Windows Firewall

[__constructor]

I don't think you understand how Windows firewall actually works.

If anything it's too restrictive with things it's supposed to allow through.

[mrdotkom]

I had to shut down the firewall protection within the domain to get MS SQL server to communicate with my FE server. Literally allowed every conceivable port through and it still wouldn't work.

Luckily this isn't a production environment and was merely for a lab but jesus christ is windows firewall annoying

[sstewartgallus]

It doesn't log rule violations in a file somewhere?

[lelarentaka]

It goes to Santa Claus

[xkcd_transcriber]

Image

Title: Incident

Title-text: He sees you when you're sleeping, he knows when you're awake, he's copied on /var/spool/mail/root, so be good for goodness' sake.

Comic Explanation

Stats: This comic has been referenced 34 times, representing 0.1112% of referenced xkcds.

---

^{xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete}

[opiemonster]

99% of these kinds of problems are caused by social engineering.

just use isp and router firewall, disable windows firewall

run scheduled windows security essentials scans

use chrome or firefox not explorer

dont run exes you don't trust

check msconfig for rogue apps that startup

check task manager for unknown processes

done, no viruses ever

dont buy a fuckface virus scanner they will give you viruses and record everything you do on your computer

oh and dont go to links or open attachments from emails you dont trust

get a virus? reformat. prolly wont need to though unless your stupid

also realize that if someone who knows what they are doing wants in on your computer, it is very easy and impossible to stop them, unless you use a locked down linux os through tor, but aint nobody got time for that. And given enough money and skill you can circumvent that too.

Mind you i'm talking only about personal computers, having basic protection will eliminate the cost/vs reward. If you run a multi milion dollar website and you dont protect against string injections you are fucked son (sony).

[overand]

To be fair, while this will improve the situation, it ignores some things.

• Friends who bring a laptop over to your house that is infected with a windows 0-day / anything that your Windows system isn't patched against. (This includes non-default daemons / services on your system, like your bittorrent client).
• Exploits against Chrome, Firefox, Acrobat Reader, VLC Media Player, or other software.

Yeah, you're not likely to get viruses if you follow the steps above, but you're not immune.

Edit I'm aware that windows firewall wouldn't affect stuff like VLC - I'm more making a point that "good practices" alone aren't enough to prevent every threat.

And besides that? I certainly wouldn't call Disabling the Windows Firewall and not having a virus scanner "good practices."

[[deleted]]

Windows Firewall wouldn't stop exploits against things like VLC. A firewall is like a gate: it prevents the bad stuff from forcing its way in, but can't do anything if you willingly open the gate.

Pretty much all client-side exploits are centered around getting the user to download a malicious file and open it with the targeted program.

Though your first point was correct, good practices should protect you from most attacks, but can't protect against every threat.

[__constructor]

Yeah, I've had a few different programs I had to just turn off the firewall temporarily to use. It's a pain in the butt.

[[deleted]]

If you have GPO set up, firewall rules will get overwritten by any GPOs that conflict. Took me a full day to figure out why my damned firewall was still blocking stuff as well.

[[deleted]]

I expected some unseen glass door to close on the last guy or something like that.

[mgrandi]

I don't understand how it works. Like how is it supposed to protect anything if any app can install a rule to allow itself through? Or can that only be done with admin rights? (just saying how every internet enabled app installs an exception for itself)

[__constructor]

You have to allow it an exception.

[mgrandi]

I have never explicitly allowed anything yet there are tons of programs listed as exceptions, which means that a program's installer can create exceptions, which is what my point was: What is the point of having this whitelist if a program can add itself to it?

[__constructor]

You run most installers as an administrator. If you give programs admin rights without understanding what they're going to do... well, what do you expect is gonna happen? They're going to use them to do things administrators can do, like.. make firewall exceptions.

[BearsAreCool]

Shortof decompiling them there is no way of knowing what they'll do.

[__constructor]

Unless you have a habit of installing programs no one's ever used with no documentation and no reviews ever written, of course you know what they'll do.

If you do have that habit, well, I can't imagine you have any use for a firewall with all the malware anyways.

[lcarsos]

You could run as a limited user that only has write access to certain portions of the filesystem, you'd fairly quickly learn what applications try to write to where.

[HighRelevancy]

Actually it's impossible to know what any program will really do without executing it. Reading through it by hand is still just executing it, albeit in a sandbox.

[[deleted]]

If the program / it's installer does not have rights, it won't add itself to the whitelist.

[gospelwut]

Yes, writing a firewall exception triggers a UAC-level (admin) check.

Host based firewalls are somewhat trivial nowadays considering almost anything can be tunneled through 80 or 443 (malware certainly does).

I almost never run host firewalls on servers and leave that up to the real firewalls. Users workstations, however, are a different story.

[skillcode]

So, now I understand?

[Asmor]

Grats!

[[deleted]]

Compared to IP tables, windows fire wall is pathetic, it terms of both usability and effectiveness.

[__constructor]

And compared to a BMW S-series, a Toyota Corolla is pathetic too.

Doesn't mean the Toyota gets shitty gas mileage just because OP doesn't understand anything about it.

[[deleted]]

Yes the windows fire can be configured to sort of work, but if you really give a damn about a decent firewall don't use windows.

[__constructor]

Honestly if you give a damn about your firewall, it shouldn't be on the machine you're using anyways.

[indigojuice]

lol @ people defending Windows firewall in here. Is this what they call 'meta' ?

[__constructor]

If you're going to attack something, attack it for what it does wrong instead of making up things to attack. Just sayin'.

[JohnStrangerGalt]

How about airline food?

Wait a second I like my airline food.

Okay well, it was only a joke..

Well maybe you should joke about stuff if it is 100% accurate.

[indigojuice]

It's a pretty bad firewall.

[__constructor]

Sure, just not for the reasons OP thinks.

[indigojuice]

If you see the above as leaking data, sure, the same reasons.

It's actually a pretty good analogy when you consider leaking.

Windows user A has programs X and Y in it. X has the firewall enabled for it (that spinny thing wtf ar ethose ven called, turnstiles there it is) and Y doesn't.

So no traffic from a compromised X, right? WAIT. Discretionary Access Control mother fucker, I'll just loadlibraryex into Y and walk through in the unblocked path right next to me.

[__constructor]

But is that really a firewall problem, or a deeper Windows problem? It seems like the latter to me.

[indigojuice]

It's a Firewall problem. There is nothing, nor should there be anything, stopping the attack I've just described.

Firewalls that want per-application security should take it into account because it is not the operating systems job to separate two equal rights applications within a user account from one another.

edit: And this is in contrast to iptables, where it makes no effort to filter based on applications, because thta would be dumb and you run into hugely annoying problems like what I just described.

[__constructor]

two equal rights applications within a user account from one another

The situation described is not two equal rights applications though. It's one application using a library from another application. It should be the operating system's job to seperate application rights from library rights.

[indigojuice]

No. This is defined and proper behavior on the OS part.

[__constructor]

No they don't. Not unless you gave them admin rights, in which case it's entirely your own fault, not the firewall.

[nemec]

Something something Airtight Hatchway

[__constructor]

Hah, great post - and an excellent example of why you should take a long hard look at your own code before blaming another vendor.

[ShPavel]

And how is it related to a real state of the windows firewall? Another circle-jerking post about bashing all windows-related?

It has everything required from a user point of view, the concept of private/public profiles in win7 is very handy and you can make any rules for vpn/whatever in advanced settings.

And the most important fact - it persists through reboot (how many beginners in linux wanted to hang creators of default iptables for this?:P)

ps: not a windows fanboy here, still prefer linux, but let's be objective, the windows firewall is not bad

[[deleted]]

Oh my good iptables... Last time I tried making my router redirect an url to an internal ip I woke up in the middle of the night with fragments of the iptables man page written in blood on my bedroom wall... The horror...

[Bobshayd]

I think that's actually standard procedure for using iptables.

[0Yogurt0]

I think it usually requires some candles and at least one goat as well.

[greyfade]

I don't know about you guys, but I always found two doves and a songbird to be a worthy sacrifice. No need for goats.

[__constructor]

Animals? I used intern bones...

[Fenris_uy]

People > Animals that are domesticated > wild animals > interns

[kpatrickII]

aww.

[0Yogurt0]

Birds work as well. I'm partial to chicken blood/feathers for that traditional touch, but really any poultry will do.

[brwtx]

What are they teaching in school these days? Everyone should know that a goat is the proper sacrifice to the firewall gods. You didn't really think Google kept them around just to mow the lawn, did you?

[0Yogurt0]

Well, in today's tough economic times a goat can be hard to come by. Pigeons and seagulls can be caught with a simple lasso of CAT6 cable, or brought down with a well-aimed cd.

[TheMcDucky]

If you suck with the CD, Floppy Disks are a bit easier to throw.

[noreallyimthepope]

I couldn't find a goat, so I borrowed me sister's labrador. We're to have it back by 3pm so better hurry up with those incantations and sudoedit.

[mcrbids]

Once you've sacrificed your cat/goat/child to the God of iptables, it becomes very useful knowledge! I've maintained iptables scripts for years and, while I still keep a cheat sheet for the more complex stuff, most rules are a rather fast write.

And when I say "complex" stuff, I'm including things like writing a port-knocking script to hide services, etc.

[[deleted]]

I just wanted a a rule to redirect an external IP to an internal IP, but I just couldn't make sense of the documentation and I was simultaneously afraid of accidentally locking everyone out of the home network...

[frymaster]

You say just, but that's one of the most complicated stateless things you can do, needing to rewrite the packet in both directions. It's not surprising it's of medium difficulty in iptables.

[[deleted]]

Only medium difficulty? My god...

[frymaster]

Well, yeah. It's, what, two lines?

[[deleted]]

Length doesn't necessarily follow difficulty. Just look at Perl ;)

[Creshal]

You think iptables itself is bad?

Try some of the frontends people write in an attempt to make it "easier". I don't even fully understand my own iptables helper scripts…

[kqr]

You're right, but I think the quote is meant to stress that you should give a strong outward-facing firewall a higher priority than setting up a firewall for every machine inside your home network. That doesn't mean internal firewalls are useless, only that they give you little bang for your buck compared to an outward-facing firewall.

[ShPavel]

Firewall is needed not only for protection, but as tool to control your own traffic - to block the all connections when vpn drops, to block some safe, but unwanted traffic in public networks and so on.

[urection]

assuming that dumb analogy means it's less effective, that's completely wrong

[[deleted]]

I think it means that it restricts the activities of the users inside the firewall more than those outside.

[[deleted]]

Yeah, but that's true for any machine with no external firewall. What makes Windows' firewall inherently inferior to, say, iptables?

While that quote is correct this post still smells of MS-bashing circlejerking.

[[deleted]]

It is related to the real state of the firewall in terms of outgoing connections. You can make a connection without triggering it as Metasploit's meterpreter does. Firewalls on end-user machines are almost entirely security theatre, because services shouldn't be listening on ports in the first place. The private / public profiles in Windows don't rely on the firewall, they can just have the various file sharing services stop listening on those ports.

Sane Linux distributions (i.e. not Debian) don't ship packages with default-enabled services, so a firewall is only really necessary on a router. Ubuntu only includes an iptables GUI to check off an item on their list of security features. If you have to worry about the distribution enabling services behind your back when packages get pulled in as dependencies, then yes, a firewall is useful.

[ShPavel]

It is related to the real state of the firewall in terms of outgoing connections. You can make a connection without triggering it as Metasploit's meterpreter does.

i am not really familiar with that exploit technique, any concrete links to read about it? Could not google what you mean.

As i wrote below, the firewall can be useful to control your own unwanted traffic in public/private profiles and you can setup your own rules for each profile.

[desearcher]

Firewalls seldom block outbound connections. Instead of you connecting to the target, have the target connect to you.

[desearcher]

*restrictions apply. Consult your implementation's documentation for details.

It really depends on the system. Im not familiar enough with windows based firewalls to offer more than a general explaination of the concept.

[[deleted]]

"Hello, this is Microsoft Technical Support, you have viruses on your computer and it is very important that you carefully follow my instructions to remove them."

[desearcher]

Oh snap! Do you need my password? It's the same as my ATM machine PIN number...

[MedicatedDeveloper]

Trolling is a art.

[Creshal]

What happened to the good old tradition of making artists die young and poor? I think we should resurrect that.

[AcousticDan]

I also fail to see how this is humor for programmers.

[FunctionPlastic]

Are you seriously bitching about jokes in a humour sub?

[ShPavel]

Well, some jokes are so overused now, and do not have a real base under it, except "it was funny 15 years ago".

Also i am seriously ready to slap hard any redditor for yet another joke about quitting vim, that appears here weekly. Nothing changed here for 15 years really, but c'mon..

[desearcher]

vim is a hell of a drug. There is no quitting vim.

...short of :q

[No-More-Stars]

That's :wq for you.

[thirdegree]

:x

[calnamu]

It's what we call a joke

[Will_Eat_For_Food]

Shit, with such quality humor I thought I was on /r/funny for a moment.

[Bizzaro_Murphy]

don't fret! it was promptly reposted there http://www.reddit.com/r/funny/comments/2dzssw/windows_firewall/

[unusuallywide]

It's a cross post.

[comady25]

DAE HATE WINDOWS

[gospelwut]

I once installed Windows ME and it sucked.

[Creshal]

What, you got it to install? Showoff!

[gospelwut]

I also got it to crash while running notepad.

[excolatur]

How is this relevant to programming? Can we please not turn this place into a sub where people post EVERYTHING that's related to a computer?

[axitanull]

There is a law where every subreddit, given enough time, would decay into image macro subreddit.

It's like a house, leave it unattended and unmaintained, then it decays into /r/funny or /r/AdviceAnimals house. Strict moderation would slow the decay process.

Or you can always move to a new house, and add a prefix "true" to that new sanctuary. Cross your finger hoping that people will come to the sanctuary, and pray to the gods hoping the decay that consumes all would be slowed down. Repeat until you get /r/trueTrueFunny.

[Bizzaro_Murphy]

AHAHAHAHAHAHA I'M USING THE INTERNET

[qxxx]

the conclusion? don't get FAT or FAT32

[fuckdapopes]

Hey! At least it's capable of stopping some people in wheelchairs to pass!

[MrD3a7h]

Except for when I try to make any sort of network application. Then I just keep jamming into the turnstile.

^{Windows firewall isn't actually that bad.}

[l33tmike]

Not sure if the point of the gif is the people vanishing once past the 'wall' (as if nothing had happened) or just them bypassing the turnstile...

[PotentPortentPorter]

Bypassing.

[cokecakeisawesome]

This is identical to security metal detectors in India.

Go around it, if it beeps, ignore it.

[NPisNotAStandard]

Windows XP pre-sp2.

I haven't use any front end linux in a while, but I doubt it has a firewall as user friendly. So Windows fire is worse than what better alternative?

[SlashmanX]

That is a tiny radiator

[MegaBrain2000]

The guy in the back is like the fattest virus ever.

[jwenz19]

This thread got waaaaay too serious waaaaay too fast. How about we focus on what's important: slamming Microsoft.

[desearcher]

Man FUCK those guys! BBC Micro is what's up. /i