How can adding a 'only allow connections to these computers' setting in an an otherwise working IPSec rule break connectivity?
I'm setting up a basic set of client rules that restrict outbound SMB access to only go to certain servers. Assume starting from a blacklist and needing to whitelist the desired communication.
The server side is set up and functioning as it should without any problems what so ever. Set up was configured using the legacy IPSec interface server side and with the windows advanced firewall client side.
First authentication is set to Kerberos (Computer) or computer certificate. Both sides use 'request inbound and outbound' for their authentication mode.
Both sides use a 'request ipsec' model as there may be non IPSec traffic passing to other devices.
The Windows Advanced Firewall rule on the client functions perfectly until I define the 'only allow connections to these computers' option.
A wireshark capture shows ISAKMP and ESP traffic and I'm seeing main mode and quick mode associations in the security association list.
Per the MS documentation I've enabled the following logging to debug my connection issue.
auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable auditpol /set /subcategory:"IPsec Driver" /success:enable /failure:enable auditpol /set /subcategory:"IPsec Main Mode" /success:enable /failure:enable auditpol /set /subcategory:"IPsec Quick Mode" /success:enable /failure:enable auditpol /set /subcategory:"IPsec Extended Mode" /success:enable /failure:enable
This only indicates the given service - I tried both SMB and RDP - being blocked. I'm not seeing any other blocked traffic.
It looks like there is absolutely no traffic being passed to the server in question when I enable the SMB or RDP rule. Wireshark shows nothing. Looks like there was a case like this a couple years ago here but no resolution.
It appears that the Windows Filtering Platform is incorrectly blocking this traffic when it should be allowing it.
The Windows Filtering Platform has blocked a connection. Application Information: Process ID: 2468 Application Name: \device\harddiskvolume1\windows\system32\mstsc.exe Network Information: Direction: Outbound Source Address: 192.168.20.54 Source Port: 49332 Destination Address: 192.168.100.50 Destination Port: 3389 Protocol: 6