> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/windows-firewall-basics.md).

# Windows Defender Firewall Basics

## Objective

Learn how Windows Defender Firewall is organized and how to review its basic status without unnecessarily disabling security controls.

## Lab System

Use `CLIENT01`.

## Steps

### 1. Open Windows Defender Firewall

Open **Windows Security** and select:

```
Firewall & network protection
```

Review the available network profiles:

* Domain network
* Private network
* Public network

Because `CLIENT01` is joined to the ZyberLab domain, the Domain profile may be active while connected to the lab network.

### 2. Open Advanced Firewall Management

Search for:

```
Windows Defender Firewall with Advanced Security
```

Review the main areas:

* Inbound Rules
* Outbound Rules
* Connection Security Rules
* Monitoring

### 3. Review an Existing Rule

Open **Inbound Rules** and select an existing Microsoft or Windows rule.

Review:

* whether the rule is enabled
* action: Allow or Block
* protocol
* local port
* remote port
* profile
* program or service, where applicable

Do not change the rule during this first exercise.

### 4. Review Firewall Profile Status

In the main firewall console, verify that the firewall is enabled for the profiles used by the system.

## What Happened?

Windows Defender Firewall applies rules to network traffic based on direction, protocol, port, application, service, address, and active network profile.

## Security Relevance

Host-based firewalls reduce unnecessary network exposure. Disabling a firewall to make a test work can hide the real cause of a connectivity problem and weaken the host.

When a lab connection fails, first ask:

* Is the service actually running?
* Is the correct port being used?
* Is the firewall rule enabled?
* Does the rule apply to the active profile?
* Is the traffic inbound or outbound?

## Key Takeaways

* Windows uses different firewall profiles for different network contexts.
* Inbound and outbound rules control traffic differently.
* A firewall should not be disabled simply to troubleshoot connectivity.
* Review and understand the relevant rule before changing it.