How to Configure Authenticated Firewall Security Filters in Windows 11 Using PowerShell

In standard network configurations, firewall rules inspect packet headers based solely on transport layer attributes such as destination IP addresses and TCP or UDP port numbers. However, in Zero Trust enterprise architectures and high-security Windows environments, allowing any device or user to access a listening service simply because they reach an open port is insufficient. Windows Defender Firewall supports authenticated firewall rules—rules that enforce cryptographic authentication and payload encryption via IPsec before granting packet entry.

Through authenticated rules, administrators can mandate that only specific Active Directory domain computer accounts or designated security user groups can communicate with sensitive ports (such as remote administration tools, database listeners, or internal APIs). In Windows 11, the native PowerShell NetSecurity module provides granular management over these authentication parameters through the Get-NetFirewallSecurityFilter and Set-NetFirewallSecurityFilter cmdlets. This guide covers how to inspect security filter properties, mandate Kerberos/certificate authentication, enforce end-to-end payload encryption, and restrict firewall rules to authorized user groups.

Understanding Authenticated Firewall Security Filters

A firewall rule’s security filter governs how it interacts with the IPsec and Windows Filtering Platform (WFP) security engine. When a security filter is attached to a firewall rule, incoming packets must satisfy cryptographic assertions before being admitted:

• Authentication: Dictates whether the rule requires IPsec authentication. Options include:
  • NotRequired: Standard firewall behavior; packets are evaluated on port and IP headers alone.
  • Required: Packets must arrive over an authenticated IPsec tunnel (using Kerberos v5, NTLMv2, or X.509 machine certificates). Unauthenticated packets are discarded.
  • Request: The host requests authentication from the client but allows the connection if the client does not support IPsec.
• Encryption: Controls whether payload data must be encrypted with IPsec Encapsulating Security Payload (ESP). Options include NotRequired, Required (mandating AES or ChaCha20 encryption), or Dynamic.
• LocalUserAuthorizationList & RemoteUserAuthorizationList: Security descriptor definition language (SDDL) strings restricting communication exclusively to authorized local or domain users.
• RemoteMachineAuthorizationList: SDDL descriptor restricting connection rights to specific domain computers.
• OverrideBlockRules: Permits authenticated, authorized traffic to override any existing generic inbound block rules, creating a secure out-of-band administration channel.

Querying Security Filter Properties on Existing Rules

To inspect the security requirements of an existing firewall rule, open an elevated PowerShell prompt (Run as Administrator) and pipe Get-NetFirewallRule to Get-NetFirewallSecurityFilter:

# Query security filter attributes for a specific rule
Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" | 
    Get-NetFirewallSecurityFilter

The resulting object displays active cryptographic constraints:

Authentication                   : NotRequired
Encryption                       : NotRequired
OverrideBlockRules               : False
LocalUserAuthorizationList       : 
RemoteUserAuthorizationList      : 
RemoteMachineAuthorizationList   : 
PolicyStore                      : PersistentStore

Enforcing Authentication and Encryption on Inbound Ports

To secure a critical service—such as an internal database listener on TCP port 1433 or an administrative WinRM endpoint—create a new firewall rule and mandate both machine authentication and data encryption:

# Create inbound rule requiring IPsec authentication and encryption
New-NetFirewallRule -DisplayName "Secure-DB-Access-Encrypted" `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort 1433 `
    -Authentication Required `
    -Encryption Required `
    -Profile Domain

When this rule evaluates network traffic, the Windows Filtering Platform checks whether an active IPsec Security Association (SA) exists between the client and server. If the connection lacks valid Phase 2 IPsec encapsulation with cryptographic authentication, the packets are silently dropped.

Updating Existing Rules with Set-NetFirewallSecurityFilter

To convert an existing plain firewall rule into an authenticated rule without recreating it from scratch, use Set-NetFirewallSecurityFilter:

# Mandate authentication and encryption on an existing rule
Get-NetFirewallRule -DisplayName "Corporate-API-Service" | 
    Get-NetFirewallSecurityFilter | 
    Set-NetFirewallSecurityFilter -Authentication Required -Encryption Required

To verify that the change took effect:

# Verify updated security filter properties
(Get-NetFirewallRule -DisplayName "Corporate-API-Service" | Get-NetFirewallSecurityFilter).Authentication
(Get-NetFirewallRule -DisplayName "Corporate-API-Service" | Get-NetFirewallSecurityFilter).Encryption

Restricting Firewall Rules to Authorized Domain Users and Computers

Beyond requiring IPsec at the machine level, authenticated firewall rules can authorize specific user accounts. In enterprise environments running Active Directory, Kerberos user authentication tokens (AuthIP) are passed during connection establishment.

To restrict a firewall rule to a specific security group (e.g., “Database-Administrators”):

1. Retrieve the Security Identifier (SID) of the target security group:

   # Query SID for a domain security group
   $GroupSID = (Get-ADGroup -Identity "Database-Administrators").SID.Value
   $SDDL = "D:(A;;CC;;;$GroupSID)"
   

2. Apply the SDDL string to the RemoteUserAuthorizationList parameter:

   # Apply user authorization constraint to firewall rule
   Get-NetFirewallRule -DisplayName "Secure-DB-Access-Encrypted" | 
       Get-NetFirewallSecurityFilter | 
       Set-NetFirewallSecurityFilter -RemoteUserAuthorizationList $SDDL
   

Now, even if a user connects from an authenticated domain-joined workstation, the firewall will deny access unless the authenticated user account belongs to the Database Administrators group.

Enabling OverrideBlockRules for Administrative Channels

In zero-trust or isolated network configurations, administrators often enforce strict default inbound block rules across all subnets. To ensure authorized administrative workstations can always reach machines for emergency troubleshooting, enable OverrideBlockRules on an authenticated management rule:

# Allow authenticated management traffic to bypass generic block rules
Get-NetFirewallRule -DisplayName "Admin-Emergency-Access" | 
    Get-NetFirewallSecurityFilter | 
    Set-NetFirewallSecurityFilter -Authentication Required -OverrideBlockRules $True

Traffic matching this rule will bypass any lower-precedence generic inbound block rules, provided it passes cryptographic authentication.

Auditing Authenticated Firewall Rules via PowerShell

To audit all firewall rules on a workstation or server that enforce authentication or encryption, execute the following script:

# Audit all authenticated firewall rules on the system
Get-NetFirewallRule -Direction Inbound | ForEach-Object {
    $Rule = $_
    $SecFilter = $Rule | Get-NetFirewallSecurityFilter
    if ($SecFilter.Authentication -ne "NotRequired" -or $SecFilter.Encryption -ne "NotRequired") {
        [PSCustomObject]@{
            DisplayName        = $Rule.DisplayName
            Enabled            = $Rule.Enabled
            Authentication     = $SecFilter.Authentication
            Encryption         = $SecFilter.Encryption
            OverrideBlockRules = $SecFilter.OverrideBlockRules
        }
    }
} | Format-Table -AutoSize

Troubleshooting Authenticated Firewall Failures

When implementing authenticated firewall rules, keep these essential troubleshooting guidelines in mind:

• Prerequisite Connection Security Rules (IPsec): A firewall rule with -Authentication Required does NOT initiate an IPsec tunnel by itself; it only enforces that traffic must be authenticated. You must have a corresponding IPsec Connection Security Rule (New-NetIPsecRule) configured between the endpoints to perform the IKEv2/AuthIP handshake.
• Clock Skew in Kerberos Authentication: Kerberos machine and user authentication fails if the system clock skew between client, server, and Domain Controller exceeds 5 minutes. Verify NTP time synchronization using w32tm /query /status.
• Auditing Packet Drops in WFP Event Logs: When packets are dropped due to missing IPsec authentication, check the Windows Security Event Log for Event ID 5157 (The Windows Filtering Platform has blocked a connection) and Event ID 4961 (IPsec traffic dropped due to authentication policy mismatch).

Configuring authenticated security filters with Set-NetFirewallSecurityFilter empowers security engineers to build resilient, cryptographically enforced boundaries around critical Windows 11 endpoints.