Write the Host Firewall Rules

Scenario

Kestrel Ridge Freight's yard office PC does two jobs besides its own. It hosts the dispatch board, a small internal web app that staff open over HTTPS (TCP 443), and a shared folder that staff map over SMB (TCP 445). Staff PCs sit on the office LAN, 192.168.10.0/24. The PC is joined to the company domain and is on the domain network today, but the yard supervisor takes it to customer sites and joins their guest Wi-Fi, which Windows treats as a public network. The IT admins work from 10.20.0.0/24. A security review of the PC's Windows Defender Firewall found: • The vendor who installed the dispatch board left a rule named "Allow Any Inbound" that lets every inbound connection through on every profile. Delete it. Staff must still reach the dispatch board from the office LAN, through an inbound rule of its own that allows HTTPS. • Remote Desktop (TCP and UDP 3389) answers anyone who can reach the PC. Only the IT admin subnet, 10.20.0.0/24, may connect, on any network, and the admins must keep their access. • SMB must be blocked whenever the PC is on a public network, including from other devices on the same guest Wi-Fi. Staff on the domain network must keep their shared folder. The PC has no use for file sharing on a private network, so SMB there is your call. • The private and public firewall profiles are switched off. Every profile must be on. Use any Windows tool you like; a terminal changes the firewall only when elevated (right-click Start, choose Terminal (Admin), then select Yes). Grading is on the firewall's final state.

These instructions stay visible beside the lab while you work.You can reread these instructions in the lab at any time.