Query Windows Firewall

Hello,

Thank you for posting in Q&A forum.

By default, Windows Firewall blocks most inbound connections unless there are rules allowing specific traffic. Outbound traffic is typically allowed unless explicitly blocked by rules.

Default Inbound and Outbound Traffic

1. Inbound Traffic:
   • By default, most inbound traffic is blocked. However, there are some exceptions for essential system services and pre-defined rules, such as allowing remote desktop connections if it is enabled in system settings.
2. Outbound Traffic:
   • Outbound traffic is generally allowed unless there are specific rules configured to block it.

Troubleshooting Blocked Traffic

If Server02 cannot access an application on Server01 after enabling Windows Firewall, you can use the following methods and logs to determine which traffic is being blocked:

1. Windows Firewall Logs:
   • You can enable logging for Windows Firewall to capture dropped packets and successful connections.
   • To enable logging:
     • Open Windows Defender Firewall with Advanced Security.
     • Right-click on Windows Defender Firewall with Advanced Security on Local Computer, then click Properties.
     • Go to the Logging tab.
     • Configure the Log dropped packets and Log successful connections options.
   The default log file location is: C:\Windows\System32\LogFiles\Firewall\pfirewall.log
2. Event Viewer:
   • You can also check the Event Viewer for firewall-related events.
     • Open Event Viewer.
     • Navigate to Applications and Services Logs > Microsoft > Windows > Windows Firewall with Advanced Security > Firewall.

Enabling Windows Firewall with Third-Party Antivirus

It is generally a good approach to enable Windows Firewall alongside a third-party antivirus solution. Here are some points to consider:

1. Compatibility:
   • Make sure that the third-party antivirus solution is compatible with Windows Firewall. Most modern antivirus solutions should be able to coexist with Windows Firewall without issues.
2. Avoid Conflicting Rules:
   • Check the firewall rules and settings in both your antivirus solution and Windows Firewall to ensure that they do not conflict with each other. Sometimes, antivirus solutions come with their own firewall, and you should decide whether to use one or the other, but not both.
3. Security Enhancement:
   • Using both can enhance your security posture, as each may cover different aspects of network security and provide layered defense.

I hope the information above is helpful.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.