Windows Firewall Control (WFC) by BiniSoft.org

I can't figure something out. I'm using a vpn. Whenever I go through their network my Rules are deleted. However, when I disengage the Rules are populated again. However, NOT always.
Sometimes I have to restore my saved Rules because they get deleted. Can you help me with this please. What am I doing wrong?
Thank you

 

Which rules are deleted ? The rules related to the VPN software or random rules from your rules list ? There are software vendors that will automatically create rules for their software to ensure compatibility in case the users are using Windows Firewall. These rules are then removed by the same software when the program is closed down. Can you check with your VPN software if this is the case ? Make sure that you disable Secure Rules feature from WFC. In this way you will be sure that WFC does not delete any of your rules.

WFC deletes Windows Firewall rules only if:
1. Secure Rules is enabled and a new rule is not created through WFC. A rule created from outside of WFC when Secure Rules is enabled, is considered unauthorized.
2. The user defines a temporary rule from the WFC notification dialog and this rule expired. Such rules will be deleted by WFC, but this kind of rules can be defined only with WFC because this concept has no meaning outside of WFC.

If you are not in the scenarios described above, then you must find the source elsewhere.

 

Thank you for your response. I'm going to have to experiment a bit.

 

It might make your job easier if you use the Connections Log. For example, remove all VPN rules, and then try to connect. Every time it bounces back, it will report in Connections Log. Then you can right click the rule, and select Customise and Create.

If your VPN pushes its own DNS addresses, you will need to duplicate the Core Networking - DNS (UDP Out) rule, disable the original and populate the duplicated version with VPN DNS addresses. <---- This assumes you are denying internet access till VPN connects. If not, please disregard.

 

Sorry, I forgot to mention that I already had this enabled from the beginning. And those rules are definitely in my list, and enabled, allowed, and inbound. Interestingly, I found a new piece to this mystery today. Like I said, on Medium filter nothing connects via RDP. I tried setting it to low filter, which as long there's no block rule for RDP, it should let it through. But no luck. I have to disable the firewall completely for RDP to connect.

 

You don't have to disable the firewall. When it fails to connect, please consult the Connections Log on the remote machine where the connection is refused. Check the recently blocked inbound connections. You must see there what was blocked when you tried to connect and you will make an idea what rule is missing.

 

Here are some pictures to help illustrate:

Exhibit A: The rules defined on the remote client. All I did here was open the rules and filter it by port 3389. Notice how some rules are duplicated, so I think I have all my bases covered.

http://s17.postimg.org/gywaynjcf/Client_rules.png

Exhibit B: The inbound connections blocked on the remote client. I just filtered the list to see the connections originating from the local server initiating the RDP session. Notice that port 3389 is still blocked, despite all the rules I have enabled. Those rules are not just the auto-generated ones. They are also a result of me right clicking the blocked connection, and creating a rule straight from the blocked list.

http://s15.postimg.org/fu6p8yq2j/Client_blocked.png

Exhibit C: To be thorough, here's a list of blocked outbound connections from the local server, no filtering. The time stamps show that these two items were blocked after the RDP session was attempted, so I don't think they're relevant.

http://s16.postimg.org/nxso2e5r9/server_outbound.png

Hopefully this helps you understand my predicament. A side note, you also see ports 137, 5355 blocked, but I have similar rules allowing those ports.

 

@ alexandrud

Perhaps a bit of a dumb question but does (or can) WFC protect against "low-level network access"?

http://www.outpostfirewall.com/forum/showthread.php?25459-How-does-low-level-network-access-work

 

Did you disable any core networking rules ? Try this. Make a backup of your rules and then restore Windows Firewall default set of rules. Make sure that you create these remote desktop rules and then try again with Medium Filtering profile.

I think the following statement will answer your question: "WFC doesn't do any packet filtering".

 

any solution to this yet? i only have 3.35 MB hosts file but it works best when DNS is disabled.

 

Do you experience the same delay when using your hosts file ? Please send your hosts file to support@binisoft.org and I will make some tests. That post is almost one year old and I never received a large hosts file, so I thought that the problem is not a problem anymore because I didn't receive any more feedback regarding this matter.

 

no, i'm still on WinXP but i'm going to migrate over to Win7 soon and was hoping to try your program. as mentioned earlier in the thread there is a free program called HostsMan by Abelhadigital that downloads free hosts files and would be better than my sending hosts file to you.

 

I'm sorry, but I'm not exactly an expert when it comes to firewalls, so could you explain a bit more?

 

lol... you are mistaking WFC for W7F, and to an extent, W7FwAS. What you should be doing is asking Microsoft if W7F can protect against "low-level network access", not WFC. WFC is not the firewall, W7F is.

I am pretty sure you won't get far since they are barring up over W10, hence your best bet is to frequent your usual nerd forums and ask a Windows Guru.

 

I followed your directions to a tee. I backed up my rules, then restored Windows Firewall default set of rules (it erased all mine but not the backup file). I then set the filter to Medium, and typed this on the local server "telnet 192.168.1.106 3389". No connection. I went to the remote client, and looked at the blocked connections log. I found several port 3389 attempts blocked. I right clicked one, and customized it to allow for any remote port, local port 3389, and the same remote and local ip address. I selected Allow, and Inbound was selected too.

I ran the telnet command again on the local server, but the connection wouldn't go through. I checked on the remote client again for blocked connections, and there they were, port 3389 blocked just as if I hadn't allowed any rules for it.

 

What other security software do you use on this machine ? Avast, Avira, KAV, etc ? From your description (allow rules exist, but the connections are still blocked) it seems that Windows Firewall does not work correctly. This usually happens when a software proxy is used for filtering purposes. In this case the filtering is done at software proxy level, not at Windows Firewall level, making Windows Firewall rules useless.

 

Yes, now that I think of it, this is more of a HIPS than a firewall feature. But I didn't understand alexandrud's response, I don't see how this has got anything to do with packet filtering?

 

The answer is no. WFC can't provide the functionality that you were talking about, because WFC does not inspect any data packet and does not use any filtering driver. It can't prevent something that is outside of WFC purpose.

 

Windows Firewall Control v.4.5.0.0 - New version

What's new:
- New: Added a new button in the Rules Panel for columns configuration. When this button is clicked, it opens the same context menu as the right menu click from the data grid header.
- New: Added alternative ways to specify the color of the user interface in the Options tab, by using RGB values or by specifying the hex color.
- New: Invalid rules are automatically detected When opening the Rules Panel. They are displayed with red color and have a specific tooltip. Also, the color for temporary rules was changed to blue.
- New: Added a new warning message before opening for editing an inbound rule with EdgeTraversal set to 'Defer to user'. Editing of this kind of rule is not fully supported.
- New: Added the possibility to import, export or reset user settings. The new options were added under the Options tab in Main Panel.
- Improved: The text from several text boxes from Main Panel will be automatically selected when the controls will be focused to make it easier to quick update them.
- Improved: The URL services were moved from the Options tab to the Tools tab.
- Fixed: The default advanced notification settings are not the same when you make a clean installation and when you reset them to the default values.

New translation strings
045 = Modifying a rule with EdgeTraversal set to 'Defer to user' is not fully supported and the changes may not apply. Please refresh the rules list after changing this rule and check if the changes were saved. Are you sure you want to continue?
324 = Import, export or restore the user settings
325 = Import the user settings from file
326 = Export the user settings to a file
327 = Reset all settings to the default values
328 = User settings were successfully exported to
329 = After confirming this action, the program will restart in order to reload all the settings. Are you sure you want to continue?
510 = Specify below the URL services used for various online verifications
511 = URL to check an IP address reputation
512 = URL to check a file based on the SHA256 hash of the file
513 = URL to start a WHOIS query
514 = URL to read more about a specific port
729 = Columns configuration
936 = Invalid rule. The program path for which this rule is defined does not exist on the disk.
Changed translation strings
314 = Hex Color
718 = Show invalid rules
Removed translation strings
315, 316, 317, 318

Download location: http://binisoft.org/download/wfc4setup.exe
SHA1: 84e8ebb0c0badf9ac3a3c036c83161eefc567086

Have a great weekend,
Alexandru

Please share your feedback regarding the new features. It there are still problems, they will be fixed in the next version. Also, new features can be proposed.
Thank you for your support.

 

@alexandrud
Many thanks! Stupendous outstanding job!
To install it, do we have to directly update or uninstall previous version?

 

You're kidding, right?

It makes sense that packet filtering is mentioned. Your link from Outpost mentions WinPCap, which is a driver that sits on kernel level. Its sole purpose its to provide an Application Programming Interface for capturing network traffic. Your "low level network" intrusion approach seems to be out of reach for W7F. You're better off using Outpost as your link suggests, or be a Comodo Boy.

EDIT: I wonder how a VPN would interfere with what the Outpost link suggests...

 

@alexandrud

Thank you for this really great update, well done!

Have a nice weekend!

EDIT: DE-translation file should be ready soon ...
EDIT2: DE-translation file has been sent ...
EDIT3: @"all" ... DE-translation is ready on binisoft.org - direct link is: http://www.binisoft.org/get.php?translation=wfcDE.lng

 

I just updated to version 4.5.0.0 using the update facility in the program. The setup file (wfc4setup.exe) was downloaded into my User/AppData/Local/Temp folder and Malwarebytes promptly identified it as a Trojan.MSIL.Dropper. Anyone else had this experience?

 

@Rubert
I don't use any A/V app but so sure I am it is a false positive, even by probabilities: ~ Removed VirusTotal Results as per Policy ~

 

Yes I have. Malwarebytes identified this during a scheduled scan. It is probably a false positive. I just allowed malwarebytes to quarantine the file then deleted it.