I have configured Windows Firewall to block all outbound connections. I have then created "allow" rules to enable certains applications to create outbound connections. Unfortunately it seems that some connections that should be allowed are still blocked and I don't understand why.
I have a simple rule to allow Windows Problem Reporting:
- Enabled: Yes
- Action: Allow the connection
- Protocol type: TCP (6)
- Local port: All Ports
- Remote port: All Ports
- Local IP address: Any IP address
- Remote IP address: Any IP address
- Profiles: Domain, Private, Public
Nevertheless, after creating this rule, a connection was blocked and logged in the event log:
The Windows Filtering Platform has blocked a connection. Application Information: Process ID: 7440 Application Name: \device\harddiskvolume3\windows\system32\wermgr.exe Network Information: Direction: Outbound Source Address: 192.168.1.23 Source Port: 31532 Destination Address: 220.127.116.11 Destination Port: 80 Protocol: 6 Filter Information: Filter Run-Time ID: 184645 Layer Name: Connect Layer Run-Time ID: 48
Given the rule that was created specifically to allow
wermgr.exe to connect I don't understand why the connection was blocked. How can I modify the rule to allow the connection to succeed?
By the way, this is not an issue isolated to
wermgr.exe. Once in a while I see blocked connections for other applications even though I have created rules for them also. Luckily most of the time the rules work as expected.