Outbound rules on Windows Server (Firewall — Part 2)

Part 1 covered inbound. This one is about outbound: by default Windows Server allows everything going out — convenient but risky on exposed servers. Here you'll learn to audit, block and whitelist Outbound.

Video: Configure your first firewall — Part 2/2 — YouTube

1. Default policy

Open wf.msc > Windows Defender Firewall Properties. For each profile (Domain, Private, Public) you'll see:

• Inbound connections: Block (default).
• Outbound connections: Allow (default).

Switching Outbound to Block = mandatory whitelist. Only do it if you'll create Allow rules for every needed service; otherwise the server loses Internet.

2. Create an Outbound block rule (wizard)

• wf.msc > Outbound Rules > right-click > New Rule….
• Type Port, protocol TCP, port 25.
• Action Block the connection.
• Profiles to apply.
• Clear name: «Block SMTP outbound».

Now the server can't send outbound SMTP — useful to prevent a compromised process from spamming.

3. PowerShell — block outbound

Run as Administrator:

New-NetFirewallRule -DisplayName "Block SMTP out" -Direction Outbound -Protocol TCP -RemotePort 25 -Action Block -Profile Any

Block to a specific IP:

New-NetFirewallRule -DisplayName "Block C2 host" -Direction Outbound -RemoteAddress 198.51.100.42 -Action Block

4. Outbound by program

More useful than by port: limits which binaries can connect out.

New-NetFirewallRule -DisplayName "Allow update.exe out" -Direction Outbound -Program "C:\App\update.exe" -RemoteAddress 203.0.113.10 -Action Allow

If the default Outbound policy is Block, only that binary can reach that IP. Typical pattern for bastion or PCI servers.

5. Full whitelist (default-deny)

1. Create Allow rules for essentials: DNS UDP/TCP 53, NTP UDP 123, HTTPS 443 (Windows Update, minimal telemetry), HTTP 80 if needed.
2. Allow by program for your app (Pterodactyl Wings, IIS, SQL replication…).
3. Set Outbound default to Block.
4. Reboot or relog and verify everything still works.

6. Diagnostics

• Probe outbound: Test-NetConnection www.fusiora.com -Port 443 from the server. TcpTestSucceeded:False = blocked somewhere.
• List active Outbound rules: Get-NetFirewallRule -Direction Outbound | ? Enabled -eq True | Select DisplayName, Action.
• Drop log: Set-NetFirewallProfile -Profile Public -LogBlocked True -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log". Reproduce and read.
• Packet capture: pktmon start -c && pktmon stop + pktmon format.

7. Common pitfalls

• You block DNS by accident → the system breaks. Allow UDP/TCP 53 before flipping default.
• Blocking Windows Update → allow outbound to *.windowsupdate.com and *.microsoft.com on 443.
• Blocking activation → KMS usually uses TCP 1688.
• Blocking your monitoring agent (Datadog, Zabbix, Wazuh) → add Allow by program.

A well-designed outbound policy limits damage when a process is compromised: it can't call home or relay spam. Combine with Part 1 and the Fusiora panel firewall for defense in depth.