Firewall Settings: Windows and macOS Guide

A firewall is the network access control layer that determines which connections your computer accepts and which it rejects. Without a properly configured firewall, every port on the machine is potentially accessible to any device on the same network — and if the machine has internet-facing ports, to the entire internet. If you want the full context, see our Complete Guide to Online Security and Privacy.

Most users never touch their firewall settings beyond checking that the firewall is on — and for many home users, the defaults are adequate. But this guide is most useful in the scenarios where defaults fail: connecting to a public network where the firewall should be maximally restrictive, running a service that legitimately needs an open port, or investigating why an application can’t make an expected connection.

Understanding the basics — three concepts to know first

Inbound vs outbound traffic: inbound is connection attempts arriving at your computer from other devices (remote desktop requests, server requests, pings from other network devices). Outbound is connections your computer initiates (web browsing, cloud sync, updates). Most consumer firewalls default to allowing all outbound and restricting inbound — which is the correct default. Inbound rules are the primary security surface.

Network profiles (Windows) are contextual rule sets that apply based on the network type. Windows Defender Firewall has three: Domain (corporate domain-joined networks, managed by IT policy), Private (trusted home or office networks), and Public (untrusted networks — coffee shops, airports). The Public profile applies the most restrictive rules. Misclassifying a public network as Private — which sometimes happens when accepting incorrect prompts — reduces the firewall’s protection on that session.

Router NAT vs device firewall: most home routers include a built-in NAT (Network Address Translation) firewall that prevents unsolicited inbound connections from the internet reaching any device on the local network. This means on a home network, the primary threat isn’t internet-originated connections (the router blocks those) but lateral movement from other compromised devices on the same local network. The device firewall is most critical on public networks where the router NAT is absent.

Windows Defender Firewall — step-by-step configuration

1. Verify all three profiles are active. Windows Security → Firewall & network protection. Confirm Domain networks, Private networks, and Public networks all show “Firewall is on.” Any profile showing “Firewall is off” is a security gap that needs immediate correction.
2. Block all inbound connections on the Public profile. Windows Defender Firewall with Advanced Security (search in Start) → Windows Defender Firewall Properties → Public Profile tab → Inbound connections → Block (with override checked for allowed programs). This is the most important setting for laptop users who regularly connect to public WiFi — it blocks all unsolicited inbound traffic while still allowing responses to outbound connections the computer initiated.
3. Enable stealth mode for the Public profile. In the same Public Profile settings → Settings → Customize → “Unicast response to multicast or broadcast” → No. Stealth mode prevents the computer from responding to probe packets, reducing its visibility to network scanners.
4. Audit the inbound allow list. Windows Defender Firewall with Advanced Security → Inbound Rules → filter by “Enabled=Yes” and “Action=Allow.” Review every rule that permits inbound traffic, particularly those that allow “All programs” or “Any” remote IP. Rules you don’t recognise or can’t attribute to a specific application warrant investigation — malware occasionally creates firewall exceptions during installation. This step is the most frequently skipped but the most revealing.
5. Create specific application rules for services that legitimately need inbound access. Inbound Rules → New Rule → Program → browse to the application executable → Allow the connection → select appropriate profiles (Private only for a home server, not Public) → name the rule clearly. More secure than allowing all inbound traffic to a port number, because it restricts the exception to the specific application.
6. Set default inbound action to Block for all profiles. Windows Defender Firewall Properties → for each profile tab → Inbound connections → Block. Block-by-default means every inbound connection is blocked unless there is an explicit allow rule — the most secure configuration.

Step 4 — auditing the allow list — is the most frequently skipped step because it requires active effort rather than just toggling a setting. On a machine in service for years, the inbound allow list may contain rules for uninstalled applications, rules broader than necessary (allowing from any IP), and in some cases rules created by software without the user’s awareness. The quarterly audit prevents rule-list bloat that gradually erodes the firewall’s protection.

macOS firewall configuration

macOS’s Application Firewall controls connections per application rather than per port. Simpler to configure and understand in everyday use, though less granular than Windows Advanced mode.

Enable and configure: System Settings → Network → Firewall → turn on. Click Options to access configuration:

• “Block all incoming connections”: the most restrictive setting — blocks all inbound regardless of application, while allowing outbound and their responses. Appropriate for public or untrusted networks.
• “Enable stealth mode”: prevents the Mac from responding to probe requests from unexpected callers. Enable this. Works the same way as Windows stealth mode — reduces visibility on shared networks.
• Per-application exceptions: the Options panel shows every application with a firewall exception. Review the list and remove any application that shouldn’t be accepting inbound connections. Applications you’ve uninstalled may still have exceptions listed.

macOS also includes a separate packet filter (PF) accessible from the command line — more powerful but also more complex than the Application Firewall. For most users, the Application Firewall in System Settings covers the necessary configuration without requiring command-line knowledge.

Network profile comparison — when to use each

Network type	Windows profile	Recommended inbound setting	File/printer sharing	Stealth mode
Home network (own router)	Private	Block by default, specific exceptions as needed	Enabled if needed	Optional
Office/corporate network	Domain (or Private if no domain)	Managed by IT policy or similar to Private	Per IT policy	Optional
Public WiFi (café, airport, hotel)	Public	Block all inbound connections	Disabled	Enabled
Mobile hotspot	Private (trusted) or Public (untrusted)	Block all inbound for conservative posture	Disabled	Enabled

Confirming the current network profile: Windows taskbar → WiFi/Network icon → click the connected network → look for “Public network” or “Private network” label. If connected to a public WiFi and the label shows “Private network,” change it: Settings → Network & Internet → WiFi → the connected network → Network profile → Public.

Firewall troubleshooting — when an application can’t connect

The most common firewall-related support question: “why can’t application X connect?” The diagnostic sequence:

1. Check Windows Security → Firewall & network protection → “Allow an app through firewall” — find the application in the list and verify it’s allowed for the relevant network profile (Private/Public)
2. If the application isn’t in the list: Add it manually, or look for its own installer that typically adds an exception automatically
3. For advanced troubleshooting: Windows Defender Firewall with Advanced Security → monitoring → Inbound Rules — this shows the active rules in real time. Filter by the application’s executable name to see what rules apply.
4. Test with firewall temporarily disabled (for diagnostic purposes only) — if the application works with the firewall off, a firewall rule is blocking it. Re-enable the firewall immediately after testing; find and add the specific rule needed.

Our guide on the digital security checklist includes firewall rule audits as a quarterly maintenance item. For Microsoft’s official documentation on Windows Defender Firewall rule precedence and troubleshooting, Microsoft’s Windows Firewall documentation covers the advanced rule configuration and policy merge order in technical detail.

Third-party firewalls — when they’re worth considering

Windows Defender Firewall and macOS Application Firewall provide adequate baseline protection for most users. Third-party firewalls add capabilities that the built-in solutions don’t provide, but introduce additional complexity and cost:

• Application-level outbound filtering (Windows): Windows Defender Firewall’s outbound rules are less user-friendly to configure than specialist tools. For users who want to control which applications can access the internet (blocking apps from phoning home, blocking telemetry at the application level), tools like simplewall (free, open-source) or GlassWire provide a simpler interface for outbound application rules that Windows’ built-in Advanced Security editor makes difficult.
• Little Snitch (macOS): adds interactive outbound connection monitoring to macOS — it prompts when any application attempts to make a new outbound connection, allowing or denying per-application, per-host, or per-port. Much more granular than the built-in Application Firewall and particularly useful for identifying applications that “phone home” with data you didn’t know they were sending. Expensive (~$50) but the tool of choice for privacy-conscious Mac users who want full visibility into outbound connections.
• Hardware firewall / UTM appliances: for small businesses that need network-level firewall protection beyond what a consumer router provides, Firewalla or Ubiquiti UniFi Security Gateway provide network-level firewall rules, traffic monitoring, and intrusion detection. More appropriate than managing device-level firewall rules across every machine in the organisation individually.

Outbound firewall rules — for users who want application-level control

Most consumer firewalls default to allowing all outbound traffic, which is the correct default for usability. Blocking outbound selectively requires understanding what every application on the computer legitimately connects to — which is complex but not impossible. See also iPhone Privacy Settings for a related case.

Applications that commonly warrant outbound restriction consideration:

• Applications with no legitimate network function that shouldn’t be making any outbound connections
• Applications that collect telemetry and usage data — blocking their telemetry endpoints reduces data transmission without affecting core functionality
• Applications installed for a specific one-time task that should no longer be connecting to any server

For most home users, outbound filtering is optional and adds configuration overhead that the privacy and security benefit may not justify unless there’s a specific application you want to restrict. The inbound rules and network profile configuration in the main sections above address the primary security risks without the complexity of application-level outbound management. You might also run into Windows Defender Guide.

Firewall settings, configured correctly and audited periodically, provide a consistent defence against the inbound connection attempts that represent the majority of network-based attack vectors against individual computers. The combination of block-by-default inbound rules, correct network profile classification, stealth mode on public networks, and a quarterly allow-list audit produces a firewall posture that works silently in the background for most users — only becoming visible when an application needs a new exception or when the audit surfaces a rule that shouldn’t be there. Related: macOS Security Settings.