# Ensure 'Windows Firewall: Public: Inbound connections' is set to 'Block (default)'

Necessity: The Public profile is used for untrusted networks like public Wi-Fi hotspots in airports or cafes. By default, inbound connections should be blocked to protect the system from malicious actors on the same network who may attempt to scan for open ports, exploit vulnerabilities, or gain unauthorized access. Allowing unsolicited inbound traffic on a public network exposes the system to significant risk. Auditing and Remediation: The audit script checks the current value of the 'DefaultInboundAction' parameter for the firewall's Public profile. The remediation script modifies this parameter, setting it to 'Block' to enforce the security policy. Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Block'. This is because there is no secure scenario where allowing unsolicited inbound connections on an untrusted public network is advisable. 'Block' is the universally accepted best practice and the default for a reason, aligning with the principle of least privilege. Any other configuration represents a critical security misconfiguration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Block']` |
| **Moderate** | `['Block']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'DefaultInboundAction' for the 'Public' network profile using the `Get-NetFirewallProfile` cmdlet. The script must output only the value of this property (e.g., 'Block', 'Allow').

## Remediation Script Working

PowerShell script that sets the 'DefaultInboundAction' for the 'Public' network profile using the `Set-NetFirewallProfile` cmdlet. The script must accept the desired state (e.g., 'Block') as a single, positional command-line argument. It must return `$true` on successful application of the setting and `$false` on failure.

