Windows Firewall Control (WFC) by BiniSoft.org

1. No
2. No
3. No

Nothing at this point.

Correct.

No.

This was with a fresh install of WFC, so it was fresh rules.

No.

As I said earlier, I may revisit this at some point...

 

OK, tried again. This time Firefox was silently blocked = NO NOTIFICATION!!! Definitely a problem with Windows Firewall Control.

Uninstalled again.

 

Notifications work for all of us, but not on your particular setup. This problem is related to your computer only. If you want to help please open the user manual and follow the Troubleshooting section of it. Send me the logs as described there. Off course, if you want my help to find out why the notifications don't work on your computer.

When outbound filtering is enabled in Windows Firewall, Windows Firewall will always silently block programs without an explicit allow rule. WFC just adds support to see when a program is blocked.

 

Dear Mr Developer,

Here's how to reproduce:

Uninstall WFC choosing to restore Windows Firewall to default.

Install fresh and activate.

Enable outbound blocking and sounds.

Now open roughly between a dozen and twenty programs or so allowing each.

Continue until WFC stops notifying.

I couldn't be bothered dealing with it any further. Last few times I tried with my exact same setup on older versions of WFC this never happened.

It was working OK twice with the latest version just recently until for what ever reason it just stops notifying.

 

Personally I couldn't give a rat's what does the blocking, WFC stops notifying.

 

I did the same steps as you did and the notifications didn't stop to appear. After a few minutes, I already had notifications for 15 applications in the list. WFC works as expected on my test machines.

If you don't want to provide the log files then I can't help you.

 

That's fine, but I did say, "roughly between a dozen and twenty programs or so". If you don't want to test I have no further interest in WFC.

Cheers!

 

Maybe you missed this step:

• Continue until WFC stops notifying.

 

Let's not pollute this thread unnecessary anymore. Without the log files from your side there is nothing more to be discussed.

 

Ok.

I don"t have WFC installed so I don't have any logs. I won"t bother with WFC as I don't think it is for me.

All the best!

 

Even with the Windows 10 store allowed and the Windows Update allowed. I am still not getting any notifications and see this message on all apps.

If I disable WFC, then that message goes away. (Turn the profile to Low Filtering lets it work)

Notifications work on everything but I see none when using the store.

 

Please give some examples (URLs, free products preferably) so that I can try them too. I do not use Microsoft Store and there are thousands of apps and the ones that I tried, they worked. Thank you.

 

I found the issue. installagentuserbroker.exe needs access for the store to work and not give the error about Company Policy. I will just let it have temp access when needed.

For some reason, that particular file randomly asks for permission to connect to the internet. It did that a while ago when I was browsing the web in Google Chrome. I had added it to the do not bother me anymore with a notification list. If it keeps up I will just have to add the rule that makes the store work, disable it and put that file back in there to not notify.

 

Thank you for your updated feedback.

 

Thank you for your reply Alexandru, I have read the help article you suggested. It's true that I'm using a couple of applications which most likely act as proxies (e.g. Avast WebShield, GlassWire, VirtualBox, etc.), but it seems to be unlikely the case to me. Are you sure about that? There is a lot of various application which act as proxies, it's pretty standard non-hacky way of processing network traffic in Windows. If Windows Firewall would be incompatible with them it would be pretty completely useless. I would say that almost every Windows user is using at least one application acting as a proxy.

Also, in my case, it's working properly for about 90 % of time. Sometimes I don't have any issue for months, sometimes it's a little bit more frequent. If it would be the incompatibility, it wouldn't work all the time I guess. The same is valid also for custom hosts file and incompatible rules (BTW what exactly does it mean?).

 

I am sure that Avast WebShield doesn't play well with Windows Firewall. It inspects the traffic and the traffic will not reach Windows Firewall anymore. If you have allowed Avast WebShield module, then all programs are allowed since all the traffic will appear to be made by the WebShield not by the original software. When I say incompatible rules, I refer to an allow rule blocked by a block rule that matches the same connections as the allow rule. Or the case when a software needs multiple rules but not all of them are created. For example Windows Mail, it is not enough to allow hxmail.exe. You have to allow svchost.exe too. If svchost.exe is blocked by a rule or the rule for it is disabled, then there is an incompatibility between what you have though to be enough and what is actually needed.

If you have a virtual machine without all of these extra security programs, try WFC in there and see if you still have the same problem. Something external is causing this behavior. If you have an allow rule and it is ignored, then the block is not made by Windows Firewall, even if in Security log a dropped packet is logged, it can be blocked by a different software. Usually, another security software that block certain connections. WFC doesn't block anything for sure. And if you have an allow rule in Windows Firewall, it is not blocked by Windows Firewall neither.

 

Tried once again, same thing!. I am notified for some programs and once again notifications just stop. After a system restart the notifications start again for a while and then stop again.

Yes, does not help.

I cannot find where the logs you want are located.

 

If you mean these, they are also not very helpful.

Code:

Log Name:      WFC
Source:        WFC
Date:          23/09/2017 2:26:52 PM
Event ID:      495
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Dave-PC
Description:
Windows Firewall state was modified from outside of Windows Firewall Control.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="WFC" />
    <EventID Qualifiers="0">495</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-09-23T04:26:52.389135400Z" />
    <EventRecordID>29</EventRecordID>
    <Channel>WFC</Channel>
    <Computer>Dave-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows Firewall state was modified from outside of Windows Firewall Control.</Data>
  </EventData>
</Event>

Code:

Log Name:      WFC
Source:        WFC
Date:          23/09/2017 2:26:52 PM
Event ID:      1610
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Dave-PC
Description:
Policy file was successfully exported.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="WFC" />
    <EventID Qualifiers="0">1610</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-09-23T04:26:52.103878100Z" />
    <EventRecordID>28</EventRecordID>
    <Channel>WFC</Channel>
    <Computer>Dave-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Policy file was successfully exported.</Data>
    <Data>File: C:\Program Files\Windows Firewall Control\restore.wfw</Data>
    <Data>File: C:\Program Files\Windows Firewall Control\restore.wfw</Data>
    <Data>Rules exported: 359</Data>
  </EventData>
</Event>

 

I don't know why it is so hard to reproduce because I'm seeing exactly the same silent blocking after allowing a handful of programs on another machine. I'm really trying to like WFC, but...

Edit: After a system restart the notifications work again... for a while.

 

Hello again, something that seemed strange. I was testing the Secure Rules feature with Driver Booster which adds several firewall rules. The first time everything was ok and I saw the "U - " rules added and disabled. However, when I reopened DB these same rules were automatically enabled. Is this to be expected?

Btw it'd be quite useful if you could implement notifications when a program tries to add rules this way. Thanks.

update: it seems when DB is closed the rules are automatically disabled, and when it's running they are re-enabled. Weird.

 

Firewall newbie here.

What am I missing?

I keep allowing Host Process for Windows Services (svchost.exe) located in C:\Windows\system32\svchost.exe Any Protocol but there is still blocked connections with no notifications.

 

Post here a screenshot of your rule from Rules Panel and a screenshot from Connections Log with those silently blocked connections (make sure that all columns are displayed). Also, check your email.

 

A simple feature request, if possible: could we please get the ability to make a rule temporary after the rule has already been created? For example, when scrolling through the rule panel, right-clicking the rule for example.exe, then on the popup menu, clicking "Make temporary" [submenu] -> "Until WFC restart"

I use the temporary ability quite a bit, but it's only possible when alerts pop up, not on rules that already exist or rules were created via the Windows explorer context menu (right-clicking an .exe and Allowing/Blocking it via Windows Explorer). Thanks!

 

I have the same request.

 

This is already possible, even for multiple rules at once. From the context menu, select Add to group -> Temporary Rules. The same number of mouse clicks are required as your proposed solution