5

We were poking around in the Windows 8.1 Advanced Firewall interface and we are noticing that there are two Inbound program rules created for C:\Program Files (x86)\Mozilla Firefox\firefox.exe Private profile. One allows all TCP ports and the second allows all UDP ports.

Anybody know of a reason why these inbound rules are put in place? We're considering deleting the rule, but I'm concerned that Firefox will just re-do them next time it auto updates.

  • Communication with a http server is a 2-way street. – Ramhound Feb 25 '15 at 16:41
  • I had these rules present but disabled. Just updated to Firefox 42, it added a new set of 2 enabled rules. – Gras Double Nov 10 '15 at 0:46
3

According to mozilla.support.firefox, it seems related to two things introduced with FireFox 36:

  • Firefox Hello (as Screener states) which you could disable by setting loop.enabled=false in about:config
  • media sharing using SSDP/UPnP (for Roku or Chromecast)?
    According to bugzilla this can not be disabled, but it seems they are considering the setting browser.casting.enabled=false in about:config for FireFox 37
2

Firefox now includes a video chat interface called Firefox Hello. If your system is clean, any new firewall rules that weren't required before are likely related to it.

  • You can of course disable this new interface – Ramhound Feb 25 '15 at 22:20
  • @Ramhound but it attempts to access it somehow the first time you launch the current Firefox version. I got a Windows Firewall popup after updating to Firefox 36 too. – user33758 Feb 26 '15 at 0:10
  • According to support.mozilla.org/ro/kb/hello-status, "Firefox Hello has been discontinued and removed from Firefox starting with version 49" (that was in August 2016). However, the firewall rule still remains. – Razvan Socol Apr 20 at 19:37
0

Firefox seem to use tcpip connection for some kind of interprocess communication. There is traffic across these connections, as soon as you start it up.

This doesn't warrant opening to everything the way it does, atleast not without giving the user a notice. But it's been doing it for a while. You can restrict the rules to only apply to and from localhost (127.0.0.1), without any detriment. Unless you use Hello.

Edit> Some suggest setting loop.enabled to false in the config to stop the Hello stuff from starting up. I'm 100% that's actually what it does, but it makes the button unavailable anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.