0

My Windows 10 computer has an extra network interface attached via USB which is named Ethernet 2 when listed by ipconfig. Ethernet 2 has an IPv4 address starting with 192.254 like 192.254.N.N and its IPv6 address starts with fe80::. Attached to the other end is a Raspberry Pi.

An application on my Windows PC could not receive UDP packets from that network as long as Windows Defender Firewall only allowed that application to communicate on Domain and Private networks. Switching the firewall to allow communication on Public networks (the option which is neither Domain nor Private) fixed the issue. It strikes me as counterintuitive that a link-local network on fe80:: or 192.254 is classified as a "public" network when in fact it's a point-to-point cable?

What am I misunderstanding in the terminology or network classification?

1 Answer 1

1

"Public" vs "Private" in Windows Firewall doesn't classify IP network prefixes – it classifies the state of the entire network interface. (That is, all traffic from a given network interface has either the "Private" rules or the "Public" rules applied to it, regardless of source IP address.)

The distinction is not only about Internet accessibility and not at all about the IP addresses being "private" in the RFC1918 meaning of the term – it's more about whether hosts in your local network are trusted or not. It would completely defeat the point of the system to automatically trust fe80::/64 or 192.168.0.0/16, because the exact same "private-use" prefixes as on your point-to-point link are also used in open-access networks which may be full of untrusted hosts in the same subnet.

For example, if you connect to a cafe or library Wi-Fi network, it would almost always have a RFC1918 IPv4 address (and a link-local IPv6 address, those are mandatory to have even if a global address is present), and so would the devices of all the other customers using the same Wi-Fi – but in most cases you wouldn't want them to access your SMB service just because they're doing so from a fe80::/64 address.

Windows does use the prefix and various other information to detect whether it is currently connected "Domain" network (when joined to an Active Directory domain), but in other cases it errs towards the side of safety. (Windows 7–10 used to ask you upon connecting to a "new" network for the first time; Windows 11 seems to just default to "Private" every time.)

You can change the profile for the current network (for Ethernet this is only available in the most recent releases of Windows 10):

Screenshot of the Windows 11 "Settings" app with the information of an Ethernet interface open

If you want Windows Firewall to allow traffic depending on source prefix, there is a separate mechanism for that. Many of the built-in rules in Windows Firewall (wf.msc) allow "Scope → Remote: Local Subnet" when the rule is applied to 'Private' interfaces; you can do the same for the rule corresponding to your app:

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .