This is long winded so for those who just want to get to the point.. I have 2 issues
1) How can I determine what is being blocked by Windows Firewall's outbound rules so that I can create an allow rule?
2) How can I prevent a program from using an allowed program (like IE) to access the internet?
Now.... the things I love about the new Windows FireWall....
I am trying to stick with MS products since my computer runs so much smoother and faster than when running 3rd party Protection software. But there is a problem that I just can't seem to figure out and before I give up on MS products, I thought I'd ask.
Briefly put, I am a firm believer in completely turning off ALL inbound and outbound communication. I then open up only the ports I need, for the protocols I need, for the Applications that need them.
I will say that the approach that WF has taken is outstanding! All my dreams come true because I think it works the way it should... Block EVERYTHING unless I make a rule otherwise. This is so much cleaner.
To hit that point home, lets say that you want IE to be able to browse the web. But you want your Print Spooler to only have access to your network printer. For most firewalls you have to
1) Create a general rule that allows TCP traffic out on port 80 (HTTP),443 (HTTPS), and port 515 (Print Spooler)
2) You then have to go into your Application rules to block IE from using port 515 and the Print Spooler to block port 80 and 443.
... this can get messy real quick.
Instead, for WF, you just need to
1) Create a rule for IE and give it access to 80,443.
2) Create a rule for spoolsvc and give it access to 515
DONE!
....... NOW FOR THE PROBLEM AT HAND .........
If I can not figure out a solution to these 2 items, I'm going to have to toss WF out the windows (pun intended) and go back to a 3rd party.
1) Whenever you perform a task that you actually WANT to get out to the internet, initially it will be blocked. Normally you then just look at the Firewall log and it will tell you what application is attempting to access what Address on which port using which protocol... you can then just create your rule..... The Log for WF is terrible and only shows you a dropped packette. It does not tell you what was trying to use the internet and therefore there is no way you can make a rule...
For example, if I had not known that to print I needed to allow spoolsvc.exe access to xxx.xxx.xxx.50, TCP port 515 I would have never been able to determine that using the WF logs.
2) The one big flaw of WF is its lack of leak testing. (Zone Alarm is the only one I know that catches the following). Say I have a program that does not access the internet directly (which is blocked by default with Outbound set to BLOCK). Instead it launches IE and passes it a URL with the info. All the other firewalls I have tested allow this to happen.
For example, CCleaner is a great program and I trust it. However it has no business accessing the internet. However there is a link that says "check for updates" and when you click on this, it auto opens IE, takes you to the vendors website where it passes along the program version.
This could just have easily been a spyware program passing off data that it has collected... Sure you see IE open up but by then it is too late...you data has been collected. (Like I said, Zone alarm is the only firewall I've seen that blocks this)
1) How can I determine what is being blocked by Windows Firewall's outbound rules so that I can create an allow rule?
2) How can I prevent a program from using an allowed program (like IE) to access the internet?
Now.... the things I love about the new Windows FireWall....
I am trying to stick with MS products since my computer runs so much smoother and faster than when running 3rd party Protection software. But there is a problem that I just can't seem to figure out and before I give up on MS products, I thought I'd ask.
Briefly put, I am a firm believer in completely turning off ALL inbound and outbound communication. I then open up only the ports I need, for the protocols I need, for the Applications that need them.
I will say that the approach that WF has taken is outstanding! All my dreams come true because I think it works the way it should... Block EVERYTHING unless I make a rule otherwise. This is so much cleaner.
To hit that point home, lets say that you want IE to be able to browse the web. But you want your Print Spooler to only have access to your network printer. For most firewalls you have to
1) Create a general rule that allows TCP traffic out on port 80 (HTTP),443 (HTTPS), and port 515 (Print Spooler)
2) You then have to go into your Application rules to block IE from using port 515 and the Print Spooler to block port 80 and 443.
... this can get messy real quick.
Instead, for WF, you just need to
1) Create a rule for IE and give it access to 80,443.
2) Create a rule for spoolsvc and give it access to 515
DONE!
....... NOW FOR THE PROBLEM AT HAND .........
If I can not figure out a solution to these 2 items, I'm going to have to toss WF out the windows (pun intended) and go back to a 3rd party.
1) Whenever you perform a task that you actually WANT to get out to the internet, initially it will be blocked. Normally you then just look at the Firewall log and it will tell you what application is attempting to access what Address on which port using which protocol... you can then just create your rule..... The Log for WF is terrible and only shows you a dropped packette. It does not tell you what was trying to use the internet and therefore there is no way you can make a rule...
For example, if I had not known that to print I needed to allow spoolsvc.exe access to xxx.xxx.xxx.50, TCP port 515 I would have never been able to determine that using the WF logs.
2) The one big flaw of WF is its lack of leak testing. (Zone Alarm is the only one I know that catches the following). Say I have a program that does not access the internet directly (which is blocked by default with Outbound set to BLOCK). Instead it launches IE and passes it a URL with the info. All the other firewalls I have tested allow this to happen.
For example, CCleaner is a great program and I trust it. However it has no business accessing the internet. However there is a link that says "check for updates" and when you click on this, it auto opens IE, takes you to the vendors website where it passes along the program version.
This could just have easily been a spyware program passing off data that it has collected... Sure you see IE open up but by then it is too late...you data has been collected. (Like I said, Zone alarm is the only firewall I've seen that blocks this)
My Computer
- OS
- Windows 7 Pro
