0

So we noticed a different behavior from W7 systems with no firewall/av to W10 systems with firewall/av that causes our thir-party clients to raise a false positive error that is new to these W10 firewalled systems.

The problem can summarize as we get a 'TimeOut' (Socket ErrorCode 10060) after more than 20s instead of getting almost instantly before a 'ConnectionRefused' (Socket ErrorCode 10061). Please note that the issue only manifests when our tcp socket server does not connect to clients yet on that port (process is not launched yet), it works fine when it is connecting so the port is not blocked by our firewall.

When disabling completely our firewall this issue disappears as Windows now again actively refuses connections, making our third party system to behave as expected again.

How to keep my FW on and it setup such as I get the old behavior on our new W10 firewalled server side machine (i.e. simply raise a connection refused (10061) error instead of a timeout (10060) error) ?

1 Answer 1

0

Answering my own question, I could disable this behavior in Windows by disabling the "StealthMode" in the registry firewall settings see:

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpfas/e0e681d3-0468-4796-b541-c5f9945041d8?redirectedfrom=MSDN

Of course it has a direct impact on security as now you won't get this extra protection, very similar to refusing to answer ping to prevent attackers to know that the target is alive. See also: https://superuser.com/questions/356043

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .