Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say you have two rules, one that block and the other that allows the connection from the exact same IP. Which rule takes precedence?

Here is some context: I created a script that will block any suspicious activity (for example, if some one tries to access too many times with admin user, it will create a firewall rule to block that IP) but sometimes there are exceptions and I create another rule to allow access to that exact IP.

What will Windows Advanced Firewall do?

share|improve this question
Hey, I know I can simply remove the blocked rule or change it to allow access. There are possibly many other ways to do that with policies, etc but I want to know what happens in such cases? Will windows consider the latest rule? Or will it allow access for allowed to connect IP over the blocked ones? Take this other scenareo: a rule that blocks all IP. Another rule that allows an IP. Will windows let connect that IP or will it block it? You get the idea. – Koobecaf Eliforp Jul 9 '13 at 18:19
up vote 2 down vote accepted

According to the Order of Windows Firewall with Advanced Security Rules Evaluation article:

Block rules. This type of rule explicitly blocks a particular type of incoming or outgoing traffic. Because these rules are evaluated before allow rules, they take precedence. Network traffic that matches both an active block and an active allow rule is blocked.

share|improve this answer
thanks buddy. This answers my question and allows me to improve my script to not add a block rule when an allow rule is present. – Koobecaf Eliforp Jul 9 '13 at 19:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .