(Note: I went through the related questions list and couldn't find one that answers this situation.)

I'm running into an issue whose cause is difficult to spot but is easy to describe: if Windows Firewall and some related services (Windows Firewall, IKE, IPSec Policyagent, Base Filtering Engine) are stopped, then IIS performance doubles (from aprox. 650 to 1300 RPS).

Needless to say, stopping Windows Firewall is not an option.

Repro scenario is plain simple: just create an IIS web site and serve a single image i.e. http://server:9876/image.png. While CPU stays low with and without firewall enabled, CPU Privileged Time % increases in comparison with User Time %.

Has someone seen this before? Are we missing a configuration setting or else?

Environment is Windows Server Enterprise 2008 SP2, II7. Thanks.

  • Why is stopping the Windows Firewall not an option? Dec 17, 2009 at 16:53
  • Wow, server asked to do twice the work is only half as fast shock! If you really need the performance move your firewalling off the box.
    – Chopper3
    Dec 17, 2009 at 17:41

5 Answers 5


Of course the Windows Firewall will degrade performance.

It has to inspect all packets in and out of the server.

That takes CPU.

If you need to increase performance on the server, then you will have to turn off the Windows Firewall and install a hardware firewall instead.

  • I understand that, but still, 50% performance degradation sounds a lot, and without CPU going more than say 20%... Thanks.
    – Ariel
    Dec 17, 2009 at 17:00
  • Deep packet inspection is not cheap. Dec 17, 2009 at 17:04
  • Plus the time to inspect the entire packet of you image may be substantially higher that the time necessary to simply serve it up with the Windows Firewall off. The real question is... How much overhead does the Windows Firewall have when the server is under real load and executing real web pages? Dec 17, 2009 at 17:06
  • @Jeffrey Does Windows Firewall do DPI? Netfilter on Linux and pf on *BSD can do quite a bit of packet inspection and mangling without a 50% performance drop. I'd expect Windows Firewall to have similar characteristics. Dec 18, 2009 at 17:53

Might I ask why stopping Windows Firewall is not an option? If you're running IIS from a computer within your organization, I would argue that it would be better to have a hardware firewall setup in front of your network, rather than relying on a software firewall such as Windows. Even if this is a personal machine, I wouldn't connect a computer directly to a network without some sort of hardware firewall up in the first place.


If you don't do anything specific only to the Windows Firewall, you might try an alternative firewall, maybe it'll do better. I'm writing this with wipfw in mind.


Is Windows Firewall is interfering with TCP offloading? KB 951037 says it may or may not depending on your implementation.


I wonder if it is because you are using a non-standard port 9876 for HTTP traffic. Have you tried on IIS' default HTTP port 80? Does that yield the same results?

If that's the same result, then I doubt there's much you can do, apart from turning Windows Firewall off.

Software firewalls do carry overhead.

  • Actually issue got detected on 80, so port is not the problem. Thanks anyway.
    – Ariel
    Dec 17, 2009 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .