Windows Firewall misbehaving

Question

I'm trying to implement Windows firewalls on our servers, and I've come across an oddity that I could do with some advice on:

So I have a service listening on ports 8099-8102TCP, and a matching firewall rule:

New-NetFirewallRule -Enabled true -Direction Inbound -Action Allow -Profile Domain -LocalPort 8099-8102 -Protocol TCP -DisplayName "(Local) Salto mgmt TCP in"

(default action is to block all traffic)

However, this I still can't get at 8100TCP remotely. So I've checked for deny rules (which would take precendence), I see none. Next up, I do WTF auditing as per https://superuser.com/questions/1130078/how-to-tell-which-windows-firewall-rule-is-blocking-traffic - this gives me an event:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>5152</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12809</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2020-06-09T07:29:54.946996300Z" /> 
  <EventRecordID>900009</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="32" /> 
  <Channel>Security</Channel> 
  <Computer>ATWIN-SaltoT2.bathspa.ac.uk</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="ProcessId">4</Data> 
  <Data Name="Application">System</Data> 
  <Data Name="Direction">%%14592</Data> 
  <Data Name="SourceAddress">172.23.25.136</Data> 
  <Data Name="SourcePort">58740</Data> 
  <Data Name="DestAddress">172.23.28.3</Data> 
  <Data Name="DestPort">8100</Data> 
  <Data Name="Protocol">6</Data> 
  <Data Name="FilterRTID">165768</Data> 
  <Data Name="LayerName">%%14610</Data> 
  <Data Name="LayerRTID">44</Data> 
  </EventData>
  </Event>

So I get a dump of firewall rules:

netsh wfp show filters

This gives me the offending rule (I think, FilterRTID matches filterID):

<item>
            <filterKey>{3b80c06b-ca26-40d2-b265-82b304ff1dc9}</filterKey>
            <displayData>
                <name>Query User</name>
                <description>Prompt the User for a decision corresponding this Inbound Traffic</description>
            </displayData>
            <flags/>
            <providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
            <providerData>
                <data>cc03000000000000</data>
                <asString>........</asString>
            </providerData>
            <layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
            <subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
            <weight>
                <type>FWP_UINT8</type>
                <uint8>8</uint8>
            </weight>
            <filterCondition numItems="1">
                <item>
                    <fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
                    <matchType>FWP_MATCH_EQUAL</matchType>
                    <conditionValue>
                        <type>FWP_UINT32</type>
                        <uint32>3</uint32>
                    </conditionValue>
                </item>
            </filterCondition>
            <action>
                <type>FWP_ACTION_BLOCK</type>
                <filterType/>
            </action>
            <rawContext>0</rawContext>
            <reserved/>
            <filterId>165768</filterId>
            <effectiveWeight>
                <type>FWP_UINT64</type>
                <uint64>9223372036854776256</uint64>
            </effectiveWeight>
        </item>

Namely 'Query User'/'Prompt yhe User for a decision corresponding to Inbound Traffic'

So why isn't it using the rule I set, and here does this 'Prompt user' rule spring from? (and why is it not prompting me?)

Questions questions. Any advice would be really welcome.

Jim

Answer 1

OK, so I found that the setting 'Apply local firewall rules' was being set to 'no' by group policy:

this is confirmed in gpresult:

GPO: Server firewall - logging only
            Folder Id: SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AllowLocalPolicyMerge
            Value:       0, 0, 0, 0
            State:       Enabled

This is set to 'Not configured' in the 'Server firewall - logging only' policy. So I guess this is an implicit default option? (despite 'Yes' being te default). Its resolved my issue anyway.

Answer 2

A key thing that I haven't seen mentioned anywhere discussing the 'Query User' 'Prompt the User for a decision corresponding to Inbound Traffic' filter is that this "rule" actually seems to indicate that none of the other firewall rules match. It's more a default block than a specific block. In my case, it didn't have anything to do with displaying a notification at all! (they were disabled locally and in group policy)

Most people run into this because their local rules aren't being merged with their group policy rules, and the UI doesn't do a great job of indicating that (i.e. you can still add rules, they just get silently ignored). The solution for that is to fix group policy by enabling SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AllowLocalPolicyMerge.

In my case, however, the problem was that the default firewall rules for RADIUS/NPS are broken: https://windowsserver.uservoice.com/forums/295059-networking/suggestions/35724043-fix-default-nps-firewall-rules-for-server-2019

The workaround for that is make the service unrestricted with sc.exe sidtype IAS unrestricted