Understanding Rules Processing

If more than one rule matches a particular packet being examined, Windows Firewall with Advanced Security must decide which of these rules to apply to the packet so as to decide what action to take. The order in which Windows Firewall with Advanced Security processes rules is as follows:

1. WSH rules (this is not configurable by the user)
2. Connection security rules
3. Authenticated bypass rules
4. Block rules
5. Allow rules
6. Default rules

When a packet is being examined by Windows Firewall with Advanced Security, the packet is compared to each of these types of rules in the order they are listed. If the packet matches a particular rule, that rule is applied, and rule processing stops. In addition, if two rules in the same group match, then the rule that is more specific (that is, has more matching criteria) is the one that is applied. For example, if rule A matches traffic to 192.168.0.1 and rule B matches traffic to 192.168.0.1 TCP port 80, then traffic to port 80 on that server matches rule B, and its action is the one taken.

By default, the rule processing described previously includes both local rules (firewall and/ or connection security rules configured by the local administrator of the computer) and rules applied to the computer by Group Policy. If more than one Group Policy object (GPO) applies to a particular computer, the default rules come from the GPO with the highest precedence. Merging of local rules can be enabled or disabled using Group Policy. For more information, see the section titled "Considerations When Managing Windows Firewall Using Group Policy" later in this tutorial.