The Windows 7 Firewall is running with default options to allow outbound connections and block incoming connections. I have a process trying to connect regularly from within my local network, which is fine. When the program that accepts the connection is running, all goes well. When it's not, Windows 7 Firewall is causing the connection attempt to time out instead of refusing the connection (like it should be doing).

I've tried creating rules to explicitly allow all connections on that port, but it's timing out none-the-less. I'm wondering if the firewall is blocking the RST packet from being sent back? Disabling the public profile completely causes the connection to be refused (as expected) but a firewall rule does not.

Here is the rules I've tried so far without success:

Port type, TCP, Specified port 11211, Allow the connection, apply to Domain, Private, and Public

Any suggestions?

Note: When I say "refused" I'm referring to the operating system's response to the connection saying "sorry, nothing is listening." Test this out on your local machine. Open a command prompt and type telnet localhost 60000. You should see something like this: Trying telnet: connect to address Connection refused

This is a connection refused. The operating system is "refusing" the request, because (at least on my system) nothing is listening on port 60000.

Now try telnet example.com 60000. Wait. You'll eventually see something like this: Trying telnet: connect to address Operation timed out

See the difference? There is no host at example.com to reply with a "refused" so your local operating system (e.g. not the server) says "nothing is there, timeout."

Very different. The problem is Windows 7 firewall is not generating the "refused" as it should be. I'd like to find out how to fix this.

  • If you fully disable the firewall do you get the expected/wanted behaviour? – Ƭᴇcʜιᴇ007 Nov 10 '11 at 18:30
  • I'm also a little confused as to what you think would "Refuse" the connection if there's no firewall in the way (due to rules), and no server listening? – Ƭᴇcʜιᴇ007 Nov 10 '11 at 18:44
  • The connection being "timed out" sounds like the connection is being refused. I don't understand the difference. – Ramhound Nov 10 '11 at 19:29
  • The connection "timing out" is different than the connection being "refused." A refused response is the OS saying "nothing is listening on that port, so you cannot connect," vs. a timeout which has no response at all. The server takes care of refusals, the client takes care of timeouts. Significant difference there. – JT. Dec 7 '11 at 1:38
  • What is your basis for saying the Win Firewall "should" be sending Connection Refused messages? I've always understood firewalls to be mere filters, allowing or dropping packets, but not generating any traffic of their own. – kreemoweet Feb 17 '12 at 19:54

This is due to a windows firewall feature called "stealth mode". The idea is that refusing a connection instead of timing it out will tell an attacker that there actually is a computer on that IP-Address. With the connection attempt timing out, the hope is that the attacker will ignore the computer. For more information regarding stealth mode see technet.

You can disable stealth mode by modifying the registry as documented here:

To Software\Policies\Microsoft\WindowsFirewall\DomainProfile, Software\Policies\Microsoft\WindowsFirewall\PrivateProfile, Software\Policies\Microsoft\WindowsFirewall\PublicProfile, Software\Policies\Microsoft\WindowsFirewall\StandardProfile add a REG_DWORD named DisableStealthMode with a value of 0x00000001

After doing so you need to restart the windows firewall service for the changes to take effect.

  • Could you explain the fix here? We generally prefer a summary as opposed to just links – Simon Sheehan Feb 17 '12 at 20:47
  • That's exactly it! I can't vote up because I don't have enough reputation, but the fix did exactly what was needed! Keys: Software\Policies\Microsoft\WindowsFirewall\DomainProfile, Software\Policies\Microsoft\WindowsFirewall\PrivateProfile, Software\Policies\Microsoft\WindowsFirewall\PublicProfile, Software\Policies\Microsoft\WindowsFirewall\StandardProfile Value: "DisableStealthMode" Type: REG_DWORD. Size: Equal to size of the Data field. Data: 0x00000001 means TRUE and 0x00000000 means FALSE. – JT. Feb 17 '12 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.