TL;DR: Firewalls are a series of gates that allow or block traffic based on specified criteria. We can edit firewall rules and create new ones via PowerShell, but we always must apply the Principle of Least Privilege and understand each setting before changing it.

Context: After connecting the office scanner to a new computer, the scanner could see the destination address, but scanned files were not arriving in the shared folder.

What I did

Using PowerShell, I found that all File and Printer Sharing firewall rules were disabled. This meant Windows was blocking the inbound SMB connection the scanner needed in order to write to my shared folder. Instead of enabling the entire File and Printer Sharing group, I disabled the broad rules and created one narrow allow rule for inbound TCP 445 traffic from the scanner’s IP address on private networks only.

Takeaways:

1. It was exciting to see the inner workings of Windows Firewall and to get a tactile understanding of how it works.
2. Get-NetFirewallRule shows the rule shell: name, profile, direction, action, and enabled state. To understand what traffic the rule applies to, I had to inspect the associated filters, such as Get-NetFirewallPortFilter and Get-NetFirewallAddressFilter.
3. Firewall rule settings are like light switches. PowerShell lets me flip those switches, inspect them, and create new ones. The underlying implementation is more like the electrical wiring behind the wall. In this case, I was the operator, not the electrician.
4. Understanding compounds. I have learned enough about networks, security, and general programming principles to work with firewall rules more comfortably, and, most importantly, to treat them with the respect they deserve.

tags: #networking, #smb, #powershell, #infosec, #file-systems