How to enable and configure Windows Firewall rules for safer remote working

Summary

This guide helps you troubleshoot and resolve: How to enable and configure Windows Firewall rules for safer remote working. Follow the steps below to fix the issue.

Common Causes

When you're working from home, at a café, or on the road, your laptop is exposed to networks you don't fully control. Windows Firewall is a built-in security feature that monitors incoming and outgoing traffic and blocks anything suspicious. This guide walks you through checking that it's enabled, understanding the default rules, and creating custom rules for the apps and ports your work relies on.

If you only need to perform a quick check, jump to the Quick Fix Steps below. For a deeper walkthrough, see the Detailed Instructions section.

Quick Fix Steps

1. Open the Start menu and type wf.msc, then press Enter.
2. In the left pane, click Windows Defender Firewall Properties.
3. For each profile tab (Domain, Private, Public), set Firewall state to On.
4. Set Inbound connections to Block and Outbound connections to Allow for the Public profile at minimum.
5. Click Apply, then OK.
6. Close the console and restart your computer.

Detailed Instructions

Check whether Windows Firewall is enabled

1. Press Win + R, type wf.msc, and press Enter.
2. Look at the left pane. You should see Windows Defender Firewall with Advanced Security.
3. The middle pane shows the current state for each profile: Domain, Private, and Public.
4. If any profile shows Off, follow the steps below to switch it on.

Enable Windows Firewall for all profiles

1. In the same wf.msc console, click Windows Defender Firewall Properties in the left pane.
2. You'll see three tabs at the top: Domain Profile, Private Profile, and Public Profile.
3. For each tab:
   • Set Firewall state to On (recommended).
   • Set Inbound connections to Block (default).
   • Set Outbound connections to Allow (default) unless your organisation requires stricter controls.
4. Click Apply after each tab, then OK when finished.

Understand the three network profiles

Windows applies firewall rules based on the type of network you're connected to:

• Domain — Applied when your laptop is joined to a corporate domain and connected over a trusted network.
• Private — Applied when you designate a home or office network as trusted (for example, your home Wi-Fi).
• Public — Applied automatically to any network you don't mark as trusted, such as café Wi-Fi, hotel networks, or airport hotspots. This is the strictest profile and the most important one for remote workers.

Review existing inbound rules

1. In the left pane of wf.msc, click Inbound Rules.
2. You'll see a long list of rules with columns for Name, Group, Profile, Action, and Enabled.
3. Scroll through and look for any rules you don't recognise, especially those marked Enabled with Allow as the action.
4. To disable a suspicious rule, right-click it and choose Disable Rule. Don't delete rules unless you're certain they're not required.

Create a custom inbound rule for a business application

If your team uses an application that needs to accept incoming connections (for example, a remote desktop tool, database server, or collaboration platform), you may need to create a specific rule.

1. In wf.msc, right-click Inbound Rules in the left pane and choose New Rule.
2. Choose the rule type:
   • Program — To allow a specific application. Browse to the executable file (usually a .exe).
   • Port — To allow traffic on a specific TCP or UDP port.
   • Predefined — To pick from a list of common Windows components.
   • Custom — For advanced combinations of program, protocol, port, and scope.
3. Follow the wizard prompts. For a port-based rule, you'll typically:
   • Select TCP or UDP.
   • Enter the specific port number (for example, 3389 for Remote Desktop).
   • Choose Allow the connection.
   • Tick the profiles that should apply (Domain, Private, and/or Public).
   • Give the rule a clear name such as RDP - Work Laptop Only.
4. Click Finish.

Restrict a rule to specific remote IP addresses

For an extra layer of protection, you can limit an inbound rule so it only accepts traffic from known IP addresses (such as your office network).

1. Open the rule you just created by double-clicking it in the Inbound Rules list.
2. Go to the Scope tab.
3. Under Remote IP address, select These IP addresses and click Add.
4. Enter the IP address or range you want to allow (for example, 203.0.113.0/24).
5. Click OK, then Apply.

Export and back up your firewall rules

Before making significant changes, it's worth exporting your current configuration so you can restore it if something goes wrong.

1. In wf.msc, right-click Windows Defender Firewall with Advanced Security at the top of the left pane.
2. Choose Export Policy.
3. Save the .wfw file to a secure location such as your OneDrive or an encrypted USB drive.
4. To restore, right-click the same node and choose Import Policy.

Reset Windows Firewall to default settings

If you've made changes that have broken connectivity and you can't pinpoint the cause, resetting to defaults is often the fastest path back to a known-good state.

1. Press Win + R, type wf.msc, and press Enter.
2. In the right pane, click Restore Defaults.
3. Confirm any prompts that appear.
4. Close the console and restart your computer.

Still Having Issues?