Windows Firewall: Public: Outbound connections
This DWORD value defines the default action that Windows Firewall takes for outbound connections while the public firewall profile is active.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DefaultOutboundAction
This DWORD value defines the default action that Windows Firewall takes for outbound connections while the public firewall profile is active. A value of 0 allows an outbound connection when the traffic does not match an outbound firewall rule.
Explicit firewall rules are still evaluated. In particular, outbound rules that block specific applications, services, protocols, ports, or destinations remain effective. This value does not override those rules.
Notes
Security
The Allow default action does not provide block-by-default control of outbound traffic. Applications and services can generally establish outbound network connections unless a matching block rule prevents them. This also applies to unwanted or compromised processes and can make communication with external systems or the transfer of data possible.
The setting does not allow inbound connections or bypass a matching block rule. Default behavior for inbound connections is controlled separately.
Notes
DefaultOutboundAction is a DWORD value. 0 represents Allow and 1 represents Block.
The setting applies only to the public firewall profile. When another profile is active, that profile's default action applies instead. Filtering also depends on Windows Firewall being enabled for the public profile.
Microsoft documentation
Microsoft Learn: Windows security baseline – Windows Firewall: Public: Outbound connections
Microsoft Learn: Windows Firewall overview