Windows Server Firewall: Scripting Custom IPsec and Rules

Deploying Windows Server instances directly onto public IPv4 and IPv6 cloud addresses requires immediate, stateful network perimeter controls. Windows Defender Firewall with Advanced Security provides the underlying filtering mechanism through the Windows Filtering Platform (WFP). Rather than manually navigating the graphical MMC snap-in, enterprise infrastructure teams rely on PowerShell to script deterministic firewall baselines.

Beyond standard inbound port restrictions, Windows Firewall supports native IPsec Connection Security Rules. This allows two Windows VPS nodes (or a database server and application server) to mutually authenticate via Kerberos, preshared keys, or certificates, and automatically encrypt all payload traffic with hardware-accelerated AES-GCM transport encryption.

Expand

Scripting Inbound Access Rules via PowerShell

To protect services such as Remote Desktop (RDP) from automated credential brute forcing, restrict management ports strictly to authorized subnet addresses:

# Disable default permissive RDP rule
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Create a locked-down custom rule permitting RDP only from administrative IPs
$rdpParams = @{
  DisplayName = "RDP-Admin-Subnet-Only"
  Direction = "Inbound"
  Action = "Allow"
  Protocol = "TCP"
  LocalPort = 3389
  RemoteAddress = @("198.51.100.0/24", "203.0.113.15")
  Profile = @("Public", "Domain", "Private")
  Description = "Restricted administrative RDP access"
}
New-NetFirewallRule @rdpParams

# Create high-throughput rule for public web traffic
$webParams = @{
  DisplayName = "HTTP-HTTPS-Inbound"
  Direction = "Inbound"
  Action = "Allow"
  Protocol = "TCP"
  LocalPort = @(80, 443)
  Profile = "Public"
}
New-NetFirewallRule @webParams

Configuring Mutual IPsec Encryption

To establish encrypted transport between your application tier and database tier without maintaining complex third-party VPN daemons, create a Connection Security Rule:

# Create an IPsec transport security rule between App and DB servers
$ipsecParams = @{
  DisplayName = "App-To-DB-IPsec-Transport"
  Mode = "Transport"
  InboundSecurity = "Require"
  OutboundSecurity = "Require"
  LocalAddress = "10.0.0.5"
  RemoteAddress = "10.0.0.6"
  AuthenticationMethod = "PreSharedKey"
  PreSharedKey = "EnterpriseSecureKey2026!ComplexPhrase"
  QuickModeCryptoSet = "AES256-SHA256"
}
New-NetIPsecRule @ipsecParams

Once applied, all TCP packets between 10.0.0.5 and 10.0.0.6 are encapsulated in IPsec ESP headers, providing line-rate wire encryption backed by CPU AES-NI hardware extensions.

Firewall Design and Architecture Video

Review fundamental firewall principles, state tracking, and packet rules in this technical video:

Auditing and Diagnosing Dropped Packets

To trace dropped packets in real time without third-party packet sniffers, enable the native Windows Firewall drop log:

# Enable dropped packet logging for the Public profile
Set-NetFirewallProfile -Profile Public -LogFileName "%SystemRoot%system32LogFilesFirewallpfirewall.log" -LogMaxSizeKilobytes 32768 -LogDropped True

# Monitor real-time dropped packets
Get-Content -Path "C:WindowsSystem32LogFilesFirewallpfirewall.log" -Tail 20 -Wait

Lock down your public Windows Server VPS with high-precision firewall controls on Netbay at netbayhosts.in.