Windows Firewall Control (WFC) by BiniSoft.org

Thanks WFC maker. High time to brush up on it again. Another duh question but with the new recently released 6.5 is there anything that you would officially suggest other than what others and yourself have mentioned when installing WFC in Windows 10 anew.

 

I might not be the right person to answer this. Below are all my rules:



Notifications are disabled, Secure Rules enabled, Medium Filtering profile. Windows Update rule enabled once a month when I remember to check for Windows Updates. Everything else silently blocked. Each person with his own needs.

 

Well, it would still be nice to show what domain name the program is connecting to like Notepad++ is doing in my attached screen shot/capture. When I look at its IP address, I wouldn't know if that would be NPP's server from its whois feature (Cloudflare). In other older software firewalls (e.g., PC Tools Firewall Plus v7) in older Windows versions, they would tell me the domain name and its IP address it is trying to connect to.

 

This is not a good example. In this screenshot:

it is Notepad++ itself that is making the connection to a specific domain and if that connection fails it displays that it could not connect to it. It does not resolve an IP address to a domain name.

In older Windows versions, those firewalls used to have their own drivers. This means they could intercept your network packets from start to end. You enter yahoo.com in your browser, you initiate a connection to that domain, that driver knows about this request and can show a notification about yahoo.com. Back to WFC, it works in a passive way. It has access to limited data which is logged in the Security event log by Windows Firewall. Without inspecting network traffic, there is no way for WFC to display the domain name from an IP address. An IP address can host hundreds of websites.

 

You are right, PH can display it when running as admin with the driver loaded, but it is not really worth the risk of being hijacked, it is OK for temporarily inspecting the traffic, but that is it.

I thought it too at first, but the domain name does not really say much, besides the IP can be different based on the region you are in, when in EU, you will get EU servers, etc.
Fox example my cloud software connects to 46.165.242.15, but thanks to ipnetinfo I know, it can use the IP range 46.165.240.0-46.165.247.255, so I add that to the firewall.

 

Hello, this is my first message here.
I am asking for your help please, I am totally n00b to networking...
I have set the WFC recommended rules and deleted all the previous ones.
I am using a regular internet connection at home without any private network.
I still get notifications about two Windows services (svchost.exe) from time to time : DNS Client, DHCP Server.
What would you recommend about these two services :
- setting up rules ? which ones ? I have tried some with no success (sometime blocking the whole traffic)
- adding svchost.exe to ignore list ? (that would make me unable to further set a rule of other Windows services)
- other ?

Same question with SYSTEM, I also get random notifications about it (Protocol : IGMP).
Thank you for your help guys

 

DNS Client is fairly easy, just setup your DNS servers IPs and UDP port 53 outbound, that should do.
DHCP is similar, you need to allow ports 67/68 in some fashion, I have simply setup static IP address.

Svchost.exe is a pain to setup, but once done, it just works, with occasional prompts.

You can block it altogether, unless your app really needs ping.

https://www.bleepingcomputer.com/ne...k-malware-uses-icmp-for-covert-communication/

 

@alexandrud
hi
with notifications are on and customize this rule before creating it , could be added ip range?
first screenshot
thanks
https://www.binisoft.org/images/pic2.png

 

@alexandrud - Its useful enough template to my suiting and I wish you happiness and success

 

You can add an IP-range using the correct syntax for the separation of addresses when the red backlight of the IP string will change to the green.

 

hi @aldist
is there a screenshot how add an ip-range?
and are there some rules set that can be shared made to make windows more secure ?
thanks

 

You can add it directly to the notification or by editing the existing rule, but it requires a surgical precision, the box is so tiny. It would be better if people could add IPs or IP angles per line.

Limit windows processes, like svchost.exe, often used by malware. Limiting it per IP ranges might seem difficult, but there are only handful of them. For example my location produced those, they can be also used by MS apps, store, etc.

Code:

2.19.32.0-2.19.47.255,2.20.20.0-2.20.23.255,2.23.0.0-2.23.15.255,2.23.96.0-2.23.111.255,13.64.0.0-13.107.255.255,20.33.0.0-20.128.255.255,20.180.0.0-20.191.255.255,23.192.0.0-23.223.255.255,23.32.0.0-23.67.255.255,40.64.0.0-40.71.255.255,40.74.0.0-40.125.127.255,40.126.0.0-40.126.63.255,51.10.0.0-51.13.255.255,51.103.0.0-51.105.255.255,52.132.0.0-52.143.255.255,52.145.0.0-52.191.255.255,52.224.0.0-52.255.255.255,104.64.0.0-104.127.255.255

 

@TairikuOkami
hi
in short to block a range is enough 140.120.54.0-140.120.54.255
to block all the ip 140.120.54.x ?
thanks

 

@mantra

the developer @alexandrud posted a well written, easy to follow guide:

Windows Firewall Control (WFC) by BiniSoft.org

 

Yes, right. And if you need access to the address 140.120.54.121 from this range, then the deny rule must contain two sub-ranges
140.120.54.0-140.120.54.120,140.120.54.122-140.120.54.255
As you can see 140.120.54.121 is excluded from these ranges.

@alexandrud
What is your opinion whether it is necessary to make a column with row numbering like 1, 2, 3 ... 26 ... etc. in the rules panel? This will greatly facilitate user navigation in the rules, since the line number is easy to remember.

 

I can add a row numbering but I can't ensure the same number for a specific rule. An index property does not exist among other properties of a rule. Once you delete a rule, other rules will change the index. Since there is no order of processing the rules, a column with a random numbering from 1 to X doesn't seem very useful.

 

Yes of course. This is just the ordinal number of the line, it is not rigidly tied to a specific rule. There was rule # 56 for Firefox, if you remove any rule above, the rule for Firefox gets # 55 ... and so on.

 

I've got an issue with Secure Boot and an Asus Z590 motherboard. When I change the profile from high filtering (Secure Boot) to medium filtering my Ethernet adapter/connection is not restored. What could be the problem?

 

Not related with your motherboard. Check in Rules Panel if those two block all firewall rules that are created when High Filtering profile is set are removed when you set back Medium Filtering profile. Secure Boot only sets High filtering profile when a system shutdown event is detected.

 

Maybe your network adapter is in the off state? The firewall rules will not enable it.

 

DHCP assigns IP at boot, so maybe the timeout period is too long or just something has gone wrong. Check: ipconfig /all

 

"Those two"? Which two?

 

Set High Filtering profile and open Rules Panel. You will notice two new rules which block all inbound and outbound connections. Those two.

 

When the High Filtering profile is enabled or when booting with the Secure Boot option enabled, WFC creates two global deny rules and there is no internet access for everyone.

When the Medium Filtering profile is enabled, these rules are removed and Internet access appears.

Even with svchost.exe completely blocked, the IP address is assigned after exactly 16 seconds

 

Yes the two rules are removed when I switch from high filtering to medium filtering. I will turn on Secure Boot again and see what the two rules are doing on an actual clean boot. That's where I was having issues.