Windows XP Default Inbound Firewall Rules

Windows XP fundamentally reshaped desktop network security, transitioning from an unprotected environment in its initial release to a strict, stateful inbound filtering model with Service Pack 2. This article details the default inbound traffic rules implemented in Windows XP, contrasting the early Internet Connection Firewall with the revised Windows Firewall architecture.

Windows XP RTM and Service Pack 1: Internet Connection Firewall (ICF)

In the original release of Windows XP (RTM) and Service Pack 1 (SP1), the native firewall was known as the Internet Connection Firewall (ICF).

  • State by Default: ICF was completely disabled by default on all network interfaces. Inbound traffic faced no firewall filtering unless a user or administrator manually enabled the feature.
  • Inbound Rules When Enabled: Once turned on, ICF enforced a strict stateful rule: all unsolicited inbound traffic was dropped. Only inbound packets that matched an existing, established outbound connection state were permitted.
  • Exceptions: No service exceptions (such as File and Printer Sharing or Remote Desktop) were open by default. ICMP echo requests (pings) were completely blocked.

Windows XP Service Pack 2 and Service Pack 3: Windows Firewall

Service Pack 2 (SP2) introduced a major overhaul, rebranding ICF to Windows Firewall and enforcing security-by-default principles across the operating system.

  • Default Operational State: Windows Firewall was turned On by default for all network adapters, including local area connections, wireless networks, and dial-up/VPN interfaces.
  • Default Inbound Policy (Block Unsolicited Traffic): The fundamental rule for all inbound traffic was an implicit "Deny All." Any packet arriving at the network interface that did not correspond to an existing outbound connection was silently discarded.
  • Stateful Filtering: Inbound responses to client-initiated outbound requests (such as web browsing via HTTP/HTTPS, DNS queries, or DHCP lease requests) were automatically allowed through dynamic port tracking.
  • Default Port Exceptions: In a standard clean installation of Windows XP SP2 or SP3, all listening service exceptions were disabled by default:
    • File and Printer Sharing (Ports 137, 138, 139, and 445): Blocked by default.
    • Remote Desktop (Port 3389): Blocked by default.
    • Remote Assistance: Allowed by default only if an invitation was actively generated by the user, utilizing dynamic port allocation.
    • Universal Plug and Play (UPnP) framework: Blocked by default.
  • ICMP (Ping) Rules: By default, all incoming ICMP traffic was blocked. The firewall dropped incoming Echo Requests (ICMP Type 8), meaning a default Windows XP SP2/SP3 machine would not respond to network ping commands from other devices.
  • Scope Restrictions: When users subsequently enabled an exception (such as File and Printer Sharing through the Network Setup Wizard), the firewall applied a restricted scope rule by default: traffic was only permitted from the local subnet rather than from any IP address on the wider internet.