doing rather than just what it's configured to do. Logging is disabled by default and is one of the first things to check during an audit, since a benchmark will often require it to be turned on for both allowed and dropped connections.

Configuring the firewall

There are multiple ways to view and configure the Windows Firewall. The main ones are outlined below. It is worth setting up a practice image or testing VM so you can get hands-on experience with each method before touching a production system.

Windows Defender Firewall with Advanced Security (wf.msc)

This is the GUI tool for configuring Windows Firewall in detail. To open it, search for "Windows Defender Firewall with Advanced Security" in the Windows search bar, or run wf.msc from the Run dialog or a terminal. From wf.msc you can:

View and edit Inbound Rules and Outbound Rules separately
Create new rules using a guided wizard with options for program, port, predefined feature, or custom
View and edit Connection Security Rules, such as those used for IPsec
Check and change the profile level settings (Domain/Private/Public) by right-clicking the root node and selecting Properties, including whether the firewall is on, the default inbound/outbound action, and logging settings

Double clicking any rule in the list brings up its Properties, letting you inspect or change its program, ports, scope, and profile in detail. This is generally the best tool for a manual, visual audit of exactly what rules exist and how they're scoped.

netsh advfirewall

netsh is a long standing command line tool for network configuration, and its advfirewall context is used specifically for the firewall. netsh is run from cmd.exe or PowerShell. Some useful examples:

netsh advfirewall show allprofiles - shows the state and default settings of all three profiles
netsh advfirewall firewall show rule name=all - lists every configured rule and its properties
netsh advfirewall set allprofiles logging droppedconnections enable - turns on logging of blocked connections for all profiles

A full explanation of every advfirewall option is out of scope for this article, but running netsh advfirewall firewall show rule name=all help, or reading the documentation below, will give you a rundown of available options.

PowerShell (NetSecurity module)

PowerShell has a dedicated set of cmdlets for firewall management, found in the NetSecurity module. These generally follow the pattern *-NetFirewall*. Some of the most useful ones for auditing are:

Get-NetFirewallProfile - shows the settings of each profile, including whether it's enabled and its default inbound/outbound actions
Get-NetFirewallRule - lists all configured rules; can be piped to Get-NetFirewallPortFilter or Get-NetFirewallAddressFilter to see the specific ports or addresses tied to each rule
New-NetFirewallRule / Set-NetFirewallRule - create or modify rules
Get-NetFirewallRule -Enabled True -Direction Inbound - a quick way to filter down to just the active inbound rules, which is often the most important thing to check during an audit

As with any PowerShell cmdlet, you can run Get-Help [command] -Full for detailed usage and examples.

References, Further Reading