2

I am experimenting on blocking all outbound traffic by default using Windows Firewall. I then wish to explicitly allow ICMPv4 outbound by the PING.EXE program. Hence, I explicitly create custom rules that say if the file is %systemroot%\system32\PING.EXE and the protocol is ICMPv4, it is allowed.

However, when I run PING.EXE 8.8.8.8, it says "General Failure" and my firewall log shows that the traffic is dropped. I then use dir ping.exe /s to find all the instances of PING.EXE (there are 4 of them, one in System32, one in SysWOW64, two under WinSxS) and explicitly allow all 4 of them. I am still met with "General Failure".

I used ProcMon to see if C:\Windows\System32\PING.EXE is being called. It looks like it is.

However, if I says ICMPv4 is allowed for "ALl programs that meet the specified conditions", then PING.EXE 8.8.8.8 will succeed.

Can anyone help to explain why is this the case?

1
  • In general and not just for the ping program, the idea is to not directly use the WinSXS files, but rather, use the ones in the system32 or SysWOW64 folders as they are ntfs hard links to the current version intended for use of the program contained in the WinSXS folder. Windows update maintains the content of WinSXS and all of the ntfs links to the correct files and versions thereof. Jun 5, 2016 at 2:44

1 Answer 1

2

The reason for it working when "All programs" is selected and not when using the ping.exe seems to be that the firewall does not see the source/destination program for the ICMPv4 traffic, and only sees the "System" process and that the "System" process falls under the "All programs" category.

Note that

  • In the field where it is asking for a full path to the executable you can just write: System
  • you will need to have your rules applied to the correct network profile of Domain, Private, or Public for your current connection
  • the "tracert" program is particularly usefull for diagnostics.

The default when adding a new ICMPv4 rule, allows all ICMPv4 types and codes. There are a bunch of icmp types and codes, see http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml for full detail. You may not want to allow all of the them.

For ping to work, it at least needs both outbound and inbound traffic for the

  • Echo request (ping) ICMP type 8
  • Echo reply (pong) ICMP type 0

Being MS they've tried to dumb it down a bit and hide the full detail. If you look in the "Advanced firewall area -> rule properties -> protocol and ports tab -> customise button" you will see the area for types and codes. On my system, which I believe is still in its default state, it has

  • outbound - ICMPv4 "Echo Request"
  • Inbound
    • ICMPv4 "Echo Request" - (I'm assuming "Echo Request" in microsoftese means either request or reply)
    • ICMP Type 3 (destination unreachable) code 4 (Fragmentation Needed and Don't Fragment was Set). Though I'm not sure why only code 4 is allowed when the other type 3 codes are quite useful to know.
5
  • Thanks. But that doesn't explain why when I switch the program path from C:\Windows\System32\PING.EXE to "ALl programs that meet the specified conditions", it works. Or am I missing something that you mentioned?
    – xyz
    Jun 5, 2016 at 2:23
  • Ah..that may make sense...wonder if there is a way for me specify only "System" process are allowed but not other program.
    – xyz
    Jun 5, 2016 at 2:28
  • 1
    Seeing as firewall doesn't see the source/destination program and only the "System" process I don't think you are going to have a lot of luck on restricting it to a white list of programs. Also I just had a closer look and the default when adding a new ICMPv4 rule is to allow all types and codes. Jun 5, 2016 at 2:34
  • That seems to work. By the way, I wanted to check your comments as the correct answer, but seems like I can only check the answer itself.
    – xyz
    Jun 5, 2016 at 2:41
  • I've updated the answer to better reflect the problem described by the question. Jun 5, 2016 at 3:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .