Simulation Lab 11.2: Module 11 Block Ports -- Defender Firewall

Introduction

In Simulation Lab 11.2 – Module 11 “Block Ports”, students learn how to use Windows Defender Firewall to restrict network traffic by closing specific TCP/UDP ports. This lab is a core component of many cybersecurity curricula because controlling port access is one of the simplest yet most effective ways to reduce an organization’s attack surface. By the end of the exercise, learners will be able to identify vulnerable services, create inbound and outbound firewall rules, verify that the rules are active, and document the changes for future audits.

Some disagree here. Fair enough.

The concepts covered in this module also map directly to real‑world tasks performed by security analysts, network engineers, and system administrators. Whether you are protecting a single workstation, a server farm, or an entire enterprise, the same principles apply: understand the traffic you need, block the traffic you don’t, and continuously monitor the firewall’s state It's one of those things that adds up..

Why Blocking Ports Matters

Reducing the Attack Surface

Every open port represents a potential entry point for attackers. Services such as Remote Desktop Protocol (RDP – port 3389), File Transfer Protocol (FTP – port 21), or Simple Mail Transfer Protocol (SMTP – port 25) are frequently targeted because they are well‑known and often misconfigured. By blocking unnecessary ports, you eliminate the opportunity for exploits like brute‑force login attempts, buffer overflows, or unauthorized data exfiltration.

Compliance and Auditing

Regulatory frameworks (PCI‑DSS, HIPAA, NIST 800‑53) require organizations to demonstrate that they have implemented network segmentation and port filtering. A correctly configured Windows Defender Firewall provides the audit trail needed to prove compliance: each rule is logged, can be exported, and can be tied to change‑management tickets.

Performance Benefits

When traffic is filtered at the host level, the operating system discards unwanted packets before they reach the application stack. This reduces CPU usage, memory consumption, and network congestion, especially on machines that act as application servers or gateway devices Simple, but easy to overlook..

Lab Overview

The lab uses a Windows 10/11 virtual machine with Defender Firewall enabled, and a second VM acting as a traffic source. All commands are executed with Administrator privileges That alone is useful..

Step‑by‑Step Walkthrough

1. Confirming the Baseline Firewall State

Open PowerShell as Administrator and run:

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction

You should see Enabled: True for all profiles and DefaultInboundAction: Block. If any profile is disabled, enable it with:

Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

2. Enumerating Listening Ports

Run the following to capture a snapshot of active listeners:

netstat -ano | findstr LISTENING

Cross‑reference the PID (Process ID) with the service name:

Get-Process -Id  | Select-Object Id,ProcessName

Typical results might include:

• Port 135 – RPC
• Port 139/445 – SMB/CIFS
• Port 3389 – RDP (if enabled)

Identify which of these are unnecessary for the lab environment. To give you an idea, Telnet (port 23) is rarely used and should be blocked.

3. Creating Inbound Block Rules

Use the Windows Defender Firewall with Advanced Security GUI or PowerShell. The PowerShell method is faster and reproducible:

# Block inbound Telnet (TCP 23) from any remote address
New-NetFirewallRule -DisplayName "Block Inbound Telnet" `
    -Direction Inbound -Protocol TCP -LocalPort 23 `
    -Action Block -Profile Any -Enabled True

# Block inbound SMB (TCP 445)
New-NetFirewallRule -DisplayName "Block Inbound SMB" `
    -Direction Inbound -Protocol TCP -LocalPort 445 `
    -Action Block -Profile Any -Enabled True

Both rules appear in Get-NetFirewallRule with unique Rule IDs (GUIDs). Verify:

Get-NetFirewallRule -DisplayName "Block Inbound*" | Format-Table Name,Enabled,Action,Direction,LocalPort

4. Creating an Outbound Block Rule for a Specific User

Suppose you have a test account labuser. To prevent this user from making HTTP requests:

$UserSID = (Get-LocalUser -Name labuser).SID.Value
New-NetFirewallRule -DisplayName "Block labuser HTTP Outbound" `
    -Direction Outbound -Protocol TCP -RemotePort 80 `
    -Action Block -Profile Any -Enabled True `
    -User $UserSID

Now any process running under labuser will be unable to reach external web servers on port 80.

5. Testing the Rules

From the second VM (attacker machine), attempt to connect to the blocked ports:

telnet  23
telnet  445

Both attempts should time out or return “Connection refused” Most people skip this — try not to..

On the lab machine, log in as labuser and try to browse a website:

Invoke-WebRequest -Uri http://example.com

PowerShell will throw a WebException indicating that the connection was blocked.

Switch to an Administrator account and repeat the request; it should succeed, confirming that the rule is user‑specific Still holds up..

6. Exporting the Firewall Policy

To ensure repeatability across multiple systems, export the current configuration:

Export-WindowsFirewallRules -FilePath "C:\LabExports\Lab11_BlockPorts.wfw"

The .wfw file can be imported on any Windows machine with:

Import-WindowsFirewallRules -FilePath "C:\LabExports\Lab11_BlockPorts.wfw"

7. Documenting the Lab

A proper lab report includes:

1. Objective – What the lab aims to achieve.
2. Environment – OS version, VM configuration, network topology.
3. Commands Executed – Full PowerShell snippets with timestamps.
4. Screenshots – GUI rule view, netstat output before/after, test results.
5. Analysis – Explanation of why each port was blocked and the impact on security.
6. Conclusion – Summary of learning outcomes and next steps (e.g., adding logging, creating alerts).

Scientific Explanation Behind Port Blocking

The OSI Model Perspective

Port numbers belong to the Transport Layer (Layer 4) of the OSI model. TCP and UDP use these 16‑bit identifiers to multiplex multiple applications over a single IP address. When a packet arrives, the operating system examines the destination port and hands the payload to the corresponding socket.

A firewall placed at the host level intercepts packets before they reach the socket layer. This leads to by checking the port number against a rule set, the firewall can drop (silently discard) or reject (send a TCP RST/ICMP unreachable) the packet. This early termination prevents the application from ever seeing the data, which is why blocking ports is a defense‑in‑depth technique.

Quick note before moving on.

Statefulness and Connection Tracking

Windows Defender Firewall is stateful, meaning it tracks the state of each TCP connection (e.Worth adding: g. Worth adding: , SYN_SENT, ESTABLISHED, FIN_WAIT). This leads to when you block an inbound port, the firewall denies the initial SYN packet, so no connection state is ever created. For outbound rules, the firewall examines the first outbound SYN from the specified user or process and drops it if it matches a blocked remote port.

Stateful inspection also allows exception rules such as “allow inbound traffic if it is part of an established outbound connection.” This is why you often see default rules that permit return traffic while still blocking unsolicited inbound attempts The details matter here..

Impact on Application Behavior

When a blocked port is targeted, the application typically receives an error code:

• TCP – WSAECONNREFUSED (10061) on Windows, indicating the connection was actively refused.
• UDP – No response, leading to a timeout after the application’s retransmission limit is reached.

Understanding these error codes helps troubleshoot misconfigured rules and avoid false positives during penetration testing.

Frequently Asked Questions (FAQ)

Q1: Will blocking port 445 affect file sharing between Windows machines?
A: Yes. SMB/CIFS runs over port 445. If you need internal file sharing, create a rule that allows traffic from trusted IP ranges while keeping it blocked for the internet That alone is useful..

Q2: Can I block a range of ports in a single rule?
A: Absolutely. Use the -LocalPort parameter with a hyphenated range, e.g., -LocalPort 1024-2048. This is useful for stopping high‑numbered ports used by certain malware families.

Q3: How do I log blocked connections?
A: Enable logging in the firewall’s Properties → Logging tab. Set the Log dropped packets option and specify a log file path. Logs are stored in the %systemroot%\system32\LogFiles\Firewall directory Small thing, real impact..

Q4: Will blocking outbound HTTP for a user affect Windows Update?
A: Yes, because Windows Update uses HTTPS (port 443). If you block only port 80, updates will still succeed, but any HTTP‑only services will fail. Always test before applying user‑wide restrictions.

Q5: Is there a performance penalty for having many firewall rules?
A: Modern Windows versions handle thousands of rules efficiently, but the rule evaluation order matters. Place the most frequently matched rules at the top and use rule groups to keep the list organized That alone is useful..

Best Practices for Ongoing Port Management

1. Perform Regular Port Scans – Use tools like Nmap or PowerShell’s Test-NetConnection to detect newly opened ports after software installations.
2. Adopt a “Zero‑Trust” Stance – Default to blocking all inbound traffic and only open ports that are explicitly required for business functions.
3. apply Group Policy – Deploy firewall rules across an Active Directory domain using Group Policy Objects (GPOs) for consistency.
4. Integrate with SIEM – Forward firewall logs to a Security Information and Event Management platform to detect anomalous blocked‑connection attempts.
5. Review and Update Quarterly – Align rule reviews with patch cycles and business changes to avoid “rule rot.”

Conclusion

Simulation Lab 11.In practice, 2’s “Block Ports” module offers a hands‑on introduction to one of the most fundamental security controls: host‑based firewall rule creation. By systematically identifying unnecessary services, constructing precise inbound and outbound block rules, and verifying their effectiveness, students acquire a skill set that translates directly to protecting real‑world environments Which is the point..

Beyond the lab, the principles of port hardening, stateful inspection, and continuous monitoring form the backbone of a strong network defense strategy. Whether you are a budding security analyst or an experienced IT professional, mastering Windows Defender Firewall’s rule engine equips you to reduce attack vectors, satisfy compliance mandates, and maintain optimal system performance.

Honestly, this part trips people up more than it should Small thing, real impact..

Remember: the best firewall is the one you understand, document, and maintain. Keep the rule set lean, test changes in a controlled environment, and always pair port blocking with complementary controls such as intrusion detection, patch management, and user education. With these practices in place, your organization will be far better positioned to thwart the myriad threats that target open ports every day Took long enough..