# Ensure 'Windows Firewall: Public: Inbound connections' is set to 'Block (default)'

Necessity: The Public firewall profile is used when the system is connected to untrusted networks, such as public Wi-Fi hotspots. Blocking all unsolicited inbound connections by default is a critical security measure. It prevents unauthorized access, stops network worms from spreading, and shields the system from scans and attacks by malicious actors on the same network. Misconfiguring this to 'Allow' would expose the system's services to significant and unnecessary risk.

Auditing and Remediation: The audit script queries the current state of the 'DefaultInboundAction' property for the Public network profile using the 'Get-NetFirewallProfile' cmdlet. The remediation script uses the 'Set-NetFirewallProfile' cmdlet to modify this same property, changing the default behavior for handling inbound connections to the specified value.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is consistently 'Block'. This reflects a fundamental security principle of 'default-deny' or 'least privilege.'
- Basic: ['Block'] is the minimum secure configuration, aligning with CIS Benchmarks and industry best practices. It establishes a secure baseline for operating on untrusted networks.
- Moderate/Strict: ['Block'] remains the only recommended setting because there is no secure alternative for a default inbound policy on a public network. Any setting other than 'Block' introduces a significant security vulnerability. Specific required inbound traffic should be permitted via explicit firewall rules rather than by weakening the default profile's security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Block']` |
| **Moderate** | `['Block']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'DefaultInboundAction' for the 'Public' firewall profile. The script must only output the current value (e.g., 'Block', 'Allow'), with no extra text or labels.

## Remediation Script Working

PowerShell script that sets the 'DefaultInboundAction' for the 'Public' firewall profile. The script must accept the desired state (e.g., 'Block', 'Allow') as a single positional command-line argument. It must return `$true` upon successful application of the setting and `$false` otherwise.

