How to Enable or Disable “Block All Incoming Connections” in Windows Firewall The Windows Firewall offers more than just predefined rules and profiles. One of its most powerful yet underutilized features is the “Block all incoming connections” option. This setting temporarily stops all unsolicited inbound traffic while still allowing outbound connections and responses to outbound-initiated traffic. In this video, we’ll look at several ways to enable or disable this setting in Windows 11, including through the Windows Security app, Control Panel, PowerShell, and Command Prompt. Before we begin, be sure to subscribe to NinjaOne’s IT video hub for more tech content like this. 4 Methods for Configuring “Block All Incoming Connections” in Windows Firewall Method 1: Using the Windows Security App (GUI) This method is ideal for one-off changes, testing, or troubleshooting on a single active network profile, without using the registry. Open Settings, then navigate to Privacy & security > Windows Security > Firewall & network protection. Select your active network: example, Private network or Public network. Scroll down to Microsoft Defender Firewall. Toggle Block all incoming connections, including those in the list of allowed apps. Select On to block all unsolicited inbound connections, or Off to allow inbound traffic. The change will immediately take effect, no restart needed. Method 2: Using the Windows Defender Firewall Control Panel The classic Control Panel interface allows for comprehensive control and lets you configure multiple network profiles at once. Open Control Panel, navigate to System and Security, then select Windows Defender Firewall. Click Advanced settings on the left. In the Windows Defender Firewall window, select Windows Defender Firewall Properties. Under the Settings section for each profile, locate Inbound connections. Choose Block all connections, then click OK to apply. Method 3: Using PowerShell PowerShell is the go-to method for IT admins integrating firewall configurations into deployment scripts or remediation workflows. Open PowerShell as Administrator and use the following commands: Run this command to enable “Block all incoming connections” for the Public profile: Conversely, run this command to disable this setting and allow inbound connections based on defined firewall rules: Lastly, you can apply this across all For the complete PowerShell script set, including examples for all profiles, see the full blog post linked below. Method 4: Using Command Prompt (netsh) If PowerShell isn’t available or you’re working in a restricted or legacy environment, you can use the netsh command-line utility. Use this to enable “Block all incoming connections” for the Public profile: Here’s the script for disabling this setting and reverting to rule-based inbound control: To apply the configuration to another profile, such as Private, use: Finally, you can run Get-NetFirewallProfile or open Event Viewer to verify the applied changes. The “Block all incoming connections” setting gives administrators a powerful way to instantly harden a device against external threats. To use this setting effectively, remember that it’s best suited for temporary use and should be disabled once normal operations resume to restore services like remote access and file sharing. For more information, check out our official blog post on how to enable the “Block all incoming connections” setting in Windows Firewall, linked in the description below.