Five Ways to Not Firewall a Windows Container (and the One That Works)

Sat, 22 Aug 2026 19:40:00 -0700

ephemerd runs CI jobs from pull requests. One of the rules is that a job can reach the internet but not my LAN. On Linux that’s a few iptables rules in the FORWARD path, and I didn’t think about it much. On Windows I spent about a week finding out how many ways there are to write a firewall rule that Windows accepts, lists and never applies.

The setup is Windows Server 2025 (build 26100) with job containers running under Hyper-V isolation. They sit on the default HNS NAT network that every Windows container tutorial uses. In ephemerd’s case that’s 10.88.0.0/16 with gateway 10.88.0.1. The target is the same as Linux. Block 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 169.254.0.0/16, and allow everything else.

Hns on Luther Monson

Five Ways to Not Firewall a Windows Container (and the One That Works)