Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We would like to distribute a firewall program with our product.

I can configure the Windows Firewall to block outgoing connections (which it does not by default)

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

But then I need to know when one is blocked so it can ask if it should be unblocked.

I tried turning on logging, but it does not log the path to the exe. Is there a way to get that logged?

I posted a question on StackOverflow to try an event detection method, but if there was a way to turn on logging of the path to the exe, I wanted to know about it. I hope to stay with Java which is limited in event detection.

I don't mind calling any command-line programs, also don't mind using vbscripts. But what I need is to know as soon as an outgoing connection from an exe is blocked and which exe.

share|improve this question
    
Is this a one-time thing for something you're testing, or something you need to know as a function of your program? I don't think the ability is built in to Windows firewall but there were third-party applications that did. –  Bart Silverstrim Sep 28 '11 at 16:16
    
Whatever solution needs to be distributed with my program. It is not a one time thing. If there was a third-party program that I could control through the command-line it might be acceptable, but it is probably going to be necessary for us to control all the GUIs, and we do not want to have to pay for it. –  George Bailey Sep 28 '11 at 18:07

2 Answers 2

I believe this is what you are looking for: application logging

Once this is configured it will be logged in the system log and the application name will be listed.

share|improve this answer
    
I will see if this will work when I have time. I am busy now. –  George Bailey Sep 28 '11 at 18:33
    
This may be helpful. I figured out how to use auditpol to turn on auditing for the necessary events, but where does this go? I have not yet seen how to get to the event log except via a GUI. I will look further later, but additional info would be helpful. –  George Bailey Oct 4 '11 at 17:08

This vbscript will enumerate through the Windows Firewall rule settings:

'  This VBScript file includes sample code that enumerates
'  Windows Firewall rules using the Microsoft Windows Firewall APIs.


Option Explicit

Dim CurrentProfiles
Dim InterfaceArray
Dim LowerBound
Dim UpperBound
Dim iterate
Dim rule

' Profile Type
Const NET_FW_PROFILE2_DOMAIN = 1
Const NET_FW_PROFILE2_PRIVATE = 2
Const NET_FW_PROFILE2_PUBLIC = 4

' Protocol
Const NET_FW_IP_PROTOCOL_TCP = 6
Const NET_FW_IP_PROTOCOL_UDP = 17
Const NET_FW_IP_PROTOCOL_ICMPv4 = 1
Const NET_FW_IP_PROTOCOL_ICMPv6 = 58

' Direction
Const NET_FW_RULE_DIR_IN = 1
Const NET_FW_RULE_DIR_OUT = 2

' Action
Const NET_FW_ACTION_BLOCK = 0
Const NET_FW_ACTION_ALLOW = 1


' Create the FwPolicy2 object.
Dim fwPolicy2
Set fwPolicy2 = CreateObject("HNetCfg.FwPolicy2")

CurrentProfiles = fwPolicy2.CurrentProfileTypes

'// The returned 'CurrentProfiles' bitmask can have more than 1 bit set if multiple profiles 
'//   are active or current at the same time

if ( CurrentProfiles AND NET_FW_PROFILE2_DOMAIN ) then
   WScript.Echo("Domain Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PRIVATE ) then
   WScript.Echo("Private Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PUBLIC ) then
   WScript.Echo("Public Firewall Profile is active")
end if

' Get the Rules object
Dim RulesObject
Set RulesObject = fwPolicy2.Rules

' Print all the rules in currently active firewall profiles.
WScript.Echo("Rules:")

For Each rule In Rulesobject
    if rule.Profiles And CurrentProfiles then
        WScript.Echo("  Rule Name:          " & rule.Name)
        WScript.Echo("   ----------------------------------------------")
        WScript.Echo("  Description:        " & rule.Description)
        WScript.Echo("  Application Name:   " & rule.ApplicationName)
        WScript.Echo("  Service Name:       " & rule.ServiceName)
        Select Case rule.Protocol
            Case NET_FW_IP_PROTOCOL_TCP    WScript.Echo("  IP Protocol:        TCP.")
            Case NET_FW_IP_PROTOCOL_UDP    WScript.Echo("  IP Protocol:        UDP.")
            Case NET_FW_IP_PROTOCOL_ICMPv4 WScript.Echo("  IP Protocol:        UDP.")
            Case NET_FW_IP_PROTOCOL_ICMPv6 WScript.Echo("  IP Protocol:        UDP.")
            Case Else                      WScript.Echo("  IP Protocol:        " & rule.Protocol)
        End Select
        if rule.Protocol = NET_FW_IP_PROTOCOL_TCP or rule.Protocol = NET_FW_IP_PROTOCOL_UDP then
            WScript.Echo("  Local Ports:        " & rule.LocalPorts)
            WScript.Echo("  Remote Ports:       " & rule.RemotePorts)
            WScript.Echo("  LocalAddresses:     " & rule.LocalAddresses)
            WScript.Echo("  RemoteAddresses:    " & rule.RemoteAddresses)
        end if
        if rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv4 or rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv6 then
            WScript.Echo("  ICMP Type and Code:    " & rule.IcmpTypesAndCodes)
        end if
        Select Case rule.Direction
            Case NET_FW_RULE_DIR_IN  WScript.Echo("  Direction:          In")
            Case NET_FW_RULE_DIR_OUT WScript.Echo("  Direction:          Out")
        End Select
        WScript.Echo("  Enabled:            " & rule.Enabled)
        WScript.Echo("  Edge:               " & rule.EdgeTraversal)
        Select Case rule.Action
            Case NET_FW_ACTION_ALLOW  WScript.Echo("  Action:             Allow")
            Case NET_FW_ACTION_BLOCk  WScript.Echo("  Action:             Block")
        End Select
        WScript.Echo("  Grouping:           " & rule.Grouping)
        WScript.Echo("  Edge:               " & rule.EdgeTraversal)
        WScript.Echo("  Interface Types:    " & rule.InterfaceTypes)
        InterfaceArray = rule.Interfaces
        if IsEmpty(InterfaceArray) then
            WScript.Echo("  Interfaces:         All")
        else
            LowerBound = LBound(InterfaceArray)
            UpperBound = UBound(InterfaceArray)
            WScript.Echo("  Interfaces:     ")
            for iterate = LowerBound To UpperBound
                WScript.Echo("       " & InterfaceArray(iterate))
            Next
        end if

        WScript.Echo("")
    end if
Next

It came from here, which should set you on the path in the right direction.

share|improve this answer
    
I already know how to see all the rules, I need to know when an exe is blocked by a "default deny outbound rule". Then I need to know which exe is blocked. Correct me if I'm wrong, but I think this answer is not helpful for that because the script and all the links on the MSDN page seem to only talk about the rules, not adding exe to the logging. (I fixed the problem in my question, that might have been confusing) (I am not saying that what I want is possible, but I just want to know how to do it if it is possible) –  George Bailey Sep 28 '11 at 16:08
    
I'm not sure the Windows firewall blocks anything outbound by default. –  GregD Sep 28 '11 at 16:15
    
The default setting is to block incoming by default and allow outgoing by default. I change that using netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound. After running that, both outbound and inbound are blocked, unless one of the rules states otherwise. –  George Bailey Sep 28 '11 at 18:05
    
Ah, it's your use of the term "default". Windows Firewall by "default" allows all outbound. You alter "default" by running your netsh command to block all inbound and all outbound, which is no longer "default"...overly pedantic I know...but it's important in some contexts..LOL –  GregD Sep 28 '11 at 18:17
    
Yea, I know. :) –  George Bailey Sep 28 '11 at 18:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.