0

Without going into too much detail on why I need to do this, I'm trying to put the Windows XP Firewall into an allow all ports configuration, and only deny certain ports I have in a list.

I've scripted this via batch commandline with netsh firewall add portopening commands. From what I've read, if activated the firewall denies all traffic and only allows ports with exceptions, so via batch scripting I've opened all 65,000+ ports on both TCP and UDP, essentially having the firewall turned on but in an "allow all" configuration. I then deny the 100 or so ports from my list that I want blocked after they are all open.

This strategy appears to work, but the problem I anticipated and am now seeing is that svchost.exe is taking 50% of my CPU time, having to continuously process these firewall rules.

From what I've seen on Windows XP, there's no way to have the firewall ON and in an "allow all" configuration" because the XP firewall cannot have port ranges defined, they must be defined one by one. Looks like Windows Vista or 7 would be much easier since the firewall got an advanced capabilities re-vamp.

Does anyone have a suggestion on how to achieve this "allow all", deny certain" strategy? I realize this is a strange use of the Windows firewall but assuming I had to do this, is it possible?

1
  • Pretty much no firewall allows this, because this is a very bad idea from a security perspective. It is basically impossible to protect a system if you allow all and filter bad stuff. This is simply because it is nearly impossible to define 'bad stuff'. The bad guys keep coming up with new things.
    – Zoredache
    Feb 9, 2012 at 19:29

4 Answers 4

1

Totally agree with afrazier comment...

As far as I know, there's no application or service requiering to open 65536 ports inbound!

To be clear, an open port is a port on which a service is running and ln listening state in order to answer to an external connection sollicitation. E.G. the port 80 HTTP for a web server with Apache (for example).

The incomming connection sollicitation is a TCP packet with the flag SYN and no data to the the required port: port 80 for a HTTP connection, 119 NNTP, 21 FTP and so on.

If the service is ready to allow a connection to this port, the server sent a TCP packet with the flags ACK, SYN to the client and the client confirm the connection sollicitation by a TCP packet with the flag ACK... and the connection enter in the established state. This is the normal handshake.

If the service on the listening port is'nt able to accept a connection it sent a TCP packet with the flags ACK, RST: this is a closed port...

Hmmm... to make a long story short:

  • 1- You need a Third party firewal. May be Look'n Stop which is a ruled based firewall.

  • 2- Configure the application requiring to open these large number of ports and set the rule ONLY for this application

  • 3- Put the this rule before the rule blocking all other TCP incomming connections sollicitations (with the flag SYN) and so on...

Hope this help. Let us know. :)

7
  • Yea, this is pretty much what I had concluded. I've pretty much been told that the firewall has to be turned on and blocking certain ports, but I have also been told that I'm not allowed to do any investigation to determine what services are running locally, what ports they use or wireshark any incoming traffic at all. To ensure system functionality with no knowledge of the system or network, it seems that I can ONLY block these ports that are called out. Seems like the Windows XP firewall is just not capable of doing what I want without CPU usage going too high. Thanks for your responses. Feb 9, 2012 at 19:33
  • Disable XP firewall and try Sygate, its is no longer supported but is the best firewall for XP ever, use version 5.6.2808...oldversion.com/Sygate-Personal-Firewall.html
    – Moab
    Feb 9, 2012 at 20:28
  • @Moab: Sygate? Really? There's been no advancement in firewall software since? The last time I used that I was installing it onto a Win98 system!
    – afrazier
    Feb 9, 2012 at 20:58
  • @user117630: You really need to provide more information on what it is you're trying to accomplish. Something's not adding up. In fact, I don't think there's any open services on XP default. The VM I just set up only has File & Print Sharing and Remote Management, and I had to explicitly install and enable those.
    – afrazier
    Feb 9, 2012 at 21:03
  • @afrazier, its all I use on XP, Sygate got it right, then Symantec bought it and killed it. Won't work on Vista or higher. Best there is for XP imho.
    – Moab
    Feb 11, 2012 at 1:51
2

I'm curious what the use case is for having the firewall configured this way. Open ports are useless unless something is listening on them, and if you have a single program listening on so many ports, just make an exception for the program itself and that should take care of everything.

If that's not going to work then it looks to me like the firewall built into XP simply can't do what you want efficiently.

The firewall built into Vista and 7 allow port ranges on rules and should make it significantly easier to put the firewall into the kind of state you want.

Otherwise you're going to need to evaluate 3rd party tools to see how well they work. I haven't used a 3rd party firewall since XP SP2 was released, so I'm in no position to make any recommendations.

0

This is an old\odd question but I would say the best solution would be to disable the firewall completely and then also disable any services you don't want remote users to be able to access. You are over thinking this I think. An added bonus is that this solution uses less than zero processing time.

0

UPDATE: Don't do this, this slows down the system so much, that you are better off analyzing which ports you actually need.

I know this is super late, but I just had a customer that had this requirement. Let's not discuss how much sense this makes, but this at least leaves logging active, as opposed to firewall being disabled.

I was able to open all ports via cmd by creating 65535 rules for eacht tcp and udp...

FOR /L %I IN (0,1,65535) DO netsh firewall add portopening TCP %I "TCP "%I

This creates rules in increments of one from 0 to 65535 for TCP. UDP of course follows same principle. Rule Names are in Pattern of "TCP 1" "TCP 2" etc.

This obviously takes ages, if you want to speed it up, split it into multiple cmd windows. I split it to 4 identical parts by just replacing the content of the brackets like this.

part 1 (0,1,16300)
part 2 (16301,1,32600)
part 3 (32601,1,48900)
part 4 (48901,1,65535)

Still testing if a firewall with this many rules does not affect the system in some strange manner, but so far it seems to be doing the same as it was with a disabled firewall.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .