diff --git a/README.md b/README.md
index 428692f..2d0c194 100644
--- a/README.md
+++ b/README.md
@@ -40,4 +40,5 @@
 - [wg_hub](roles/wg_hub/README.md)
 - [wg_spoke](roles/wg_spoke/README.md)
 - [win_chocolatey_install](roles/win_chocolatey_install/README.md)
+- [win_firewall](roles/win_firewall/README.md)
 - [xfs_project_quotas](roles/xfs_project_quotas/README.md)
diff --git a/galaxy.yml b/galaxy.yml
index a346a54..4057d8c 100644
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -1,7 +1,7 @@
 ---
 namespace: genlab
 name: common
-version: 0.36.0
+version: 0.37.0
 readme: README.md
 authors:
   - Alexander Gorelyshev (corvus-migratorius@proton.me)
diff --git a/requirements.yml b/requirements.yml
index 49f723c..54632d6 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -9,3 +9,4 @@ collections:
   - name: lucasheld.uptime_kuma
   - name: maxhoesel.borgbackup
   - name: ansible.windows
+  - name: community.windows
diff --git a/roles/win_firewall/README.md b/roles/win_firewall/README.md
new file mode 100644
index 0000000..9d62993
--- /dev/null
+++ b/roles/win_firewall/README.md
@@ -0,0 +1,58 @@
+win_firewall
+=========
+
+Configure windows hosts as a Spoke in the Wireguard Spoke-and-Hub topology.
+
+Requirements
+------------
+
+None
+
+Role Variables
+--------------
+
+```yaml
+win_firewall_name: name     # Required
+
+# Default variables
+win_firewall_action: allow
+win_firewall_direction: in
+win_firewall_enabled: true
+win_firewall_localip: any
+win_firewall_localport: any
+win_firewall_profiles: domain,private,public
+win_firewall_program: any
+win_firewall_protocol: any
+win_firewall_remoteip: any
+win_firewall_remoteport: any
+win_firewall_service: any
+win_firewall_state: present
+```
+
+Dependencies
+------------
+
+ansible.windows
+community.windows
+
+Example Playbook
+----------------
+
+```yaml
+roles:
+  - role: genlab.common.win_firewall
+    win_firewall_name: Allow port 1234 to 10.0.0.0/24
+    win_firewall_action: allow
+    win_firewall_localport: 1234
+    win_firewall_remoteip: 10.0.0.0/24
+```
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+malyuk.ss@genlab.llc
diff --git a/roles/win_firewall/defaults/main.yml b/roles/win_firewall/defaults/main.yml
new file mode 100644
index 0000000..62b67ab
--- /dev/null
+++ b/roles/win_firewall/defaults/main.yml
@@ -0,0 +1,13 @@
+---
+win_firewall_action: allow
+win_firewall_direction: in
+win_firewall_enabled: true
+win_firewall_localip: any
+win_firewall_localport: any
+win_firewall_profiles: domain,private,public
+win_firewall_program: any
+win_firewall_protocol: any
+win_firewall_remoteip: any
+win_firewall_remoteport: any
+win_firewall_service: any
+win_firewall_state: present
diff --git a/roles/win_firewall/handlers/main.yml b/roles/win_firewall/handlers/main.yml
new file mode 100644
index 0000000..ed97d53
--- /dev/null
+++ b/roles/win_firewall/handlers/main.yml
@@ -0,0 +1 @@
+---
diff --git a/roles/win_firewall/meta/main.yml b/roles/win_firewall/meta/main.yml
new file mode 100644
index 0000000..5f9c8ad
--- /dev/null
+++ b/roles/win_firewall/meta/main.yml
@@ -0,0 +1,16 @@
+---
+galaxy_info:
+  role_name: "win_firewall"
+  namespace: genlab
+  author: "Sergey Malyuk"
+  company: "Genlab, LLC"
+  description: "Configures clean windows firewall"
+  license: "MIT"
+  min_ansible_version: "2.16"
+
+  platforms:
+    - name: "Windows"
+
+  galaxy_tags: []
+
+dependencies: []
diff --git a/roles/win_firewall/molecule/default/converge.yml b/roles/win_firewall/molecule/default/converge.yml
new file mode 100644
index 0000000..f6f0e46
--- /dev/null
+++ b/roles/win_firewall/molecule/default/converge.yml
@@ -0,0 +1,9 @@
+---
+- name: Converge
+  hosts: all
+  pre_tasks:
+    # Blank task for ignoring CI testing
+    # This role was tested manually
+    - name: Blank
+      ansible.builtin.command: echo
+      changed_when: false
diff --git a/roles/win_firewall/molecule/default/molecule.yml b/roles/win_firewall/molecule/default/molecule.yml
new file mode 100644
index 0000000..de54042
--- /dev/null
+++ b/roles/win_firewall/molecule/default/molecule.yml
@@ -0,0 +1,22 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-ubuntu2204-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+provisioner:
+  name: ansible
+verifier:
+  name: ansible
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .
diff --git a/roles/win_firewall/molecule/default/verify.yml b/roles/win_firewall/molecule/default/verify.yml
new file mode 100644
index 0000000..da5d2ff
--- /dev/null
+++ b/roles/win_firewall/molecule/default/verify.yml
@@ -0,0 +1,11 @@
+---
+
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+    # Blank task for ignoring CI testing
+    # This role was tested manually
+    - name: Blank
+      ansible.builtin.command: echo
+      changed_when: false
diff --git a/roles/win_firewall/tasks/main.yml b/roles/win_firewall/tasks/main.yml
new file mode 100644
index 0000000..d47bc64
--- /dev/null
+++ b/roles/win_firewall/tasks/main.yml
@@ -0,0 +1,50 @@
+---
+- name: Print out rule name for convenient debugging
+  ansible.builtin.debug:
+    msg: "{{ win_firewall_name }}"
+
+- name: Check if firewall is configured
+  block:
+    - name: Get firewall flag stat
+      ansible.windows.win_stat:
+        path: C:\firewall.flag
+      register: win_firewall_firewall_flag
+
+    - name: Assert that firewall.flag exists
+      ansible.builtin.assert:
+        that: win_firewall_firewall_flag.stat.exists
+        success_msg: "firewall.flag exists"
+        fail_msg: "firewall.flag DOES NOT exist"
+
+  rescue:
+    - name: Disable Windows Firewall
+      ansible.windows.win_firewall:
+        state: disabled
+
+    - name: Delete all firewall rules
+      ansible.windows.win_shell: netsh advfirewall firewall delete rule name=all
+
+    - name: Create firewall.flag
+      ansible.windows.win_file:
+        path: C:\firewall.flag
+        state: touch
+
+- name: Create firewall rule
+  community.windows.win_firewall_rule:
+    name: "{{ win_firewall_name }}"
+    action: "{{ win_firewall_action }}"
+    direction: "{{ win_firewall_direction }}"
+    enabled: "{{ win_firewall_enabled }}"
+    localip: "{{ win_firewall_localip }}"
+    localport: "{{ win_firewall_localport }}"
+    profiles: "{{ win_firewall_profiles }}"
+    program: "{{ win_firewall_program }}"
+    protocol: "{{ win_firewall_protocol }}"
+    remoteip: "{{ win_firewall_remoteip }}"
+    remoteport: "{{ win_firewall_remoteport }}"
+    service: "{{ win_firewall_service }}"
+    state: "{{ win_firewall_state }}"
+
+- name: Enable Windows Firewall
+  ansible.windows.win_firewall:
+    state: enabled
diff --git a/roles/win_firewall/vars/main.yml b/roles/win_firewall/vars/main.yml
new file mode 100644
index 0000000..ed97d53
--- /dev/null
+++ b/roles/win_firewall/vars/main.yml
@@ -0,0 +1 @@
+---