Windows Firewall Rules

Supported Windows endpoints have a versioned policy for their local Windows Firewall rules. Open an endpoint and select the Firewall tab to view and edit that policy.

The firewall rule policy and firewall profile state are separate:

• the endpoint Firewall tab stores local firewall rules
• the Windows Firewall Policy configuration profile manages whether Domain, Private, and Public firewall profiles are enabled
• the Windows Firewall Rules configuration profile checks and enforces the endpoint's active rule revision

Requirements

Firewall rule policies require:

• Windows 10 or Windows Server 2016 and later
• a supported Ordyn agent version
• permission to read or update endpoint Windows Firewall policies

The policy covers rules in the Windows Firewall PersistentStore. It does not read or manage rules supplied through Group Policy, MDM, the effective ActiveStore, connection-security policy, IPsec policy, service-hardening stores, or other external policy sources. Do not combine Ordyn rule enforcement with another manager for the local persistent rule store.

Firewall rule capture, checks, and remediation launch PowerShell on the endpoint. Endpoint security controls must permit the PowerShell activity started by Ordyn. See PowerShell security controls.

Initializing a policy

Add Import Windows Firewall rules to a job and run that job against the endpoint. Importing the endpoint's local rules is the supported way to create its firewall policy. The first successful import creates the policy and its first active revision.

Running the task again creates another active revision from the rules present on the endpoint at that time.

Importing rules does not apply rules to the endpoint. It only changes the active policy stored in Ordyn.

Editing rules

Every rule has an internal Windows identifier and a user-facing display name. Ordyn preserves the identifier for matching and enforcement but keeps it hidden in the normal editor. Display names do not need to be unique, so separate rules can use the same name.

The active policy shows its rules in a table. Use search and the State, Direction, Action, and Management filters to narrow the table.

Select rules with their row checkboxes. The table also supports range selection with Shift and multi-selection with Ctrl or Command. Right-click a single rule to edit, duplicate, enable, disable, or delete it. Right-click multiple selected rules to enable, disable, or delete them together.

Editing, duplicating, or deleting a rule creates a new immutable active revision. A bulk operation applies the selected change as one operation and creates at most one active revision, regardless of how many rules are selected. These changes do not start a check or remediation run.

The rule editor supports the writable NetSecurity settings used by standard persistent rules, including:

• display name, description, and enabled state
• inbound or outbound direction
• allow or block action
• Domain, Private, and Public profiles
• protocol, local and remote ports, and ICMP types and codes
• local and remote addresses
• application path, application package, and Windows service conditions
• interface aliases and interface types
• edge traversal, source mapping, platform, dynamic transport, and authorization settings

Fields that accept multiple ports, addresses, interfaces, or other values provide separate entries for each value.

Predefined rules

Windows component and application rules can be predefined or protected. Ordyn imports these rules and shows their properties, but only their enabled state can be changed. Predefined rules cannot be renamed, edited, duplicated, or deleted in Ordyn.

If a policy expects a predefined rule that Windows has removed, enforcement reports a configuration error instead of trying to recreate it. New predefined rules added by Windows remain unmanaged until a later import includes them.

Revisions

Select Revisions in the firewall sidebar to review the policy history. Select a revision to view its details in the sidebar and its rules in the table. Historical rules are read-only.

Sources include:

• job import
• rule changes
• restore

Select Restore revision to restore a historical revision after confirming the warning. Restoring copies its contents into a new active revision. The historical revision remains unchanged, and restoring does not start remediation.

If another user or job changes the active revision while an editor or import task is open, Ordyn rejects the stale change instead of overwriting the newer revision.

Checking and enforcing rules

Create a Windows Firewall Rules configuration profile and assign it to the required tenant, folder, group, or endpoint scope. The profile uses each endpoint's own active firewall policy and has no policy selector.

Choose the assignment behavior and add the automations that should run it:

• Audit only reports whether managed local rule properties match the active revision
• Remediate checks first and applies the active revision when managed rule properties have drifted

An assigned endpoint without a firewall policy reports a configuration error. If multiple Windows Firewall Rules profiles apply to one endpoint, every matching profile runs independently.

Rule changes become active in Ordyn immediately, but they reach the endpoint only through a configuration-profile run. An automated profile uses a newly saved revision during its next run.

Unsupported rules

Ordyn supports the writable fields exposed by the NetSecurity provider for normal persistent rules. A rule is marked unsupported when Windows reports conditions that the endpoint's NetSecurity version cannot safely read and write, or when the provider cannot manage the rule consistently.

The import job preserves unsupported rules as read-only policy entries with a reason. Checks and remediation stop before changing the endpoint while an unsupported rule is present. Remove or simplify the rule locally and import again before retrying enforcement.

Ordyn agent outbound rule

The Windows installer creates an outbound allow rule for the Ordyn agent executable. Installer repair and upgrades recreate the rule, and uninstall removes it.

Between installer runs, this is an ordinary local firewall rule. It appears in captured policies and can be edited or deleted like other rules. A policy may therefore remove it, and an explicit outbound block rule may override it.

Deleting or blocking the agent rule can disconnect the endpoint from Ordyn. Review outbound rules carefully before enforcing a revision. Recovery may require changing the firewall locally or running the installer again.