Windows Firewall Configuration - Truly Block EVERYTHING...

Discussion in 'Windows 10' started by CODYQX4, Aug 24, 2015.

  1. MrMagic

    MrMagic MDL Guru

    Feb 13, 2012
    6,015
    4,148
    210

    Why not? It's not like an AV, if one blocks everything, the other should not have any connections left to block
     
  2. shewolf

    shewolf MDL Senior Member

    Apr 16, 2015
    471
    1,066
    10
    #42 shewolf, Aug 25, 2015
    Last edited: Aug 25, 2015
    Ok, one blocks everything but allow some IP, the second block of the same IP and you do not have a connection.
    I guess in your case windows firewall allows WL Mail outbound connection to any IP but peerblock is still blocking MS IPs.
    The WL Mail loses connection.

    To average firewall user I would recommend contrary, use default windows firewall rules and block what you want. Otherwise you are constantly in trouble.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. MrMagic

    MrMagic MDL Guru

    Feb 13, 2012
    6,015
    4,148
    210
    Fixed WLMail, works with PB & Firewall, but had to reset the firewall to defaults, then use WFC to allow it again

    Getting bored of all this crap, I think I'm gonna head back to 8.1 soon, hiding a few updates sounds much better option, no DX12 games out anyway
     
  4. MrMagic

    MrMagic MDL Guru

    Feb 13, 2012
    6,015
    4,148
    210
    Giving Comodo a shot atm, although I told it to inform me about EVERYTHING, it allowed WU to check without asking

    And FF and IE....

    And WL Mail...

    Some firewall...

    It's not asking me about anything

    Meh, too hung over to care atm
     
  5. Cipher

    Cipher MDL Member

    May 31, 2008
    129
    37
    10
    #46 Cipher, Aug 25, 2015
    Last edited: Aug 25, 2015
    I manually added the known list of HOST name blocks and the IPs they currently resolve to, to Comodo's global rules and it appears to work.

    Running Microsoft Edge shows the IP address for pre.footprintpredict.com on port 443 is sucessfully blocked in the firewall log.

    Personally I don't trust the Windows Firewall.
     
  6. MrMagic

    MrMagic MDL Guru

    Feb 13, 2012
    6,015
    4,148
    210

    You got a quick link to that list?

    I`ll give that a shot thanks
     
  7. Cipher

    Cipher MDL Member

    May 31, 2008
    129
    37
    10
  8. MrMagic

    MrMagic MDL Guru

    Feb 13, 2012
    6,015
    4,148
    210
  9. Cipher

    Cipher MDL Member

    May 31, 2008
    129
    37
    10
  10. MrMagic

    MrMagic MDL Guru

    Feb 13, 2012
    6,015
    4,148
    210
    Good idea, I might too once the missus returns with my alcohol fix :D

    Hangovers are not good for technical stuff, suddenly simple things become impossible
     
  11. Knives*

    Knives* MDL Member

    Sep 21, 2013
    212
    132
    10
  12. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,069
    3,447
    90
    For what it's worth, with no modifications windows 10 connects to comodo's domain a lot. No idea why and no I don't have the exact info. If I'd known we'd be talking about comodo later I would have saved that data. Because of this, I don't trust comodo.
     
  13. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #54 CODYQX4, Aug 25, 2015
    Last edited: Apr 12, 2019
    (OP)
    .
     
  14. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,069
    3,447
    90
    Without. Clean install.
     
  15. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #56 CODYQX4, Aug 25, 2015
    Last edited: Apr 12, 2019
    (OP)
    .
     
  16. shewolf

    shewolf MDL Senior Member

    Apr 16, 2015
    471
    1,066
    10
    #57 shewolf, Aug 25, 2015
    Last edited by a moderator: Apr 20, 2017
    To average firewall user I would recommend use default windows firewall rules and enter this configuration.

    Microsoft Telemetry communication will disappear.

    Code:
    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    
    "Allow Windows Update"="v2.24|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|RPort=80|RPort=443|App=C:\\Windows\\system32\\svchost.exe|Svc=wuauserv|Name=Windows Update|Desc=Rule created by shewolf on 08/24/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Allow Windows Update|"
    
    "Block Windows Dmwappushservice"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\system32\\svchost.exe|Svc=dmwappushservice|Name=Windows Dmwappushservice|Desc=Rule created by shewolf on 08/24/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block Windows DiagTrackservice"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\system32\\svchost.exe|Svc=DiagTrack|Name=Block Windows DiagTrackservice|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block Search and Cortana"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\systemapps\\microsoft.windows.cortana_cw5n1h2txyewy\\searchui.exe|Name=Search and Cortana application|AppPkgId=S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block SIH Client"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\system32\\sihclient.exe|Name=SIH Client|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block Microsoft Windows Search Indexer"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\system32\\searchindexer.exe|Name=Microsoft Windows Search Indexer|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block All Out traffic from WinDefend"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=%ProgramFiles%\\Windows Defender\\MsMpEng.exe|Svc=WinDefend|Name=Block Out WinDefend|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block Windows Defender User Interface"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\program files\\windows defender\\msascui.exe|Name=Windows Defender User Interface|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block SearchUI"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\systemapps\\microsoft.windows.cortana_cw5n1h2txyewy\\searchui.exe|Name=Block SearchUI|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block All Out traffic from Explorer"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=%SystemRoot%\\explorer.exe|Name=Block Out from Explorer|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block Windows Process"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\system32\\svchost.exe|Svc=IKEEXT|Name=Process for Windows Services |Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block Windows Problem Reporting"="v2.24|Action=Block|Active=TRUE|Dir=Out|App=C:\\windows\\system32\\wermgr.exe|Name=Windows Problem Reporting|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    "Block Microsoft Telemetry IP"="v2.24|Action=Block|Active=TRUE|Dir=Out|RA4=64.4.0.0/255.255.192.0|RA4=65.52.0.0/255.252.0.0|RA4=157.56.91.77|RA4=168.61.0.0/255.255.0.0|RA4=168.62.0.0/255.254.0.0|RA4=23.212.108.121-23.212.108.162|RA4=111.221.29.0-111.221.29.255|Name=Block Microsoft Telemetry IP|Desc=Rule created by shewolf on 08/25/2015 18:24:52. Do not edit rule by hand|EmbedCtxt=Block Microsoft Telemetry|"
    
    
    
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  17. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,389
    11,614
    240
    Is anyone fairly advanced with Firewall settings?
    I'm trying to figure out custom "Allow" outbound rules to enable the Settings app to check for Windows Updates.

    I've tried %windir%\immersivecontrolpanel\systemsettings.exe
    I've tried svchost->wuauserv and svchost->bits

    I'm trying to figure out how to set the default option to outbound disabled for say Public and then just allow certain programs.

    If I just point it at svchost.exe it will work, but I don't want to open it up to every service if I can help it.
     
  18. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #59 CODYQX4, Aug 25, 2015
    Last edited: Apr 12, 2019
    (OP)
    .
     
  19. El_Heffe

    El_Heffe MDL Member

    Jul 16, 2007
    200
    87
    10
    Yes, this is one of the problems with Windows Firewall.

    Another problem with Windows Firewall is that you have to specify exactly which outgoing connections you want to block. Right now, you can block all the ones we know about. But what about the ones you don't know about? For example, stuff that gets added in future updates?

    Do you really think Microsoft is going to allow people to block everything and not add new ones to get around the blocks?

    It's better to use a firewall that lets you block everything by default and then each time something tries to connect to the Internet you can allow it or block it. This allows you to block things that might get added without your knowledge.

    I use the firewall in AVG Internet Security, but I'm sure there are others that are just as good.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...