Allow/Block specific RPC interface UUIDs using the Windows Firewall

Question

Is it possible to block/allow certain RPC UUIDs using the Windows Firewall?

For example, Active Directory domain controller replication occurs using RPC over TCP via the drsuapi and dsaop RPC servers with UUIDs e3514235-4b06-11d1-ab04-00c04fc2dcd2 and 7c44d7d4-31d5-424c-bd5e-2b3e1f323d22, respectively. I would like to create a rule that allows this traffic only from domain controllers and maybe from IT administrator subnets. Allowing all RPC traffic is too broad as that increases the attack surface greatly since Windows exposes many other RPC servers(such as DCOM or the task scheduler). Is there any way I can restrict traffic at this level?

Answer 1

Yes, you can do this with the netsh rpc filter command, but documentation and examples are scarce. The best documentation is the netsh help:

netsh rpc filter add condition /?

Usage: add condition [field=]<string> [matchtype=]<string> [data=]<string>

Parameters:

       Tag           Value
       field       - One of the following values:
                     For layer = um
                         if_uuid if_version if_flag dcom_app_id image_name
                         protocol auth_type auth_level sec_encrypt_alg
                         sec_key_size remote_user_token local_addr_v4
                         local_addr_v6 remote_addr_v4 remote_addr_v6
                         local_port pipe
                     For layer = epmap
                         if_uuid if_version protocol auth_type auth_level
                         sec_encrypt_alg sec_key_size remote_user_token
                         local_addr_v4 local_addr_v6 remote_addr_v4
                         remote_addr_v6 local_port pipe
                     For layer = ep_add
                         process_with_if_uuid protocol ep_value ep_flags
                     For layer = proxy_conn
                         server_name server_port proxy_auth_type
                         client_token client_cert_key_name client_cert_oid
                     For layer = proxy_if
                         if_uuid if_version server_name server_port
                         proxy_auth_type client_token client_cert_key_length
                         client_cert_oid
       matchtype   - One of the following values:
                     equal
                     greater
                     less
                     greater_or_equal
                     less_or_equal
                     range
                     all_set
                     any_set
                     none_set
       data        - Value associated with the field paramter.

Remarks: Adds a condition to the RPC firewall rule.

Examples:

       add condition field=if_uuid matchtype=equal
                     data=11111111-1111-1111-1111-111111111111
       add condition field=protocol matchtype=equal data=ncacn_ip_tcp

netsh rpc filter add filter /?

Usage: add filter

Remarks: Adds an RPC firewall filter.
         A rule and one or more conditions must be added
         before adding a filter.


Example:

       add filter

netsh rpc filter add rule /?

Usage: add rule [layer=]<string> [actiontype=]<string> [[filterkey=]<string>]
             [[persistence=]volatile] [[audit=]enable]

Parameters:

       Tag           Value
       layer       - One of the following values:
                     um
                     epmap
                     ep_add
                     proxy_conn
                     proxy_if
       actiontype  - One of the following values:
                     block
                     permit
                     continue
       persistence - Filter will be persistent.
                     This is the default.
       filterkey   - Uuid to uniquely identify the RPC firewall filter.
       audit       - Enable auditing for this filter
                     Only permit action type is allowed for audit rules.
                     Audit rules are not allowed at ep_add layer.

Remarks: Adds an RPC firewall filter rule.

Examples:

       add rule layer=um actiontype=block
       add rule layer=epmap actiontype=permit
                filterkey=11111111-1111-1111-1111-111111111111

There are only a few examples I have ever found online, one is this KB article that has formatting messed up but I happen to have a formatted snapshot:

These two articles also have some interesting information:

https://support.microsoft.com/en-us/help/838191/list-of-remote-procedure-call-rpc-fixes-in-windows-xp-service-pack-2-a

https://docs.microsoft.com/en-us/windows/desktop/rpc/load-balancing-best-practices