Understanding Firewall Settings in Windows 11

Windows 11’s firewall is easiest to check in **Windows Security** under **Firewall & network protection**. From there, you can see which network profile is active, keep Microsoft Defender Firewall turned on for that profile, and allow only the apps you trust. If a change causes trouble, you can restore the default firewall settings and start over from a known-safe setup.

Start here: open the firewall settings you need

Before you change anything, make sure you can open Windows Security and that you have permission to change settings on this PC.

• Open Start and type Windows Security.
• Open the app, then select Firewall & network protection.
• On that page, you’ll see the three network profiles Windows uses: Domain network, Private network, and Public network.
• The page also shows which profile is active right now.

That active profile is the one that matters first. Firewall settings apply per profile, so the rule you add for Private does not help if Windows is currently treating the connection as Public. On a home network, you’ll usually be working with the Private profile. On a café, hotel, or airport network, it’s usually Public. If the PC is managed by an organization, you may see Domain as active instead.

If you only check one thing at the start, check the active profile. That tells you where your change will actually apply.

Choose the right network profile before changing anything

Windows assigns each connection to a profile so it can decide how open or closed the network should be.

A Private network is meant for places you trust, like your home Wi‑Fi. On a Private network, Windows can make the PC easier to discover by other devices on that same network, which helps with things like file sharing, printers, or streaming to another device.

A Public network is for places you don’t trust, like a coffee shop, airport, or hotel. In that profile, Windows is stricter so your PC is harder for strangers on the same network to see.

A Domain network is usually used in workplaces or schools where the PC is joined to an organization’s domain. If you own a home PC, you probably won’t use this profile at all.

For a home Wi‑Fi example, you generally want the connection set to Private if it’s your own router and your own devices. If Windows has marked it as Public, your sharing and discovery features may not work the way you expect. Check the active profile before you start allowing apps through the firewall, because the rule may be applied to the wrong network type if you skip this step.

Turn the firewall on and check the protection settings

The safest setup is to keep Microsoft Defender Firewall on for every profile you use. If it’s off, your PC has fewer barriers against unwanted network traffic.

1. In Windows Security, open Firewall & network protection.
2. Select Domain network, Private network, or Public network to view its settings.
3. Turn Microsoft Defender Firewall to On for that profile if it isn’t already.
4. Repeat for the other profiles you use.

A few settings are worth checking while you’re there. Incoming connections controls how Windows handles unsolicited traffic from the network. Leaving the default protection in place is usually the safer choice. If you see a setting for notifications, it can be helpful because Windows can tell you when an app is trying to communicate through the firewall.

You may also see options related to network discovery and file and printer sharing. These are convenient on a trusted home network, but they make your PC more visible. If you don’t need them, leave them off.

If you’re unsure, start with the firewall on and the rest left alone. Turning the firewall on does not stop normal internet use, and most everyday apps work without any extra changes.

Allow only the apps you trust

If an app stops working on your network, the cleanest fix is usually to allow that specific app instead of opening a broad port.

1. In Windows Security, open Firewall & network protection.
2. Select Allow an app through firewall.
3. If the list is locked, choose Change settings first. You may need administrator permission.
4. Find the app in the list and check the boxes for the network types you want it to use, usually Private only for a home app.
5. If the app is not listed, use Allow another app and browse to the program file.

This keeps the exception narrow. A rule tied to one app is easier to review later than a broad port rule, which can leave a wider opening than you meant to create. If your printer software needs access on your home network, or a game launcher needs to reach its servers, allow that app on the network profile you trust and leave the others unchecked.

If the app still does not work, check two things before you make the rule broader: whether the active profile matches the one you allowed, and whether the app actually needs network access on that profile. If you no longer need an app allowed through the firewall, remove the entry or clear its boxes. The less you allow, the smaller the attack surface.

If something stops working, fix it without weakening security

If a network feature breaks after you change firewall settings, check the profile first. A common mistake is allowing an app on Private while you’re actually connected through Public, or vice versa.

Restoring defaults removes custom firewall rules. That can fix problems, but you may need to allow trusted apps again afterward.

1. Go back to Firewall & network protection and confirm the active profile matches the network you’re using.
2. Check whether the app you changed is allowed for that exact profile.
3. If the problem started after a firewall rule change, undo that specific change before you try broader fixes.
4. If the settings have become messy or you’re not sure what was changed, select Restore firewalls to default from the firewall page.
5. Confirm the reset, then review your firewall profile and app allowances again.

Restoring defaults is a good cleanup move when a rule causes trouble, but it also clears the exceptions you added earlier. Use it when you want to get back to a known-safe starting point, then add back only the apps you truly need.

If the app still fails after that, the issue may not be the firewall at all. It could be the app’s own settings, your router, or the network type Windows has assigned.

Finish by confirming your firewall is doing its job

A quick check at the end saves a lot of guesswork later. Open Windows Security and confirm three things: Microsoft Defender Firewall is on, the active network profile matches where you are connected, and only the apps you actually trust are allowed through.

If you’re on home Wi‑Fi, the connection should usually be Private. If you’re away from home, Public is the safer choice. Keep the firewall enabled for every profile, and only add app exceptions when you have a clear reason for them.

If those pieces line up, your firewall is set up in a way that protects you without getting in the way of normal use.

Conclusion

Once you know which profile is active, firewall settings in Windows 11 are straightforward to manage. Keep Microsoft Defender Firewall on, use Private only for trusted home or similar networks, and allow apps one by one instead of opening broad access. If a change causes problems, undo that specific rule first, or restore defaults and build back only the exceptions you need. That gives you a cleaner setup and a better chance of spotting mistakes before they spread.

Frequently Asked Questions

Should I turn off Microsoft Defender Firewall if an app stops working?

Usually no. It’s better to allow the specific app you trust, or fix the profile the app is using. Turning the firewall off leaves the whole PC less protected.

Why does Windows show more than one network profile?

Windows separates networks by trust level. Private is for trusted networks, Public is for untrusted ones, and Domain is for organization-managed PCs.

Is it safer to allow an app or open a port?

Allowing an app is usually safer because the exception is tied to one program. Opening a port can be broader than you need.