3

I am using Windows 7 firewall with outbound filtering enabled. Windows Firewall does not provide an UI for new outbound connection prompts, it just blocks them. Windows Firewall Control solves this using a workaround - it enables audit logging of packet/connection drop failures, monitors the Security log for new entries, and brings up prompts as needed.

I have spent time crafting a list of outbound Allow rules for all system services and applications that need to make outbound connections. Windows Firewall is able to target specific services within svchost.exe, allowing pretty fine-grained control. I have come across only two things where this doesn't work - Network Discovery, and Cryptographic Services.

I have the following rule enabled:

netsh advfirewall firewall add rule name="Windows Cryptographic Services"
  program="%SystemRoot%\System32\svchost.exe" service=CryptSvc 
  protocol=tcp remoteport=80,443 dir=out action=allow

However, I still keep getting blocks originating from the svchost.exe hosting CryptSvc, trying to make outbound http connections to verify certificates and such. I even used sc config CryptSvc type=own to isolate the service into its own container, to confirm that it's indeed CryptSvc making these requests. And even then, the rule would still not match. There are many other rules with the same structure, just different target service, where everything works just fine.

So far I could not find a satisfactory workaround. Allowing 'everything' for CryptSvc still won't make it match. The scope needs to be at least 'all services' for it to match, and this is too broad. I can add an ignore rule for svchost.exe in WFC, but that, again, is too broad for my liking. I'd prefer a systematic solution.

EDIT: Trying to edit my firewall rule pops up the a warning box:

Windows services have been restricted with rules that allow expected behavior only. Rules that specify host processes, such as svchost.exe, might not work as expected because they can conflict with Windows service-hardening rules.

Are you sure that you want to create a rule referencing this process?

Could be that this 'hardening' is interfering with the firewall's mechanism for identifying the originating service.

|improve this question
  • 1
    Hm, I will try, not sure what this'll achieve though since the logs clearly say it's tripping on connection attempts to ms servers on port 80. – theultramage Jul 15 '18 at 10:46
  • Goal is to have proper outbound filtering, with all core services that need network access be covered by appropriately constrained firewall rules. The built-in Windows Firewall product does not provide an UI for new outbound connection prompts. If you enable default-to-deny, you won't even know what's trying to connect (and when) unless you use auditpol.exe to turn on logging. And even then, you have to sift through all the junk in the Security log. That's where WFC comes in, it does that for you. I stay away from driver-based third party firewall products, I've been burned in the past. – theultramage Jul 15 '18 at 16:39
  • What I do when using WFC is to put it in notification mode, so any time something wants to get out I get a pop up where I can allow or deny it, this allows a simpler way to make rules as you go rather than custom manual ones. – Moab Jul 15 '18 at 16:40
  • 1
    The problem is that the CryptSvc allow rule does not get matched, no matter how I define it, so everytime something tries to do CRL/OCSP, it still gets blocked, and I get spammed with prompts. My current workaround is to keep blocking them (bad for security!) and silence svchost.exe in WFC. – theultramage Jul 15 '18 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.