Understanding Firewall Rules

Firewall rules are used to filter network traffic between the local computer and the network. To filter traffic means to allow or block traffic based on the filtering conditions specified in the rule. These filtering conditions can include protocol; local or remote port; local or remote IP address scope; user, computer or group; interface type; program or service; and ICMP Type Code. For more information concerning filtering conditions, see the section titled "Filtering Conditions for Firewall Rules" later in this tutorial.

Firewall rules in Windows Firewall with Advanced Security can be classified in various ways:

• Inbound vs. outbound rules Determines the direction of the rule; that is, whether the rule applies to traffic passing from the network to the local computer or vice versa.
• Allow vs. block rules Determines the action the rule takes; that is, whether the traffic specified by the rule will be permitted or not.
• Allow if secure rules Indicates another action that a rule can take; namely, that only traffic protected using IPsec will be permitted.
• Authenticated bypass rules Overrides blocking rules for properly authenticated traffic (an optional subtype of allow if secure rules).

The sections that follow provide more detail concerning these different types of rules. In addition to the above types of rules, any particular firewall rule you create (such as an inbound allow rule) can be configured as follows:

• Program rule This type of rule is used to allow traffic for a specific program (executable file) on the computer.
• Port rule This type of rule is used to allow traffic over a specific TCP or UDP port number or range of port numbers.
• Predefined rule Windows Firewall with Advanced Security includes a number of predefined firewall rules for specific Windows functionality. Examples of predefined rules include File and Printer Sharing and Remote Assistance. Each predefined rule is actually a group of rules that allow the particular Windows experience or feature to access the network in the way needed.
• Custom rule Create this type of rule when the other types of firewall rules don't meet the needs of your environment.

For more information, see the section titled "Creating and Configuring Firewall Rules" later in this tutorial.