Windows 10: Firewall rule doesn't work

Hi,


my default setting for the firewall is to block all traffic. Exceptions are added if necessary. This strategy will not be changed for there is no clarity regarding all the traffic going on. For instance, two exceptions enable DNS and DHCP. This works well. Another one is svchost, service="Cryptographic services" (CryptSvc). The latter does not work. This means, the firewall still blocks these packets. I have verified my rule multiple times, even removed it and added it again.


As the normal firewall log file isn't speaking enough, I have enabled logging of dropped packets in the event log via group policies. I wrote a little program for live observation of these log entries. Thereby, I am able to lookup the services from the logged process ID.





The firewall rule exactly matches this case. Consequently, the packet should not be blocked. The rule is: Allow, Outgoing, program=svchost, service=CryptSvc, all profiles, all local ports, all IPs, protocol TCP, remote ports 80 and 443.


So my question is: Why does the firewall block packets even if a rule allows them? (There is no other rule denying it)


Win 10 x64 Pro


Thanks

:)

 

Windows 10 Firewall won't keep my inbound/outbound rules

Hi,

I realize the inconvenience caused to you regarding the Windows Firewall. I will certainly assist you.

I suggest you to restart the Windows firewall service and check if it helps.

Follow the below steps for the same.

• Press Windows key + R simultaneously for Run.
• Type services.msc and then Enter.
• Right click on the Windows firewall services and then restart the services and check if it helps.

If the issue still persists then I suggest you to remove and then read the Windows fire wall rule.

Hope this information is helpful. Please get back to us with the information required, if you need further assistance, we’ll be glad to assist you.

 

firewall rule to block addresses NOT on an IP list?


I am just starting to learn the Windows Firewall (working on both Windows 7 and 10) and I'm not impressed with the inflexibility of its rules. I would like to know if


1. Is there is a way to do what I want with Windows Firewall?
2. Is there is a third-party firewall that would do it?


What I want to do is create a rule that blocks outgoing connections, for program X, that are to a destination **NOT** in an IP list.


Windows Firewall is not very flexible in how you specify IP list rules. When you give an IP list, your rule will match that list... you can't say "trigger the rule for non-matching IP addresses." Therefore to allow outgoing connections to a list, you have to


1. Change the entire firewall policy to block outgoing connections by default so that you can create an "allow rule" matching your list. This will mess up the rest of your programs.


2. Somehow combine a block rule and allow rule. Create a block rule for most traffic, with the "allow" rule overriding it when appropriate. However, this doesn't appear to be possible in general. It **may** be possible for connections that use IPSec, I'm not sure. And I'm not sure if I can use IPSec in my application.

And is there a third-party firewall that can do it? Most 3rd-party firewalls are LESS sophisticated than Windows Firewall, because the use case they are addressing is providing an interface that doesn't require much comprehension. I need one that's actually MORE sophisticated than Windows Firewall.

 

Windows Firewall: Doesn't show blocking rules

Hello!

Today I've blocked all connections of a program by creating a outbound rule in Windows Firewall. However, I now wish to remove it. The problem: I can't find that newly created rule anywhere in the list. The rule does take an effect, since deactivating the
Firewall lets the program run properly. I can only see rules in the list that "allow" stuff, but not those who block things.

What I have tried so far:

- All filters set to "Show all" within the Firewall

- Created the same rule again, doesn't show up

- Created a rule that allows the program, shows up

Any solutions?