In testing some machine hardening settings I noticed what appears to be a bug in Windows XP's firewall. If you open firewall.cpl and go to the Exceptions tab you can add exceptions for known applications and individual ports. If you check the checkbox for, say, Remote Desktop, then it allows 3389 in so people can RDP to the machine.
If you go to the Advanced tab you can set firewall exceptions for individual interfaces. You should be able to disable the Remote Desktop exception in the Exceptions tab and enable the exception for RDP for each desired individual interface. If I do this for a single interface, then try to RDP to the machine using the IP address assigned to that interface, sometimes it will let me through, sometimes it won't. If I do manage to get it working it works exactly as expected. If, however, I disable the interface and then re-enable it the exception still shows up in the firewall UI and the settings still appear to be the same if I do
netsh firewall show portopening, but for whatever reason it starts dropping the connection attempts.
I'm mostly wondering if someone can verify this issue, whether it's widely known, and if there's any sort of workaround for it. We'd like to be able to only allow certain services over a specific interface, but with XP's built-in firewall this function seems to be broken.