How to Configure Microsoft Defender Firewall in Windows 10 and 11

Microsoft Defender Firewall blocks uninvited traffic automatically, but the moment an app stops connecting, or you want to stop one from phoning home, you’ll need to adjust things manually. Inbound connections are blocked by default; outbound connections are open unless you write a rule to close them.

Open Microsoft Defender Firewall

The fastest path in is through the Windows Security app. These steps work identically on Windows 10 and Windows 11.

1. Click Start, type Windows Security, and press Enter.
2. Select Firewall & network protection.

You’ll see three network profiles: Domain (corporate Active Directory environments), Private (home or trusted office networks), and Public (hotel Wi-Fi, airports, any network you wouldn’t trust). Each profile has its own firewall settings, so you can be strict on public networks without touching your home setup.

If your home network shows up as Public when it should be Private, change it to Private before adjusting any firewall rules, the two profiles are treated very differently.

Allow an App Through the Firewall

If an app can’t connect and you suspect the firewall is blocking it, start here.

1. In Firewall & network protection, click Allow an app through firewall.
2. Click Change settings (admin rights required).
3. Find the app in the list and check Private, Public, or both, depending on which networks you need it active on.
4. If the app isn’t listed, click Add an app and browse to the executable.
5. Click OK.

The confusing part: this screen controls inbound connections only. Allowing an app on Private doesn’t automatically allow it on Public, those checkboxes are independent. That matters if you switch between a home wireless router and a café network. To restrict what an app sends out, you need the advanced settings below.

Turn the Firewall On or Off

You can disable the firewall per profile, but there’s a more useful option tucked underneath the toggle.

1. In Firewall & network protection, click the active network profile, for example, Public network.
2. Under Microsoft Defender Firewall, flip the toggle on or off.
3. To lock down all inbound traffic without disabling the firewall entirely, check Blocks all incoming connections, including those in the list of allowed apps.

That “blocks all incoming” option is genuinely useful. Flip it on at a hotel or airport lounge when you don’t trust the local network. Your browser still loads pages because it initiates the connection outbound, but nothing can reach your machine from the local network. What stops working: file sharing, Remote Desktop, and any service waiting for an inbound connection.

Keep the firewall on even if you run a third-party security suite. Most AV products layer on top of Microsoft Defender Firewall rather than replacing it.

Advanced Settings: Create Custom Firewall Rules

For per-port blocking, per-app outbound control, or IP-range filtering, you need Windows Defender Firewall with Advanced Security.

1. Press Start, type wf.msc, and press Enter.

The left pane has Inbound Rules and Outbound Rules. The center panel shows firewall state across all three profiles at once.

Create an inbound rule

Inbound rules control what’s allowed into your machine, useful for game servers, local development tools, or any service that accepts connections.

1. Click Inbound Rules in the left pane.
2. In the right Actions panel, click New Rule….
3. Choose the rule type:

– Program, block or allow a specific .exe file. – Port, allow or block traffic on a specific TCP or UDP port. – Predefined, use a Windows template like File and Printer Sharing. – Custom, combine program, port, protocol, and IP address filters.

4. Click Next and specify the program path or port number.
5. Choose Allow the connection, Allow if secure, or Block the connection. Click Next.
6. Select the profiles this rule applies to: Domain, Private, Public, or any combination.
7. Name the rule clearly and click Finish.

Create an outbound rule

By default, every app on your machine can reach the internet freely. Outbound rules are how you change that, and this is where the firewall gets genuinely useful if you want real control over what programs can send out.

Here’s a working example: blocking all outbound traffic on port 80, the plain HTTP port, so no browser on the machine can load unencrypted pages.

1. Click Outbound Rules in the left pane.
2. Click New Rule… in the right Actions panel.
3. Select Port and click Next.
4. Select TCP, type 80 in the Specific remote ports field, and click Next.

5. Select Block the connection and click Next.

6. Check all three profiles, Domain, Private, Public, and click Next.

7. Name the rule something like “Block HTTP outbound” and click Finish.

Open Chrome or Edge and load a page using http:// you’ll get a connection error because port 80 is now closed outbound.

Delete the rule when you’re done testing. To block a single app instead of an entire port, choose Program at step 3 and browse to the .exe. That’s the cleaner approach for stopping a VPN service client, a game launcher, or any individual app from reaching the internet without affecting everything else.

Reset the Firewall to Defaults

If a rule you created broke something, apps won’t connect, network shares disappeared, a full reset removes every custom rule and restores Microsoft’s defaults.

1. Click Start, type Windows Defender Firewall, and press Enter.
2. In the left-hand pane, click Restore defaults.
3. Click Restore defaults in the confirmation dialog.

This wipes all custom inbound and outbound rules. Apps that needed manual allowances won’t work again until you re-add them, try removing individual rules first before going the full reset route.

Conclusion

Allowing an app through the basic interface solves the most common problems. If you’ve finally got outbound rules running in wf.msc, that’s the harder skill, and worth the time on any PC you want to lock down properly. A firewall that keeps misbehaving after a reset, or rules that seem to vanish on their own, can point to malware; a full system scan is the right next step.