0

I was looking for a basic firewall program for outbound blocking. The only feature I needed was a notification for any new outbound connection so I could choose to allow or block.

The free "Windows Firewall Control" (by binisoft) did what I needed. Except one problem that I need help with:

After initial setup, the "connection log" remains mostly empty (as expected), BUT when I'm connected to a VPN, it fills up rapidly with blocked outgoing connections for svchost.exe. Even though I have previously granted full access to svchost. The VPN connection itself works fine and I can connect to the internet, but the log keeps adding new entries every second and fills to 100s of lines.

Screenshot

The expected behavior would be for me to get a notification to allow/block the outgoing connection, but I don't get any. Even if manually allow svchost full access, these entries keep coming.

To troubleshoot, I tried another firewall program called "Simplewall". Here I don't see similar entries on it's default setting, but I see them again if I enable "Dropped packets log". And they look like:

12/‎8/‎2018 ‏‎9:37:27 AM,NT AUTHORITY\NETWORK SERVICE,C:\windows\system32**svchost.exe**,192.168.X.X:53 (Remote),192.168.X.X:54108 (Local),udp,OpenVPN,#288909,OUT,BLOCK

Even with this firewall I don't get any new notification asking for access. And I have already granted full access to all VPN .exe files and svchost.exe (I basically said Yes to all initial notifications to allow everything). The internet/VPN works fine, but these numerous blocked attempts keep accumulating.

Sounds like it's something to do with "dropped packets" (and that these are not "normal" outgoing connection attempts).

Anyone familiar with this and can help figure out what's going on?

(Btw, I tried a third firewall called "Windows 10 Firewall Control" by sphinx software. Same phenomenon when on VPN. If I don't connect to VPN, I don't see the blocked connection entries)

  • Why aren't you using the Windows Defender Firewall? – harrymc Dec 8 '18 at 20:29
  • It does not give a notification to allow or block an outgoing connection when a new program tries to do so. – kayan1 Dec 8 '18 at 20:42
  • Yes, it does - link. – harrymc Dec 8 '18 at 20:44
  • Are you saying that if I turn on Outbound blocking (which is disabled by default), it will show a popup notification asking me to allow or block every new application? – kayan1 Dec 8 '18 at 20:50
  • No, this is the normal functioning of the firewall. – harrymc Dec 8 '18 at 20:51

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.