Windows Firewall: What It Blocks and How to Set It
Quick answer: The Windows firewall is on by default and it blocks unsolicited inbound connections while allowing nearly all outbound traffic. That default is correct for most home machines. The two things worth checking are which apps have been granted inbound exceptions over the years, and whether your network is marked Private or Public, because that one setting changes how the whole ruleset behaves.
Most firewall guides either tell you to leave it alone or hand you a wall of `netsh` commands. Neither is much use if you want to know what the thing is actually doing. So here is the working engineer's version.
The asymmetry that explains everything
The Windows firewall treats traffic coming in very differently from traffic going out.
Inbound is default-deny. If something on your network tries to open a connection to your machine and no rule permits it, it is dropped. This is the protection that matters on café wifi, and it is why a Windows laptop is not instantly compromised the moment it joins a hostile network.
Outbound is default-allow. If a program on your machine opens a connection to the internet, the firewall permits it unless a rule specifically forbids it. Almost nobody writes those rules.
That asymmetry surprises people, and it is where most firewall disappointment comes from. Users assume the firewall will stop malware phoning home. By default it will not, because the malware is initiating an outbound connection and outbound is allowed. The firewall's job is stopping things from reaching in, not stopping things already inside from reaching out.
If you want the second behaviour, that is a different product category. Real-time antivirus catches the process, and our Defender comparison covers what does and does not come included on Windows.
Network profiles matter more than individual rules
Every network you join gets a profile, and each profile carries its own ruleset.
Public is the strict one. Network discovery is off, file and printer sharing is off, and fewer inbound exceptions apply. This is correct for hotels, airports, cafés and any network with people you do not know on it.
Private relaxes things so that home devices can find each other. Printers, media servers and file shares work.
Domain applies automatically on a corporate network and is controlled by administrators.
The single most common misconfiguration I see on home machines is a laptop that got marked Private on a public network, usually because someone clicked yes to the "make this PC discoverable" prompt while connecting somewhere they should not have.
To check: Settings, Network and internet, click your connection, and look at the Network profile type. Set it to Public for anything you do not control. You lose nothing at a café by doing so, because there is nothing there you want to discover.
The four settings worth reviewing
1. The allowed apps list
Over a few years, this list accumulates. Every game with multiplayer, every media server, every conferencing tool, every installer that asked once. Some of those programs are long uninstalled and their inbound exceptions remain.
Settings, Privacy and security, Windows Security, Firewall and network protection, then Allow an app through firewall.
Read down it. Anything you no longer recognise or no longer use should have its tick removed, and pay particular attention to entries ticked for Public. An app allowed inbound on Public networks is reachable from every stranger on the same café wifi.
2. Whether the firewall is actually on for all three profiles
The same Firewall and network protection page lists Domain, Private and Public separately. It is possible, and surprisingly common after installing and removing a third-party security suite, for one profile to be left off while the others stay on. Check all three read "Firewall is on".
3. Notification settings
Under each profile there is an option to be notified when the firewall blocks a new app. Leave it on. It is the only visibility you get into something trying to listen for inbound connections, and the prompt is how you learn that a program you thought was a simple utility wants to open a port.
4. Outbound rules, if you have a specific reason
You can create outbound blocks. Windows Defender Firewall with Advanced Security, reachable by searching `wf.msc`, gives you the full rule engine.
I would not recommend a general outbound-blocking project for a home machine. Done properly it means auditing every legitimate program's network needs, and done sloppily it produces a machine where things break mysteriously for months. The realistic home use case is narrow: blocking one specific application you want installed but offline, such as a piece of software with aggressive telemetry or a game you want kept off the network.
What the firewall does not do
Being clear about the limits is more useful than overselling it.
It does not inspect the contents of allowed traffic. An HTTPS connection your browser makes is permitted and unexamined.
It does not stop phishing. If you type your password into a convincing fake, no firewall rule is relevant, and the recovery steps in our leaked password response plan become the thing that matters instead.
It does not protect other devices on your network. Your router's firewall does that at the perimeter, and the Windows firewall protects this machine specifically, which is exactly why it still matters when the attacker is already inside the network, on a compromised smart device for example.
It does not replace an antivirus, and an antivirus does not replace it. They address different stages: one governs who may connect, the other governs what may run.
Should you use a third-party firewall?
For most people, no.
The Windows firewall has been solid since Windows 10 and its rule engine is genuinely capable. Most third-party firewalls sold to consumers add an outbound-prompting layer, which sounds appealing and in practice trains users to click Allow reflexively within a fortnight.
The honest exception is a security suite you are buying anyway for other reasons, where the firewall is bundled rather than the point. If you are weighing whether a suite earns its cost at all, the comparison guide walks through where paid protection adds something real, and where it is repackaging what Windows already gives you.
A sane home configuration
Firewall on for all three profiles. Every untrusted network marked Public. Notifications on. The allowed apps list reviewed once a year, with anything unrecognised unticked and Public exceptions treated as guilty until proven necessary. No outbound project unless you have a specific application in mind.
That configuration takes ten minutes, needs no software purchase, and puts you ahead of most home machines.
Frequently Asked Questions
Is the Windows firewall good enough on its own?
For inbound protection on a home machine, yes. It is a mature default-deny inbound firewall and it does that job properly. Where people feel it is insufficient is outbound filtering, which it can do but does not do by default. If your concern is a program on the machine sending data out, the effective control is antivirus and application vetting rather than a firewall rule.
Should my home wifi be Private or Public?
Private, if it is genuinely your own network and you want printers and file sharing to work. Public everywhere else, including any network belonging to a landlord, a hotel, a workplace you do not administer, or a shared house where you do not know every device. When in doubt, Public costs you very little.
Why does a game or app not work after I enabled the firewall?
It most likely needs an inbound exception, typical for game hosting, media servers and some conferencing tools. Add it through Allow an app through firewall rather than switching the firewall off, and tick only the profile you need, usually Private.
Does a VPN replace the firewall?
No. A VPN encrypts and reroutes your traffic; it does not decide which inbound connections are permitted. The two are complementary, and on a hostile network you want both. A VPN protects the confidentiality of what you send, the firewall protects the machine from what is sent at it.
Can malware turn the firewall off?
It can try, which is why Windows ties firewall and antivirus tampering into the same protection model and why administrator elevation is required to change these settings. If you find the firewall switched off and you did not do it, treat the machine as compromised and scan it properly rather than simply switching it back on.