4

We would like to distribute a firewall program with our product.

I can configure the Windows Firewall to block outgoing connections (which it does not by default)

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

But then I need to know when one is blocked so it can ask if it should be unblocked.

I tried turning on logging, but it does not log the path to the exe. Is there a way to get that logged?

I posted a question on StackOverflow to try an event detection method, but if there was a way to turn on logging of the path to the exe, I wanted to know about it. I hope to stay with Java which is limited in event detection.

I don't mind calling any command-line programs, also don't mind using vbscripts. But what I need is to know as soon as an outgoing connection from an exe is blocked and which exe.

  • Is this a one-time thing for something you're testing, or something you need to know as a function of your program? I don't think the ability is built in to Windows firewall but there were third-party applications that did. – Bart Silverstrim Sep 28 '11 at 16:16
  • Whatever solution needs to be distributed with my program. It is not a one time thing. If there was a third-party program that I could control through the command-line it might be acceptable, but it is probably going to be necessary for us to control all the GUIs, and we do not want to have to pay for it. – Bryan Field Sep 28 '11 at 18:07
2

p0rkjello answered correctly but left key things, after struggling for hours I found the solution.

  1. Open CMD with administrator privilege, paste command auditpol /set /subcategory:"{0CCE9226-69AE-11D9-BED3-505054503030}" /success:disable /failure:enable
  2. Open event viewer and go to Windows logs > Security
  3. From right side panel select Filter log > Keywords > Select "Audit failure"

Information that can be found here are application name, destination IP, connection direction and more

|improve this answer|||||
  • Thanks ZaHeer, this worked great, and saved me lots of trial-and-error trying to set up outbound firewall rules. Previously I was just looking at the default Windows Firewall log, C:\Windows\System32\LogFiles\Firewall\pfirewall.log, which lacks the executable name: e.g. 2017-09-16 19:02:55 DROP TCP 192.168.1.100 64.141.25.122 53108 80 0 - 0 0 0 - - - SEND 2017-09-16 19:02:55 DROP TCP 192.168.1.100 96.45.33.105 53109 80 0 - 0 0 0 - - - SEND . With these settings and Event Viewer, I can see the process ID and executable - no more guesswork! – Conrad Poelman Sep 16 '17 at 23:08
1

I believe this is what you are looking for: application logging

Once this is configured it will be logged in the system log and the application name will be listed.

|improve this answer|||||
  • I will see if this will work when I have time. I am busy now. – Bryan Field Sep 28 '11 at 18:33
  • This may be helpful. I figured out how to use auditpol to turn on auditing for the necessary events, but where does this go? I have not yet seen how to get to the event log except via a GUI. I will look further later, but additional info would be helpful. – Bryan Field Oct 4 '11 at 17:08
1

As it has been pointed out by the link, a right source is auditing events of the Windows Filtering Platform. We can output needed data with the following cmd-script:

@echo off
for /f "tokens=2 delims==" %%s in ('wmic os get LocalDateTime /value') do set datetime=%%s
auditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030} /failure:enable > nul
pause
wmic ntevent where "LogFile='security' AND EventCode = 5152 AND TimeGenerated > '%datetime%'" get InsertionStrings
auditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030} /failure:disable > nul

"{0CCE9225-69AE-11D9-BED3-505054503030}" is the GUID of an event "Filtering Platform Packet Drop", 5152 is it's code. At the pause time run a program / program's action of interest and resume the script when a test finishes. Sample output:

InsertionStrings

{"504", "\device\harddiskvolume2\windows\system32\svchost.exe", "%%14592", "10.0
.0.254", "67", "255.255.255.255", "68", "17", "89509", "%%14610", "44"}
{"3348", "\device\harddiskvolume2\another\program.exe", "%%14593", "10.0.0.1", "
52006", "123.123.123.123", "80", "6", "89523", "%%14611", "48"}

With get Message /value instead of get InsertionStrings in wmic command, output is more informative but also much longer:

Message=The Windows Filtering Platform has blocked a packet.

Application Information:
        Process ID:             3128
        Application Name:       \device\harddiskvolume2\path\to\program.exe

Network Information:
        Direction:              Outbound
        Source Address:         10.0.0.1
        Source Port:            50099
        Destination Address:    1.2.3.4
        Destination Port:               80
        Protocol:               6

Filter Information:
        Filter Run-Time ID:     69203
        Layer Name:             Connect
        Layer Run-Time ID:      48

These are just excerpts from the security log, which are accessible in GUI too.

|improve this answer|||||
-1

This vbscript will enumerate through the Windows Firewall rule settings:

'  This VBScript file includes sample code that enumerates
'  Windows Firewall rules using the Microsoft Windows Firewall APIs.


Option Explicit

Dim CurrentProfiles
Dim InterfaceArray
Dim LowerBound
Dim UpperBound
Dim iterate
Dim rule

' Profile Type
Const NET_FW_PROFILE2_DOMAIN = 1
Const NET_FW_PROFILE2_PRIVATE = 2
Const NET_FW_PROFILE2_PUBLIC = 4

' Protocol
Const NET_FW_IP_PROTOCOL_TCP = 6
Const NET_FW_IP_PROTOCOL_UDP = 17
Const NET_FW_IP_PROTOCOL_ICMPv4 = 1
Const NET_FW_IP_PROTOCOL_ICMPv6 = 58

' Direction
Const NET_FW_RULE_DIR_IN = 1
Const NET_FW_RULE_DIR_OUT = 2

' Action
Const NET_FW_ACTION_BLOCK = 0
Const NET_FW_ACTION_ALLOW = 1


' Create the FwPolicy2 object.
Dim fwPolicy2
Set fwPolicy2 = CreateObject("HNetCfg.FwPolicy2")

CurrentProfiles = fwPolicy2.CurrentProfileTypes

'// The returned 'CurrentProfiles' bitmask can have more than 1 bit set if multiple profiles 
'//   are active or current at the same time

if ( CurrentProfiles AND NET_FW_PROFILE2_DOMAIN ) then
   WScript.Echo("Domain Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PRIVATE ) then
   WScript.Echo("Private Firewall Profile is active")
end if

if ( CurrentProfiles AND NET_FW_PROFILE2_PUBLIC ) then
   WScript.Echo("Public Firewall Profile is active")
end if

' Get the Rules object
Dim RulesObject
Set RulesObject = fwPolicy2.Rules

' Print all the rules in currently active firewall profiles.
WScript.Echo("Rules:")

For Each rule In Rulesobject
    if rule.Profiles And CurrentProfiles then
        WScript.Echo("  Rule Name:          " & rule.Name)
        WScript.Echo("   ----------------------------------------------")
        WScript.Echo("  Description:        " & rule.Description)
        WScript.Echo("  Application Name:   " & rule.ApplicationName)
        WScript.Echo("  Service Name:       " & rule.ServiceName)
        Select Case rule.Protocol
            Case NET_FW_IP_PROTOCOL_TCP    WScript.Echo("  IP Protocol:        TCP.")
            Case NET_FW_IP_PROTOCOL_UDP    WScript.Echo("  IP Protocol:        UDP.")
            Case NET_FW_IP_PROTOCOL_ICMPv4 WScript.Echo("  IP Protocol:        UDP.")
            Case NET_FW_IP_PROTOCOL_ICMPv6 WScript.Echo("  IP Protocol:        UDP.")
            Case Else                      WScript.Echo("  IP Protocol:        " & rule.Protocol)
        End Select
        if rule.Protocol = NET_FW_IP_PROTOCOL_TCP or rule.Protocol = NET_FW_IP_PROTOCOL_UDP then
            WScript.Echo("  Local Ports:        " & rule.LocalPorts)
            WScript.Echo("  Remote Ports:       " & rule.RemotePorts)
            WScript.Echo("  LocalAddresses:     " & rule.LocalAddresses)
            WScript.Echo("  RemoteAddresses:    " & rule.RemoteAddresses)
        end if
        if rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv4 or rule.Protocol = NET_FW_IP_PROTOCOL_ICMPv6 then
            WScript.Echo("  ICMP Type and Code:    " & rule.IcmpTypesAndCodes)
        end if
        Select Case rule.Direction
            Case NET_FW_RULE_DIR_IN  WScript.Echo("  Direction:          In")
            Case NET_FW_RULE_DIR_OUT WScript.Echo("  Direction:          Out")
        End Select
        WScript.Echo("  Enabled:            " & rule.Enabled)
        WScript.Echo("  Edge:               " & rule.EdgeTraversal)
        Select Case rule.Action
            Case NET_FW_ACTION_ALLOW  WScript.Echo("  Action:             Allow")
            Case NET_FW_ACTION_BLOCk  WScript.Echo("  Action:             Block")
        End Select
        WScript.Echo("  Grouping:           " & rule.Grouping)
        WScript.Echo("  Edge:               " & rule.EdgeTraversal)
        WScript.Echo("  Interface Types:    " & rule.InterfaceTypes)
        InterfaceArray = rule.Interfaces
        if IsEmpty(InterfaceArray) then
            WScript.Echo("  Interfaces:         All")
        else
            LowerBound = LBound(InterfaceArray)
            UpperBound = UBound(InterfaceArray)
            WScript.Echo("  Interfaces:     ")
            for iterate = LowerBound To UpperBound
                WScript.Echo("       " & InterfaceArray(iterate))
            Next
        end if

        WScript.Echo("")
    end if
Next

It came from here, which should set you on the path in the right direction.

|improve this answer|||||
  • I already know how to see all the rules, I need to know when an exe is blocked by a "default deny outbound rule". Then I need to know which exe is blocked. Correct me if I'm wrong, but I think this answer is not helpful for that because the script and all the links on the MSDN page seem to only talk about the rules, not adding exe to the logging. (I fixed the problem in my question, that might have been confusing) (I am not saying that what I want is possible, but I just want to know how to do it if it is possible) – Bryan Field Sep 28 '11 at 16:08
  • I'm not sure the Windows firewall blocks anything outbound by default. – GregD Sep 28 '11 at 16:15
  • The default setting is to block incoming by default and allow outgoing by default. I change that using netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound. After running that, both outbound and inbound are blocked, unless one of the rules states otherwise. – Bryan Field Sep 28 '11 at 18:05
  • Ah, it's your use of the term "default". Windows Firewall by "default" allows all outbound. You alter "default" by running your netsh command to block all inbound and all outbound, which is no longer "default"...overly pedantic I know...but it's important in some contexts..LOL – GregD Sep 28 '11 at 18:17
  • Yea, I know. :) – Bryan Field Sep 28 '11 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.