Win Firewall - How does it know good from bad?

Fabler2 · 25 Nov 2020

Just found One Click Firewall by Winaero that makes it even easier..
Download OneClickFirewall (winaero.com)

Sam Vimes · 28 Nov 2020

Thanks for the link to One Click Firewall.

I've been playing again with Zonealarm Free and it seems to work well apart from the nag ware to buy the pro version. At least it provides pop-ups the first time a service tries to access the internet at which point I make the decision to allow or block. It seems to have no adverse affect on performance.

I've also been playing with Glasswire. This is basically a Network Monitor but it links to the Windows Firewall. Within Glasswire you get the pop-ups the first time a service wants to access the internet and then if you decide to block it, it adds a rule to the Windows Firewall.

It has some good features that I like but I think it's too expensive. I'm waiting until my trial period expires and supposedly it just functions as a network monitor from then on. If it still provides the pop-ups I could add the rule to the Windows Firewall my self with something like OneClickFirewall.

TairikuOkami · 28 Nov 2020

ZAF has HIPS protection (like Comodo), it can catch a process trying to connect via an allowed process.
Microsoft Firewall relies on Defender to catch any malicious activity, but an outbound connection just ain't it.
On the other hand Microsoft Firewall allows more in-depth rules, so it depends, what you want, an example:

Code:

rem Rules for my email client, it is allowed to connect only to my DNS, my email providers, via safe ports. 

netsh advfirewall firewall add rule name="POP Peeper DNS" dir=out action=allow protocol=UDP remoteip=9.9.9.9,149.112.112.112 remoteport=53 program="%ProgramFiles(x86)%\POP Peeper\POPPeeper.exe"
netsh advfirewall firewall add rule name="POP Peeper eMail" dir=out action=allow protocol=TCP remoteip=94.100.176.0-94.100.183.255,217.69.136.0-217.69.141.255 remoteport=465,993 program="%ProgramFiles(x86)%\POP Peeper\POPPeeper.exe"
netsh advfirewall firewall add rule name="POP Peeper Mailo" dir=out action=allow protocol=TCP remoteip=213.182.55.192-213.182.55.223 remoteport=465,993,995 program="%ProgramFiles(x86)%\POP Peeper\POPPeeper.exe"