Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure Windows Firewall on Server 2008 R2 to block everything except for the traffic that I add to the rule list.

I see there are three policies - public/private/domain. I've been making the same setting changes to each one, though I only have a single NIC and its assigned the domain policy.

In the domain policy properties I've set the Inbound Connections to "Block (default)" but this still let's ICMP through. I changed it to "block all connections" and created an inbound rule that allows ICMP from all three profiles, for all programs on all interfaces but this made the firewall drop ICMP traffic even though I have an allow rule created for it.

According to this documentation the allow rules are supposed to take precidence over default rules. I want to set my default rule to block all traffic and only allow certain traffic with allow rules.

I created two custom allow rules:

  1. Allow inbound ICMPv4 traffic for all programs/IP addresses.
  2. Allow inbound ICMPv6 traffic for all programs/IP addresses.

With the Inbound connections policy set to block all connections and the above allow rules enabled it still blocks my remote pings.

How do I configure Windows Firewall to do this?

Update - It turns out I was using the wrong GUI (embarrassing). Instead of using the GUI in Administrative Tools I was using the one in Group Policy editor (which happen to look identical). There were already rules set on the firewall that I couldn't see in the group policy editor. These rules were taking effect without me realizing it which caused my confusion. To do what I wanted I just had to set the policy to "Block (default)" (with the right tool of course). After deleting all the pre-existing rules (that I didn't see with the group policy editor) I was able to only allow the traffic that I wanted by creating specific allow rules.

share|improve this question
    
Look at the link in my answer, by using a Block all connections rule, you are overriding any other inbound allow rules –  Alex Feb 8 '13 at 21:23

2 Answers 2

up vote 2 down vote accepted

I see there are three policies - public/private/domain. I've been making the same setting changes to each one, though I only have a single NIC and its assigned the domain policy.

As an aside, making changes to the firewall policies for public and private won't have any effect as long as your NIC is still using the Domain network profile.

According to this documentation the allow rules are supposed to take precidence over default rules. I want to set my default rule to block all traffic and only allow certain traffic with allow rules.

You are doing this the hard way. The the default policy of the Domain profile implements a default deny ingress policy and a default allow egress (i.e, Inbound connections are blocked and Outbound connections are allowed.) If you've changed these defaults you can set them back in the Windows Firewall Properties dialog.

Then to enable ICMP traffic enable the following two allow rules:

   File and Printer Sharing (Echo Request - ICMPv4-In)
   File and Printer Sharing (Echo Request - ICMPv6-In)
share|improve this answer
    
I created two explicit allow rules for ICMPv4 and ICMPv6 but the traffic is still blocked with Inbound connections set to "block all connections". –  Andy Arismendi Feb 8 '13 at 21:25
    
You're doing this the hard way. The Domain profile by default will implement a default deny ingress policy and a default allow egress policy. Turn off your "block all connections" and turn on the ICMP allow rules. –  kce Feb 8 '13 at 21:30
    
I actually don't want ICMP enabled. I was just using that as a test. My goal is to block everything except for what I explicitly allow. –  Andy Arismendi Feb 8 '13 at 21:32
    
Again. This should be the default policy of the Domain profile. –  kce Feb 8 '13 at 21:35
    
Yes but the default for domain -- "Block (default)" allows ICMP. That doesn't mean block to me. What else doesn't it block? –  Andy Arismendi Feb 8 '13 at 21:39

When you have more then one rule matching your traffic, the Block one will have precedence.

Unless you select Override Block Rules option in your Allow rule.

Also, when using a Block all connection rule, the Override option won't work.

Sorry, I just re-read the documentation.

In a Nutshell, I believe what you are hopping to achieve is not quite possible with Windows Firewall.

Unfortunately, it doesn't work like network firewalls. I.e. read rules from top to bottom and use the first that match.

I you have rules with both Allow and Block that will match traffic, then it will Block.

Rules Action Explained

Where to find Override block rules

share|improve this answer
    
I didn't see where to set that flag in the GUI. Also I see in documentation you linked this -- "Also, if you have configured Inbound connections to be Block all connections under State on the Windows Firewall with Advanced Security Properties dialog box, then the connections will be blocked regardless of this option's setting." –  Andy Arismendi Feb 8 '13 at 21:23
    
@AndyArismendi yes, the Block all connections is like a Über block. Its used to ensure nothing will go in even if you have rules stating otherwise. –  Alex Feb 8 '13 at 21:36
    
Ok I found where to set that flag, when creating the rule. I had to select "Allow the connection if it is secure" instead of the "Allow the connection" option. The problem is that when I do this it forces me to select specific remote machines to allow the connection from. I want to allow it from all remote machines. –  Andy Arismendi Feb 8 '13 at 21:37
    
If its secure means encrypted (ipsec) that wont work eighter. Just set it to allow with override block and you will be fine. –  Alex Feb 8 '13 at 21:38
    
"Rules that override block rules must specify at least one computer or computer group for authorization." -- not what I want. –  Andy Arismendi Feb 8 '13 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.