Windows Firewall Control (WFC) by BiniSoft.org

It is called "Live Grid" and is the cloud component of ESET. Most AVs have something like that.

 

Live grid was off.

 

Software incompatibilities exist, nothing is perfect, but those problems mentioned are usually external to WFC. Two users had problems with WFC and probably another software installed on their computer, some Windows services tweaks, a conflict with another security software that considers WFC a false positive, etc. There may be thousands of reasons and scenarios. However, two users out of a few thousands is nothing new. If I recall, after each update, there were users that had some sort of problems, but this is an exception, while for 99.9% everything went smooth as always. Regarding telemetry connections, maybe you noticed my post 4458 related to this. From my point of view, there are no problems with the current version. But if we ask here, there will be always someone that will find problems, related or even better, unrelated to WFC

 

It's funny how in that thread (as well), people -even staff- keep talking about WFC in combination with the idea of adding/integrating a firewall.

In fact, it reminds me of we were on a break! https://www.youtube.com/watch?v=F8iKoQE35es IT'S NOT A FIREWALL!

 

What are you blabbering about

 

Hi alexandrud, sorry for the late response I've been very busy. This is the change, my standard user account now doesn't have access to the same events as my administrator account. This happened at some point since I updated Windows firewall control, or at least I noticed it since, and now I can't see anything in the WFC connections log as these events are not available to my standard account. I never log in as administrator directly, I only log in as my user account and use the administrator account for elevation; but I'm sure if I did login as administrator I would see the entries in windows firewall control as when I run the windows event viewer as administrator I can see everything in there. When I open event viewer normally as standard user by clicking on it then I have limited access to events (no security events, fewer events in general). So I need to tweak something so I can see everything in event viewer as a standard user as well as administrator, and those changes will be reflected in windows firewall control too. Either that or I need to tweak something so the WFC service has all the required privileges, as since the update it may have lost those privileges and only have my user account privileges for some reason. Please explain further how to do this please? Thanks. Meanwhile I'll try reinstalling it.

 

Hi alexandrud, further update, I tried reinstalling and it did no good. I also logged in directly as administrator and still can't access the connections log through windows firewall, even though I can directly access all event viewer logs. I then went to the profiles in windows firewall (domain, private, public) and tried customising logging to enable logging successful connections as well as dropped connections, but got the error access is denied, unable to set log file name. So if that's a solution that's another problem, how to enable the logging, as maybe the issue is the requisite logs aren't being logged. Do let me know thanks

 

Windows 10 v1809 RS5 (October Update). The WFC v5.3.1.0 Connections log itself has become empty and does not display any events.
Ad
Uninstall v5.3.1.0 with saving rules, install v5.4.0.0 - problem is solved, Connections Log displays events.

 

Works fine here with 5.4; time to update yours...

 

WFC v5.3.1.0 works fine for me on 1809, but I had to uncheck/check the logging to fix the blank connections log

https://www.wilderssecurity.com/thr...-by-binisoft-org.347370/page-185#post-2777288

 

Just asking,
Can someone test it against Atelier Firewall Test?
Comodo firewall(only firewall active), GData, Zonealarm Pro and Fortknox firewall failed miserably.
Old Outpost firewall(only firewall component active) and Spyshelter Firewall passed all.

 

Anyone have any idea why Atelier test download is blocked by FortiNet web filters? Category is malicious websites.



I know how to check the link at the Fortinet site, but Fortinet did the same thing with the download for Fort Knox firewall. Just wondering if anyone has heard anything about Atelier or Fort Knox that would give them any suspicion. Maybe this is simply very zealous protection of downloads from an enterprise security provider, idk...

 

For anyone that have Connections Log empty or if the notifications stopped displaying. Windows 10 v1809 installed through Windows Update will not retain the auditing settings. This means the events for which WFC is looking for will not be logged anymore. To fix this, open the Connections Log, uncheck and check again the Log connections check boxes. This will make WFC to reapply the required auditing settings.

 

Well I'm running Windows 10 version 1607 with WFC v5.4.0.0 and it doesn't work for me... no connections log available its loading the connections log forever... I tried reinstalling and checking and unchecking and neithers any help

 

Thank You!! @alexandrud.

 

Works fine here on 17763.55.

 

@alexandrud Video of notifications not working regrdless of unchecking/checking the boxes.
https://youtu.be/nb95vSxIi0I

 

EDIT: Solved by uninstalling and reinstalling WFC.

 

Nice.
With the 1809 update everything WFC related seemed to stop working. I updated to 5.4, which needed an uninstall of the prior version, and all is well.

 

For problems with WFC log, especially for blocked connections and/or with Win 10 Build 1809 the following could be an alternate way:


Open a command line (CMD) with admin rights ...


1)

- Für deutsche Windows-Version:
auditpol.exe /set /subcategory:"Filterplattformverbindung","Filterplattform: Verworfene Pakete" /success:enable /failure:enable

- For english Windows version:
auditpol.exe /set /subcategory:"Filtering Platform Connection","Filtering Platform Packet Drop" /success:enable /failure:enable


2)

Reboot machine!


PS: Perhaps the "Filterplattform: Verworfene Pakete" // "Filtering Platform Packet Drop" would not be necessary ... I'm not sure about that - however: if you add this, it should not have negative consequences ...

 

So it seems that until there is a release that fixes things, a reasonable recommendation for people would be to backup rules, uninstall, then reinstall WFC after installing the 1809 update. Regardless of which version WFC they had prior to 1809, including the latest. Confirmed by two thus far, that an uninstall and reinstall AFTER having installed 1809 has solved all issues, and just unticking/reticking the boxes didn't work for myself. Also because the steps from Alpengreis may not fix every instance... As in my log window was working fine, I just was no longer receiving any notifications.

tl;dr If you're having any problems with WFC after updating to 1809: Back up your rules, Uninstall WFC, Reinstall, Restore rules, Check settings, See if the problem still exists.

 

A release that fixes things will do the same steps: keeps settings, uninstall, install again. The problem with Windows Updates, especially large ones, is that most of the times they can't keep compatibility with all previous installed programs. Some system settings are reset to their default values, some files are not there anymore, some registry settings are changed, etc.

 

For what's it worth I've updated two computers from 1803 to 1809 and all I had to do was untick and tick again those two boxes to get notifications working again, and even still WFC was still doing its job and blocking stuff.

 

When I do an update to WFC I don't restore rules from backup, I just allow new rules to be created. It's a bit of a pain but a nice clean set of needed rules is refreshing. Also, I have found that WFC will often create a new set of it's own "recommended" rules (which is fine) and I like these at the bottom of my WFC created rules, not in the middle. This is a bit OCD of me but since it is just not possible to adjust the position of rules it's the only way to keep things neat IMO.

 

Question:
If an application uses "dynamic IP address" , how do I create a rule for it?