World Library  
Flag as Inappropriate
Email this Article

Windows Firewall

Windows Firewall
A component of Microsoft Windows
Windows Firewall in Windows 10
Other names Internet Connection Firewall
Type Firewall software
Included with Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 8
Windows 10
Service name SharedAccess
Description Security Center
Related components
Windows Security Center

Windows Firewall is a software component of Microsoft Windows that provides firewalling and packet filtering functions. It was first included in Windows XP and Windows Server 2003. Prior to the release of Windows XP Service Pack 2 in 2004, it was known as Internet Connection Firewall.


  • Overview 1
  • Versions 2
    • Windows Neptune 2.1
    • Windows XP 2.2
    • Windows Vista 2.3
    • Windows Server 2008 and Windows 7 2.4
  • See also 3
  • References 4
  • Notes 5
  • External links 6


When Windows XP was originally shipped in October 2001, it included a limited firewall called "Internet Connection Firewall". It was disabled by default due to concerns with backward compatibility, and the configuration screens were buried away in network configuration screens that many users never looked at. As a result, it was rarely used. In mid-2003, the Blaster worm attacked a large number of Windows machines, taking advantage of flaws in the RPC Windows service. Several months later, the Sasser worm did something similar. The ongoing prevalence of these worms through 2004 resulted in unpatched machines being infected within a matter of minutes.[1] Because of these incidents, as well as other criticisms that Microsoft was not being active in protecting customers from threats, Microsoft decided to significantly improve both the functionality and the interface of Windows XP's built-in firewall, rebrand it as Windows Firewall,[2] and switched it on by default since Windows XP SP2.

One of three profiles is activated automatically for each network interface:[3]

  • Public assumes that the network is shared with the World and is the most restrictive profile.
  • Private assumes that the network is isolated from the Internet and allows more inbound connections than public. A network is never assumed to be private unless designated as such by a local administrator.
  • Domain profile is the least restrictive. It allows more inbound connections to allow for file sharing etc. The domain profile is selected automatically when connected to a network with a domain trusted by the local computer.

Security log capabilities are included, which can record IP addresses and other data relating to connections originating from the home or office network or the Internet. It can record both dropped packets and successful connections. This can be used, for instance, to track every time a computer on the network connects to a website. This security log is not enabled by default; the administrator must enable it.[4]

Windows Firewall can be controlled/configured through a COM object-oriented API, scriptable through the netsh command,[5] through the GUI administration tool[6] or centrally through group policies.[7] All features are available regardless of how it is configured.


Windows Neptune

In the unreleased Windows Neptune, the firewall was introduced. It is similar to the one found in Windows XP.

Windows XP

Windows Firewall settings in Windows XP Service Pack 2

Windows Firewall was first introduced as part of Windows XP Service Pack 2. Every type of network connection, whether it is wired, wireless, VPN, or even FireWire, has the firewall enabled by default, with some built-in exceptions to allow connections from machines on the local network. It also fixed a problem whereby the firewall policies would not be enabled on a network connection until several seconds after the connection itself was created, thereby creating a window of vulnerability.[8] A number of additions were made to Group Policy, so that Windows system administrators could configure the Windows Firewall product on a company-wide level. XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.

Windows Firewall turned out to be one of the two most significant reasons (the other being DCOM activation security)[9] that many corporations did not upgrade to Service Pack 2 in a timely fashion. Around the time of SP2's release, a number of Internet sites were reporting significant application compatibility issues, though the majority of those ended up being nothing more than ports that needed to be opened on the firewall so that components of distributed systems (typically backup and antivirus solutions) could communicate.

The firewall does not filter IPv6 traffic.[10]

Note that the DCOM problem can be solved by moving applications to DComLab's ComBridge protocol.

Windows Vista

Windows Vista improved the firewall to address a number of concerns around the flexibility of Windows Firewall in a corporate environment:[11]

  • The firewall is based on the Windows Filtering Platform.
  • A new management console snap-in named Windows Firewall with Advanced Security which provides access to many advanced options, and enables remote administration. This can be accessed via Start -> Control Panel -> Administrative Tools -> Windows Firewall with Advanced Security, or by running "wf.msc"
  • Outbound packet filtering, reflecting increasing concerns about spyware and viruses that attempt to "phone home". Outbound rules are configured using the management console. Notifications are not shown however for outbound connections.
  • With the advanced packet filter, rules can also be specified for source and destination IP addresses and port ranges.
  • Rules can be configured for services by its service name chosen by a list, without needing to specify the full path file name.
  • IPsec is fully integrated, allowing connections to be allowed or denied based on security certificates, Kerberos authentication, etc. Encryption can also be required for any kind of connection.
  • Improved interface for managing separate firewall profiles. Ability to have three separate firewall profiles for when computers are domain-joined, connected to a private network, or connected to a public network (XP SP2 supports two profiles—domain-joined and standard). Support for the creation of rules for enforcing server and domain isolation policies.

Windows Server 2008 and Windows 7

Windows Server 2008 contains the same firewall as Windows Vista. The firewall in Windows Server 2008 R2 and Windows 7 contains some improvements, such as multiple active profiles.[12]

See also


  1. ^ Study: Unpatched PCs compromised in 20 minutes | CNET
  2. ^ "Troubleshooting Windows Firewall settings in Windows XP Service Pack 2 for advanced users". 
  3. ^ "Network Location Awareness". Microsoft TechNet. 
  4. ^ "Internet Connection Firewall security log". 
  5. ^ "Netsh Command Syntax for the Netsh Firewall Context". Microsoft. 
  6. ^ "User Interface: Windows Firewall with Advanced Security". Microsoft. 
  7. ^ "Deploying Windows Firewall Settings With Group Policy". Microsoft. 
  8. ^ The Cable Guy - February 2004
  9. ^ Security-Related Policy Settings
  10. ^ [4]
  11. ^ The Cable Guy - January 2006
  12. ^ What's New in Windows Firewall with Advanced Security


  1. ^ These multiple vulnerabilities were fixed by Microsoft over the course of several months; Microsoft security bulletins MS03-026, MS03-039, and MS04-012 cover this in more detail.

External links

  • Windows Firewall on Microsoft TechNet
  • Understanding Windows Firewall for Windows XP
  • Customizing Windows Firewall
  • Adding Windows Firewall Exceptions
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.

Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.