4

Does anyone know if it is possible to configure the behaviour of Windows Firewall when it has determined that a packet is disallowed?

By default, it will silently discard the packet and the source is not notified that this has happened, leading to potentially lengthly wait times at the source before the connection timeout ellapses. For a given TCP connection, I want to send a RST packet to an incoming SYN packet that has been disallowed, rather than silently discarding it.

One of my 2K3 boxes does this, but my XP SP3 machine does not. My XP SP3 laptop also used to do it, but my Win7 laptop does not.

The reason this has come about is that I regularly have to connect to several internal Linux based boxes via telnet (they do not have, nor am I able to install, SSH) and they will attempt to use ident to identify me before presenting a username/password prompt. When I connect from the 2K3 server the prompt is instant because the incoming ident packet is actively blocked, but from my XP machine I have to wait around 20 seconds because the remote host is not notified of the blocking. This is not a security thing - everything is local and in no way exposed to the internet, I have 2 firewalls between these local machines and the WAN.

I have done some considerable Googling on the subject and the closest I have come to finding any references to this behaviour is this technet article, but it seems to directly contradict the fact that I get the desired behaviour on one of my boxes. It also contains no information about how configure this type of behaviour, although reading between the lines I think this is a function of the TCP/IP stack, rather than Windows Firewall itself - it seems that the TCP/IP stack (NAT driver) asks the firewall whether a packet is allowed, then handles the action itself.

Before you ask, no, there is definitely no 3rd party firewall software installed on the 2K3 box - neither was there on my old laptop - it is/was just Windows Firewall. The configuration interface is indentical to that of the XP box I am using to write this question. I am fully aware this will most likely involve playing with registry settings, but I have no idea where to start...

3 Answers 3

2

While you have the option to reject connection attempts with an RST or an ICMP-destination-unreachable message with many packet filters, the Windows Firewall seems not to be configurable at this point. The difference in observed behavior is probably due to a disabled firewall - in this case the TCP/IP stack itself would simply send a RST response if the IDENT port is not open.

As a workaround for your case I would recommend exactly this - do add port 113/tcp to the list of exceptions for Windows Firewall. As long as nothing is listening at port 113, you will see the desired RST response from the stack instead of a a series of SYN timeouts and retransmits.

2
  • The firewall is definitely enabled on both machines, however your suggested work-around does indeed give the desired behaviour. Many thanks!
    – DaveRandom
    Sep 28, 2011 at 8:44
  • You are welcome, glad it worked out for you.
    – the-wabbit
    Sep 28, 2011 at 11:39
7

Reason - http://technet.microsoft.com/en-us/library/dd448557%28WS.10%29

Fix - http://msdn.microsoft.com/en-us/library/ff720058%28v=prot.10%29.aspx

If Keys/values don't exist - create it. After changes need to restart windows firewall service.

1
  • Just in case those links ever stop working - the feature is called "stealth mode" and is meant to make a target computer less visible on the network and to make it harder to find open ports in the firewall, by blocking outgoing TCP reset messages for an open port when no application is listening on that port. Dec 5, 2021 at 22:51
0

On your Win2k3 box & XP SP3 laptop, are your running any service that is listening on the local port ident is querying for?

The RST could be send e.g. in response to receiving a packet for a closed socket.

4
  • netstat -o shows nothing on TCP:113
    – DaveRandom
    Sep 26, 2011 at 12:22
  • Also I don't actually know of a way to write an application that does this. Every socket programming API I have ever worked with in every programming language only provides accept(), it does not provide reject() (or similar) - I have previously worked around this problem by writing a program to accept() then close() every incoming connection request, but it is messy and I don't like it - I'm sure there must be some setting somewhere that will get Windows to handle it for me.
    – DaveRandom
    Sep 26, 2011 at 12:32
  • Maybe port TCP:113 is open on the 2k3 box & sp3 laptop? Sep 26, 2011 at 13:06
  • Nope, identical configuration (from that point of view) on all machines. I have considered actually writing an ident server to bypass the prompt altogether, but even so I would like to know for future reference. Annoyingly (although sort of not) the server never used to do it, it used to have the same issue, but after a Windows update about 6 months ago, started producing the desired behaviour.
    – DaveRandom
    Sep 26, 2011 at 13:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .