Windows Firewall Control (WFC) by BiniSoft.org

Here is an example of where there is an allow rule, but the process is still being blocked?

Rule : https://imgur.com/z6l9LeB
Log : https://imgur.com/jgPflDv

Even when I delete the rule, run the app, wait for the prompt and re-create the rule the same behaviour happens?

EDIT : I've reset the rules to default (to make sure there was not a conflicting block rule) and then tried again but with the same outcome.

When I first launch this app I'm told Windows Defender has blocked this app and I can unblock it (which I do), this creates 2x Inbound rules (TCP & UDP).

Other apps work fine.

Not sure where else I should be looking to diagnose?
Any help would be appreciated. Thanks!

 

You're welcome. Glad to hear you fixed your problems.

 

1. Does it work if you switch to Low Filtering profile (disable outbound filtering in Windows Firewall) ?
2. Do you have this problem only with this application ?
3. Do you have any web filtering module in your antivirus ? Try to disable it and check the results. Maybe those IPs are blacklisted in your antivirus.
4. Do you use any software proxy or VPN when you use this application ?

To me, it seems that the blocking is not made by Windows Firewall. However, in Connections Log are logged all dropped packets, including the ones blocked by another security programs.

 

1. No it didn't.
2. Yes, if I uninstall WFC and just run the standard Windows Firewall (then click Yes to allowing the application) it works.
3. No only WFC + Windows Defender + Router level blocking (diversion + skynet) - as per point 2 if I revert back to standard Windows Firewall it works.
4. I used a VPN but that is managed at the router level (the computer is not aware of it).

I've since changed to simplewall which uses WFP, but doesn't have the granularity WFC does.

This would make sense, however there are no other programs that are installed. I'm stumped.

 

Something is not right. If you use Low Filtering profile, is like you are using the default settings of Windows Firewall. Remember that WFC does not do any packet filtering and is not aware of any network connection. At point 2) you said you uninstalled WFC then you clicked Yes to allow the application. I assume this was the Windows Firewall notification. If you press Yes, it creates two inbound rules for this app, one for UDP protocol and one for TCP protocol. Now, if you install WFC and leave it in Low Filtering profile, Windows Firewall works like WFC is not installed at all. Can you use this app now ? If not, please ask their developers how to allow their app through Windows Firewall.

 

Correct.

That's a good idea, I will try that.

Thank you for your support!

 

Good afternoon,

Windows Firewall Control won't open on my end, firewall notifications won't show up. when I try to run it I see the tray icon, but when I hover it, it disappears, I am unable to uninstall it as the uninstaller won't open, I tried re-installing on top of the current one but still have the same issue.
Any suggestions on what may be causing this?

WFC 6.0.2.0
Windows 10 Pro 1903

 

Rivatuner Statistics Server is causing this. Open it and set Application detection level to None. Otherwise, this software may try to determine the FPS for WFC which uses the GPU to render the user interface.
Source: https://binisoft.org/pdf/guides/Malwarebytes-WFC-User-Guide.pdf#page=43

 

Damn, spot on, thank you very much for the info, it worked.

 

Hi. I followed these instructions. It worked for a minute, then the default set of rules "magically" disappeared from WFC I tried again and the same happened

 

After several tries they finally stayed for good. Strange...

 

I just want to say that I came here for this exact issue, and your answer solved it. I would have never suspected RTSS.

Now, I wonder whether this issue with RTSS also explains the crash of the ProtonVPN client. The Event Viewer in both cases reported an error with d3d9.dll.

 

If you have Secure Rules enabled, make sure you have added these groups in the authorized group list, otherwise they will be removed by Secure Rules feature.

Yes, they are related. WFC and many .NET programs are using WPF (Windows Presentation Foundation) for the UI. WPF is rendered by DirectX (D3D). My guess is that RTSS is not smart enough to detect that the call to DirectX is made from a WPF app, so it thinks it is a game. Something goes wrong and while it tries to attach to a gaming process, it fails but it also breaks the software to which it tries to attach in order to read the FPS and other parameters. At least there is a solution for this.

 

By the way, it seems sufficient to add the executable to the list of RTSS, and then set "Application detection level" to "None" specifically for this executable, without touching to "Global".

Global:
https://i.imgur.com/XdvIg6i.png

wfc.exe:
https://i.imgur.com/s8bd4VP.png

Anyway, thanks for the quick fix!

 

Just wanted to close out this ask by letting you know that I never got around to retesting this, because I've found simplewall (although not as granular) to be just as effective so I'm happy to stay with that for now.

I do want to say thank you for you support and replies. And if you aren't already sponsored by Malwarebytes please let me know how I can donate for creating such great software. Thanks!

 

Is it normal that this application uses 0.6 - 1% of CPU resources? CPU is a Ryzen 7. It's not a lot at all, but no one background application takes so many resources while not doing anything. Just wonder

 

It depends. If you use Medium Filtering profile which enables outbound filtering in Windows Firewall, and you use the notifications system, and you have hundreds of firewall rules, and you have programs that generate a lot of connections, then it may be possible. Does it go back to 0% if you set the notifications to Disabled ?

 

Yes sir. It's set exactly as you wrote it. There are about 200 active rules. Thank you for fast answer

 

Can I make a small feature request? Could a couple keyboard shortcuts be added for notification popups, such as switching between popups? Something as simple as Left/Right or Ctrl-Left/Right would be great.

Some other notification shortcuts would also be great, if possible, namely:

Allow until WFC restart: CTRL-SHIFT-A(llow)
Block until WFC restart: CTRL-SHIFT-Q(uit)


I previously suggested some other keyboard shortcuts that I use all the time now: Ctrl-Tab to switch between panels, Ctrl-R or F5 to refresh, etc. These are awesome.

 

I will add these keyboard shortcuts in the next WFC release.

 

Configurable I hope.

 

Probably not. Configurable keyboard shortcuts requires 10 times more work, this is why only 3 of them are configurable.

 

Well I hope they can be disabled at the very least, CTRL-SHIFT-A I use in Notepad++ for example, and other programs like DisplayFusion might too have some overlap too.

10 times more work maybe, but your work is polished as hell, don't let that bit go.

I also noticed this...

https://i.imgur.com/COPkxdQ.png

Looks a little lonely, when can we expect friends? (you still working on that other "security program"?).

 

Thank you!! These will be extremely useful, particularly given the number of alerts/popups I have to manage on a regular basis (due to my personal workflow/fault).

Not sure how this would "un-polish" his work or make 10 times more work of something, especially as similar keyboard shortcuts have been added in the past, which have added a lot of utility.

Even if the shortcuts aren't configurable, they would still only be local to the notification, so it wouldn't override other program's shortcuts (unless your shortcuts are global, in which case, all programs are going to have shortcut overlap).

 

Being a parent of a 2 years old daughter leaves me very little free time, therefore personal projects are on hold.