Windows Firewall Incoming Connections

Windows 10 Pro 22H2 19045.3208
Windows Firewall
Windows Firewall Control

Windows firewall block incoming connections
Domain:
When I check "block all incoming connections including those in the list of allowed apps". This box will not remain checked. I check it. I go back and look at it and it is unchecked. Why does this keep happening? I don't have this issue with Private and Public.


In addition to checking the block all incoming connections box, I have specific rules to block incoming connections for protocols and select IPs.

I am using Windows Firewall Control. When I checked the log today for "Allowed Incoming" connections, I found two incoming connections where the source IP was my computer and the Destination IPs were 35.244.212.184 and 104.18.1.2. Dest Port: 443.
I am puzzled. Why did that happen?

The other allowed incoming connections are:

Source Destination
my computer my router
0.0.0.0 255.255.255.255
127.0.0.1 127.0.0.1
::1 ::1



Thanks

The log should also say what was making the connection.

Q: Do you have Secure rules and Secure Profile enabled? IF not WFC can't prevent other programs from adding thier own allow rules.

The first IP is Google and the second is Cloudflare, normal if you are browsing (the second is useful for resilience).

The other allowed incoming connections you mention are all internal to your LAN - 3 are just loopback addresses and don't even leave your device.

What exactly are you worried about?

Sqrly and Rick C, thanks so much for replying.

Do you have Secure rules and Secure Profile enabled? IF not WFC can't prevent other programs from adding thier own allow rules.

No, I don't. I didn't check it because previously I hadn't deleted the default rules. I have since deleted all of the default rules. I just figured out how to create rules in WFC to block IGMP, ICMP, etc. I think I will be able to try that option.

What exactly are you worried about?
I have a series of incoming connections where my computer IP is listed as Remote and another IP is listed as local in WFC. I am unable to create a rule that blocks these connections. Yes, I have tried clicking on the entry and creating a block rule, it doesn't help. The number of connections keeps increasing. The majority are originating from google hosting.

Incoming Allowed Log entry
Name usually is DHCP Client. Program: svchost.exe . Source IP: my computer. Destination IP: 74.125.138.136. UDP. port: 443.
- When you click on this entry, the local address is listed as 74.125.138.136 and the remote IP is listed as my computer.

Occasionally the Name is Host Processes for Windows. Program: svchost.exe.

IP addresses from 11/5/23
09:31am. DHCP Client. 74.125.138.136. UDP port: 443
09:32am. DHCP Client. 74.125.138.136. UDP. port: 443
09:32am. DHCP Client. 108.177.122.94. UDP. port: 443
09:32am. DHCP Client. 173.194.60.38. UDP. port: 443
09:50am. DHCP Client. 172.217.215.91. UDP. port: 443
09:50am. DHCP Client. 173.194.144.70. UDP. port:443
09:50am. DHCP Client. 173.194.162.198. UDP. port: 443
09:50am. DHCP Client. 173.194.162.198. UDP. port: 443
12:58pm DHCP Client. 172.217.215.136. UDP. port: 443
13:30pm. DHCP Client. 74.125.136.136. UDP. port: 443
14:42pm. DHCP Client. 172.253.124.190. UDP. port: 443

Any thoughts are appreciated. I looking for a router with a firewall hoping that will help.