Looking at Windows 10's firewall settings, I see dozens of authorized applications, for most of which I can't find a good reason to allow incoming traffic.

For example, I don't want Xbox, Twitter, MSN, Microsoft Edge to receive unknown traffic from the Internet.

I assume that these settings don't include traffic on already established connections (like the ESTABLISHED and RELATED states in Linux's netfilter). Indeed, I disallowed Microsoft Edge in the firewall and I still can browse.

Why does Windows allow so much applications in the firewall by default? Isn't this a security risk (for example, any of these apps could be exploited)? Is it safe to disable them all and block all incoming traffic?

EDIT : to be clear, I am only talking about inbound connections that happen without having been previously established by an outbound request. I'm totally fine with allowing all outbound connections, as these are initiated by my software.

  • 3
    I think all Metro apps are exempt from the firewall by default. Maybe this is due to additional security measures in these apps (sandbox, etc.) or it's just sloppy deployment strategy.
    – billc.cn
    Commented Aug 10, 2016 at 11:51
  • 3
    Even if Metro apps are sandboxed, I don't want them to receive traffic without a good reason. I disabled all the rules and my PC still works fine. I think I will just blame Microsoft for putting holes in their own security for no reason.
    – Hey
    Commented Aug 10, 2016 at 12:00
  • @Amo On similar reasons I don't use microsoft OSes et al.
    – peterh
    Commented Jan 26, 2018 at 23:40
  • Those help the spy/spam program.
    – Overmind
    Commented Mar 15, 2019 at 8:58

2 Answers 2


"Authorized Applications" does not equal "Open Ports." These applications have authorization to communicate through the firewall...This does not mean that they're listening on ports open through the firewall. In the case of many (if not all) of the application you listed, that means that when you open them and try to use them, they can establish connections to get the data requested. If you don't open Twitter, it isn't listening. If you do open Twitter, it still isn't listening on a port for in-bound connections. The fact that it's an authorized application means that you expect the firewall to allow it to communicate as it is designed to do. In this case, that's primarily going to be reaching out to the Twitter service to retrieve tweets.

So, while you are correct that you don't want services you don't need listening for inbound connections on open ports, that isn't what's happening here.

  • I think you're partly wrong. I disallowed all the apps, effectively blocking anything on my PC, and all still works well. This seems to means that the firewall only blocks incoming non-already-established connections, like I thought. Also, the firewall only shows "warnings" for new apps when they try to listen on a port, like the Minecraft server (only example I remember). But you're right saying that n authorized apps don't mean n listening ports. It just means that they can listen on a port, and I'm not comfortable with that. Why should they ?
    – Hey
    Commented Aug 10, 2016 at 19:08
  • 2
    @YdobEmos No, that's not how it works. There are separate rule sets for inbound connections vs. outbound connections. If you blocked (not disabled) both inbound connections and outbound connections for an application, it should not continue to work. If this is not the case for you, I'd be interested to see it.
    – Xander
    Commented Aug 10, 2016 at 19:34
  • @YdobEmos I've just confirmed that on my system, blocking outbound connections for the Xbox app breaks it.
    – Xander
    Commented Aug 10, 2016 at 19:40
  • Then we're not talking about the same thing. I was using the simple list of apps in the Control Panel, not the "Advanced" settings, and the ones I use seem to block only inbound connections. I totally understand why blocking outbound connections would break any app that uses the Internet. My question was about inbound connections that are and shouldn't be allowed by default. Sorry for being unclear. I'll edit the question.
    – Hey
    Commented Aug 10, 2016 at 20:38
  • "Authorized Applications" does not equal "Open Ports." - correct, but the end result is the same -- they can get through.
    – Overmind
    Commented Mar 15, 2019 at 8:59

While your assumption that having more open ports increases security risk is correct, it still depends on a lot of other factors.

Now, let me ask you if you believe that closing most ports through your firewall makes you secure? Again, you cannot have an answer to that as there are way too many factors involved.

While it is advisable to keep only the necessary ports open or closed, the default Windows setup is definitely not optimum, but at least decent. This is also the reason you have access to the firewall settings and people that understand what's going on can make a choice. But to others, it might just be an inconvenience.

For example: You don't want Xbox, Twitter or MSN. But what if I'm a non-technical person that purchased a Windows machine for the sole purpose of using Xbox, Twitter and MSN? If Windows blocked them by default, I wouldn't know what to do. I would be frustrated and think that Microsoft is a bogus company etc etc.

I hope you understand what I mean. If you understand security and think a specific setup makes your computer more secure, by all means - go for it. :)

Hope this helps!

  • I understand, thank you. Problem is, I want to use Twitter or sometimes Xbox. I still use them now that I blocked them in the firewall, they work fine. The firewall only prevents apps from receiving random incoming traffic when I didn't ask for it ; if I ask Twitter to show my timeline, the server's response will come through, because it's an already established connection. My point is, there is absolutely no need for these apps to accept random packets. My PC isn't a web server, and anyone that really needs this (on a server for example) could allow what he wants.
    – Hey
    Commented Aug 10, 2016 at 12:08
  • anyone that really needs this (on a server for example) could allow what he wants. This assumes that the person has the prerequisite knowledge. To a lot of people, this would just be an inconvenience! But I see your point. Commented Aug 10, 2016 at 12:11
  • I think that if you really need an app to listen on a port, you should learn basic security first. It may be a good thing that one can't set up a server listening publicly without knowing about firewalls.
    – Hey
    Commented Aug 10, 2016 at 19:10
  • Actually, you can. Commented Aug 10, 2016 at 19:31
  • "closing most ports through your firewall makes you secure" is a poor way to think about things. Closing ports makes you more secure by reducing attack surface and attacker access to vulnerabilities. "closing most ports through your firewall makes you more secure Commented Aug 10, 2016 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .