Why the Windows Firewall has so many exception rules by default?

Question

Consider the default firewall configuration for Windows 10 Pro (Creators Update).

So, in a nutshell:

• Block inbound connections.
• Allow oubound connections.
• 223 inbound exception rules (some of which are disabled).
• 148 outbound exception rules (some of which are disabled).

INBOUND EXCEPTIONS

Why allow so many exceptions inbound? That sounds like a blatant security vulnerability and defeats the point of having a firewall in the first place.

Sure, you can remove these, but most users won't.

Sure, the router NAT/firewall will block these, but then why have a Windows Firewall at all if you need to rely on another firewall?

Also, the vast majority of apps don't require to listen to inbound connections anyway.

OUTBOUND EXCEPTIONS

Why add outbound exceptions at all? The default behavior is to just allow everything outbound anyway, so all the exceptions don't do anything. It's confusing and redundant.

SOME THOUGHTS

I wonder if these are just poor design decisions from Microsoft, or if there are actually good reasons behind all this.

Answer 1

I would say main reasoning for this "common application ports being open" issue you are addressing is to avoid a "boy who cried wolf" situation in the future.

If a large majority of Windows connections (and common third party connections like connections made by web browsers) had to be explicitly defined as OK in the firewall rules, your average user would click accept on any request to add a new rule to the system, as legitimate requests from common services are blocked by inbound/outbound rules. Now, whenever there's suspicious traffic travelling through the firewall, your user disregards the concerning message, as it happened with every other legitimate packet.

Answer 2

It is important to realize that most of default rules are based on executable rather than port number. Furthermore, most of those rules are triplicate for Domain, Private, and Public profiles.

So add up all the executables in a default Windows install that need network connectivity, and then times it by 3. That number sounds about right.

The outbound exceptions are there so if you enable outbound filtering, basic Windows features will still work.

Answer 3

There really is no good reason to have inbound ports open by default. Microsoft does it because of users that don't know how to add exceptions to the firewall. To secure your system (This is what I did) delete all of the inbound rules. Some of them will be added back. When they do go into the properties of the rule and block the connection. This will ensure that your workstation is secure from any hacking activity. However, if there is a rule that has to do with a legitimate application, such as a game you play, leave those alone.