What you will achieve

Understand inbound versus outbound Windows Firewall rules, create a rule correctly, and avoid opening more than you need.

1) Open Windows Defender Firewall with Advanced Security

Press Win + R, type wf.msc, and press Enter.
You see separate lists for Inbound Rules and Outbound Rules.
Inbound controls traffic coming into the PC from the network or internet. Outbound controls traffic leaving the PC.

2) When each direction matters

File sharing, RDP, or a local web server need inbound allow rules for the specific port and profile (Domain, Private, Public).
Blocking outbound traffic is rare on client PCs — it can break apps that call cloud APIs. Use outbound rules mainly to restrict specific apps on managed machines.
Default policy: inbound blocked unless allowed; outbound allowed unless blocked.

3) Create an inbound allow rule

In wf.msc, click Inbound Rules → New Rule.
Choose Port or Program, specify TCP/UDP and port (e.g. 3389 for RDP), allow the connection.
Apply only to Private profile if the PC is on home networks — avoid enabling on Public unless required.

4) Verify with PowerShell

Get-NetFirewallRule -Direction Inbound | Where-Object {$_.Enabled -eq 'True' -and $_.Action -eq 'Allow'} | Select-Object DisplayName, Profile | Format-Table -AutoSize

5) Block an outbound app (managed scenarios)

Outbound Rules → New Rule → Program → block badapp.exe.
Test — many apps fail silently when outbound DNS or HTTPS is blocked.

6) Restore firewall defaults

netsh advfirewall reset
netsh advfirewall set allprofiles state on

7) Logging dropped packets

wf.msc → Properties → Private profile → Log dropped packets → path C:\Temp\pfirewall.log.
Use logs to debug why RDP or file share fails without disabling firewall entirely.

8) Profile awareness

Rules apply per profile (Domain, Private, Public). A rule enabled only on Domain does nothing on home Private Wi‑Fi — common misconfiguration.

Set network category: Settings → Network & internet → Properties on active connection.
Test with Get-NetConnectionProfile — Category should match where you enabled the rule.

Verification checklist

Test rule with telnet or Test-NetConnection to the port from another LAN PC. Disable rule temporarily to confirm traffic was actually blocked — avoids false confidence from wrong profile.

Reboot once after changes that affect services, drivers, or firmware.
Confirm the original problem is resolved under normal daily use, not only immediately after the fix.
Note date, Windows version (Settings → System → About), and what changed in your personal runbook for next time.