Windows 10: HOW DO I KNOW WHICH IS THE RELEVANT RULE TO VIEW THE LOGGING SETTINGS INBOUND OR...

HOW DO I KNOW WHICH IS THE RELEVANT RULE TO VIEW THE LOGGING SETTING INBOUND OR OUTBOUND; I SUSPECT SOMEONE MAY HAVE TAKEN OVER MY COMPUTER. I'M NOT A TECH SO I NEED CLEAR/EZ HELP. I ACCESSED THIS THRU THE CONTROL PANEL.THANK YOUMIMI V.

:)

 

Inbound Rules Closing Out

So, every time I try to open the inbound rules window, for the windows firewall, the inbound rules windows just closes out. What can I do to solve this?

 

Inbound Firewall Rule that Blocks

Code:

Please help me understand how the 2 Inbound Rules created by MMC actually operate.

Action, Enabled, Service, Program,                     Protocol

Block,  Yes,     Any,     C:\windows\system32\mmc.exe, TCP

Block,  Yes,     Any,     C:\windows\system32\mmc.exe, UDP
If these 2 rules were Outbound Rules, I'd say that client process 'mmc.exe' is blocked.

But applying equivalent logic (that 'mmc.exe' is blocked) to Inbound Rules doesn't make sense -- why would 'mmc.exe' (which created these Rules) block itself?

What (somewhat) makes sense is that 'mmc.exe' is a requester, and that these rules block all TCP & UDP datagrams & all processes.

If so, then there's quite a difference between Outbound & Inbound Rules.

In Outbound Rules, 'Program' specifies the target (the process that's blocked), whereas in Inbound Rules, 'Program' specifies the requester (the process that provokes blocking).

This is crucial reasoning because, if correct, then, as a consequence, every process is the target of Inbound Rules that Block.

What about Inbound Rules that Allow? I've always assumed that an Inbound+Allow means the specified 'Program' installs a listener (i.e., has handler(s) for the specified socket(s)).

I think that's pretty straightforward.

I've read what Microsoft provides and it's grossly inadequate -- what a surprise, eh?

Microsoft documentation presents only trivial explanation of how to complete the fields (example: "Type the path to the program in the text box"), or the tutorial's scope is limited (example: "On the Action page, select Allow the connection, and then click
 Next" -- no mention of "Block the connection").

Other web hits are just plain wrong (examples: "Program – Block or allow a program"; "Program - creates rule that controls connections for an app or program"; "if you are downloading a file through BitTorrent, the download of that file is filtered through an
 inbound rule" -- Rules control connections, not streams) or show ridiculous cases (example: "I want to block all outgoing connections on port 80").
Does anyone know of an architectural reference or guidebook that explains how Firewall Rules are implemented in a running system?
Warm Regards -- Mark.

 

Docker on Windows 10. Is it an Inbound Rule or Outbound Rule?

First, you can see your network location by network and sharing center.





Then you can set rules to open tcp port 445 as following steps.

1. Right click Inbound rules, click New
   
2. Click Custom
   
3. In the new Window, select All programs, type the specified program path, or Services
   
4. Then you can select tcp port 445 in Local port and Remote port, you can use any
   
5. Then select Ip Scope as your requirements, you can use both any Ip address and any Ip daress
   
6. Select Allow the Connection or Allow the connection if it is secure
   
7. Select your profile, you can choose your current profile(As we see at the beginning), or select all
   
8. Then type the rule name(This is dependent on yourself)
   
9. After setting inbound rule, take the same action to create a outbound rule.