Windows 10: windows 10 1803 - How to prevent programs to create inbound rules in firewall

Hello,


I'm using windows 10 1803 and I have a problem : some programs create automatically inbound rules in windows firewall at startup.


How to prevent this incredible and incomprehensible possibility ?

for example ccleaner, steam, etc.


I use local policy but it dont prevent thoses tasks to create rules....

thanks for your help

:)

 

Inbound Firewall Rule that Blocks

Please help me understand how the 2 Inbound Rules created by MMC actually operate.

Action, Enabled, Service, Program, Protocol

Block, Yes, Any, C:\windows\system32\mmc.exe, TCP

Block, Yes, Any, C:\windows\system32\mmc.exe, UDP

If these 2 rules were Outbound Rules, I'd say that client process 'mmc.exe' is blocked.

But applying equivalent logic (that 'mmc.exe' is blocked) to Inbound Rules doesn't make sense -- why would 'mmc.exe' (which created these Rules) block itself?

What (somewhat) makes sense is that 'mmc.exe' is a requester, and that these rules block all TCP & UDP datagrams & all processes.

If so, then there's quite a difference between Outbound & Inbound Rules.

In Outbound Rules, 'Program' specifies the target (the process that's blocked), whereas in Inbound Rules, 'Program' specifies the requester (the process that provokes blocking).

This is crucial reasoning because, if correct, then, as a consequence, every process is the target of Inbound Rules that Block.

What about Inbound Rules that Allow? I've always assumed that an Inbound+Allow means the specified 'Program' installs a listener (i.e., has handler(s) for the specified socket(s)).

I think that's pretty straightforward.

I've read what Microsoft provides and it's grossly inadequate -- what a surprise, eh?

Microsoft documentation presents only trivial explanation of how to complete the fields (example: "Type the path to the program in the text box"), or the tutorial's scope is limited (example: "On the Action page, select Allow the connection, and then click
Next" -- no mention of "Block the connection").

Other web hits are just plain wrong (examples: "Program – Block or allow a program"; "Program - creates rule that controls connections for an app or program"; "if you are downloading a file through BitTorrent, the download of that file is filtered through an
inbound rule" -- Rules control connections, not streams) or show ridiculous cases (example: "I want to block all outgoing connections on port 80").

Does anyone know of an architectural reference or guidebook that explains how Firewall Rules are implemented in a running system?

Warm Regards -- Mark.

 

Firewall no longer allowing "Allowed" program on Inbound Rule

Using Windows 10 and trying to allow a program to access my computer remotely through a specified port.

This used to work by allowing it in the firewall settings and turning on both public and private firewalls.

Now I have to turn off the public firewall to allow it to access my computer remotely even though it is in the inbound rules list with :

Profile: Private, Public

Enabled: Yes

Action: Allow:

Program: [path to program]

Everything else : any

This allowing used to work but now it doesn't.

 

Windows Firewall Forgetting Rules

I've recently installed the latest version of Windows 10 in my PC. I've blocked and allowed some softwares in Windows Firewall. But Firewall keeps forgetting the rules in 1/2 days. For example, I've allowed Pro Evolution Soccer 2016 in Firewall. But in a
few days, when I open the game, firewall sends message asking if I want to allow that app or not. Then after checking the allowed apps, I do not see that game in the list, which means firewall didn't remember the settings.

Also, I blocked KMPlayer in firewall to prevent it from connecting to internet (it shows too much ads otherwise). So, I created inbound and outbound rules for KMPlayer and blocked the connection. After that, it was all okay for two days, then again it started
showing ads, and then checking the rules, I didn't notice the rules there which I created two days ago. And this thing keeps happening. I make the inbound and outbound rules for KMPlayer, it stays all okay for a few days, and then it forgets again.

So, what is wrong with the firewall and what is the solution of it?

[Moved from: Windows / Windows 10 / Windows settings]