Is my Windows Firewall active?

29
2013-07
  • Mina

    I'm trying to set a simple public block for an application for both inbound and outbound connections. I'm using Windows 7, but my friend is still able to connect to the application. Steps I took are as follows:

    1. Reset firewall to default settings using the button at "Control Panel\System and Security\Windows Firewall"
    2. Go into advanced settings from the same place
    3. Add an inbound rule for the target application with public checked using TCP (program does use TCP)
    4. Add an outbound rule in the same way
    5. Close all windows and restart target application

    Now at this point, my friend is still able to connect. I've even enabled logs for both dropped and accepted connections. Nothing was logged.

    Any ideas? I'm not feeling very safe here.

    • Answers
  • ta.speot.is

    It works fine. "Public" refers to the network profile Windows has detected (Home, Work, Public) not "Allow/Disallow Access From (Home/Work/Public) Computers".

    I assume your network is set to Home.



    • view all most popular Amazon Coupons
    .
    Related Question

    security - Windows 7: Windows Firewall: Logging/Notifying on Outgoing Request Attempts
  • Maxim Zaslavsky

    I'm trying to configure Windows Firewall with Advanced Security to log and tell me when programs are trying to make outbound requests. I previously tried installing ZoneAlarm, which worked wonders for me with this in XP, but now, I'm unable to install ZA on Win7. My question is, is it possible to somehow monitor a log or get notifications when a program tries to do that if I set all outbound connections to auto-block, so that I can then create a specific rule for the program and block it.?

    Thanks!

    UPDATE: I've enabled all the logging options available through the Properties windows of the Windows Firewall with Advanced Security Console, but I am only seeing logs in the %systemroot%\system32\LogFiles\Firewall\pfirewall.log file, not in the Event Viewer, as the first answer suggested. However, the logs that I can see only tell me the request's or response's destination IP and whether the connection was allowed or blocked, but it doesn't tell me what executable it comes from. I want to find out the file path of the executable that each blocked request comes from. So far, I haven't been able to.


    • Related Answers
  • 8088

    You should be able to see this in Event Viewer. First you'll need to tweak the logging options in the Advanced Settings Console:

    alt text

    In the Event Viewer's left pane, expand to Applications and Services Log -> Microsoft -> Windows -> Windows Firewall with Advanced Security:

    alt text

    There, you can create a custom view and filter the log to only outbound connection attempts.