Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Without going into too much detail on why I need to do this, I'm trying to put the Windows XP Firewall into an allow all ports configuration, and only deny certain ports I have in a list.

I've scripted this via batch commandline with netsh firewall add portopening commands. From what I've read, if activated the firewall denies all traffic and only allows ports with exceptions, so via batch scripting I've opened all 65,000+ ports on both TCP and UDP, essentially having the firewall turned on but in an "allow all" configuration. I then deny the 100 or so ports from my list that I want blocked after they are all open.

This strategy appears to work, but the problem I anticipated and am now seeing is that svchost.exe is taking 50% of my CPU time, having to continuously process these firewall rules.

From what I've seen on Windows XP, there's no way to have the firewall ON and in an "allow all" configuration" because the XP firewall cannot have port ranges defined, they must be defined one by one. Looks like Windows Vista or 7 would be much easier since the firewall got an advanced capabilities re-vamp.

Does anyone have a suggestion on how to achieve this "allow all", deny certain" strategy? I realize this is a strange use of the Windows firewall but assuming I had to do this, is it possible?

share|improve this question
    
Pretty much no firewall allows this, because this is a very bad idea from a security perspective. It is basically impossible to protect a system if you allow all and filter bad stuff. This is simply because it is nearly impossible to define 'bad stuff'. The bad guys keep coming up with new things. –  Zoredache Feb 9 '12 at 19:29
add comment

3 Answers

up vote 1 down vote accepted

Totally agree with afrazier comment...

As far as I know, there's no application or service requiering to open 65536 ports inbound!

To be clear, an open port is a port on which a service is running and ln listening state in order to answer to an external connection sollicitation. E.G. the port 80 HTTP for a web server with Apache (for example).

The incomming connection sollicitation is a TCP packet with the flag SYN and no data to the the required port: port 80 for a HTTP connection, 119 NNTP, 21 FTP and so on.

If the service is ready to allow a connection to this port, the server sent a TCP packet with the flags ACK, SYN to the client and the client confirm the connection sollicitation by a TCP packet with the flag ACK... and the connection enter in the established state. This is the normal handshake.

If the service on the listening port is'nt able to accept a connection it sent a TCP packet with the flags ACK, RST: this is a closed port...

Hmmm... to make a long story short:

  • 1- You need a Third party firewal. May be Look'n Stop which is a ruled based firewall.

  • 2- Configure the application requiring to open these large number of ports and set the rule ONLY for this application

  • 3- Put the this rule before the rule blocking all other TCP incomming connections sollicitations (with the flag SYN) and so on...

Hope this help. Let us know. :)

share|improve this answer
    
Yea, this is pretty much what I had concluded. I've pretty much been told that the firewall has to be turned on and blocking certain ports, but I have also been told that I'm not allowed to do any investigation to determine what services are running locally, what ports they use or wireshark any incoming traffic at all. To ensure system functionality with no knowledge of the system or network, it seems that I can ONLY block these ports that are called out. Seems like the Windows XP firewall is just not capable of doing what I want without CPU usage going too high. Thanks for your responses. –  electronsrock Feb 9 '12 at 19:33
    
Disable XP firewall and try Sygate, its is no longer supported but is the best firewall for XP ever, use version 5.6.2808...oldversion.com/Sygate-Personal-Firewall.html –  Moab Feb 9 '12 at 20:28
    
@Moab: Sygate? Really? There's been no advancement in firewall software since? The last time I used that I was installing it onto a Win98 system! –  afrazier Feb 9 '12 at 20:58
    
@user117630: You really need to provide more information on what it is you're trying to accomplish. Something's not adding up. In fact, I don't think there's any open services on XP default. The VM I just set up only has File & Print Sharing and Remote Management, and I had to explicitly install and enable those. –  afrazier Feb 9 '12 at 21:03
    
@afrazier, its all I use on XP, Sygate got it right, then Symantec bought it and killed it. Won't work on Vista or higher. Best there is for XP imho. –  Moab Feb 11 '12 at 1:51
show 2 more comments

I'm curious what the use case is for having the firewall configured this way. Open ports are useless unless something is listening on them, and if you have a single program listening on so many ports, just make an exception for the program itself and that should take care of everything.

If that's not going to work then it looks to me like the firewall built into XP simply can't do what you want efficiently.

The firewall built into Vista and 7 allow port ranges on rules and should make it significantly easier to put the firewall into the kind of state you want.

Otherwise you're going to need to evaluate 3rd party tools to see how well they work. I haven't used a 3rd party firewall since XP SP2 was released, so I'm in no position to make any recommendations.

share|improve this answer
add comment

This is an old\odd question but I would say the best solution would be to disable the firewall completely and then also disable any services you don't want remote users to be able to access. You are over thinking this I think. An added bonus is that this solution uses less than zero processing time.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.