Windows Firewall: Private: Inbound connections
This registry value defines the default action that Windows Firewall takes on inbound traffic while the private firewall profile is active.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DefaultInboundAction
This registry value defines the default action that Windows Firewall takes on inbound traffic while the private firewall profile is active. It is a REG_DWORD value; 1 blocks inbound traffic by default when no applicable firewall rule explicitly allows it. A value of 0 would allow such traffic by default.
The default action is evaluated after the firewall rules. Applicable explicit allow rules can therefore continue to permit inbound connections. Response traffic associated with a connection initiated by the computer is also not blocked solely by this setting.
Notes
Security
Default blocking limits remotely accessible services to traffic that firewall rules explicitly permit. This reduces the attack surface presented by unexpected or unauthorized inbound connections.
The setting does not unconditionally block all inbound traffic. It is distinct from the option that blocks every incoming connection, including traffic covered by existing exceptions. Explicit block rules also take precedence over conflicting allow rules.
Possible side effects
Applications and network services that require inbound connections are unavailable on private networks unless an applicable active allow rule exists. This can affect functions such as sharing, discovery, or remote access without generally blocking outbound connections.
Notes
The setting takes effect only when Windows Firewall is enabled for the private profile and that profile applies to the network connection. It does not change the default action for the domain or public profiles.
Microsoft documentation
Microsoft Learn: Firewall CSP – DefaultInboundAction for the private profile
Microsoft Learn: Default Inbound Action registry specification