Without going into too much detail on why I need to do this, I'm trying to put the Windows XP Firewall into an allow all ports configuration, and only deny certain ports I have in a list.
I've scripted this via batch commandline with netsh firewall add portopening commands. From what I've read, if activated the firewall denies all traffic and only allows ports with exceptions, so via batch scripting I've opened all 65,000+ ports on both TCP and UDP, essentially having the firewall turned on but in an "allow all" configuration. I then deny the 100 or so ports from my list that I want blocked after they are all open.
This strategy appears to work, but the problem I anticipated and am now seeing is that svchost.exe is taking 50% of my CPU time, having to continuously process these firewall rules.
From what I've seen on Windows XP, there's no way to have the firewall ON and in an "allow all" configuration" because the XP firewall cannot have port ranges defined, they must be defined one by one. Looks like Windows Vista or 7 would be much easier since the firewall got an advanced capabilities re-vamp.
Does anyone have a suggestion on how to achieve this "allow all", deny certain" strategy? I realize this is a strange use of the Windows firewall but assuming I had to do this, is it possible?