Windows Embedded Firewall Configuration (Prevent LAN Snooping)

[Intuit]

Remember Kerio from the Windows XP days?
Used to use that in manual config mode to *very* closely taylor OUTBOUND traffic on my system.

Well, ever since we lost that, have been using the Windows Embedded firewall.
It's not as smart as Kerio since it only validates by path, rather than binary signature, but it's better than nothing.

Anyway, in past SecurityNOW! shows, it became apparent that concerns were growing over LAN snooping by scripts running on websites.

Outbound firewall on, this is how you prevent that.

I do this for all of my web browsers also...

Plenty of other options to be aware of also...

 

[Intuit]

If you have any experience with firewalls that were like the ancient Kerio product, (but updated with modern features of course,) let me know.

 

[Intuit]

To view the Windows Firewall Logging...

Elevated Command Prompt:

start "PFirewall.Log" tail -f %systemroot%\system32\logfiles\firewall\pfirewall.log

You have limited ability to customize the logging from the "WF.MSC" utility.

The Embedded Windows Firewall logging by the way doesn't tie traffic to a specific process; so must rely on some other tools, including ProcMon, TCPView, and/or looping "NetStat -ANO" to do that.

ProcMon Rulebase here...
ProcessMonitor-NetworkLogger17y09m06d.Reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\sysinternals\Process Monitor]
"Filter#NetworkLogger.17y09m06d"=hex:01,17,00,00,00,75,9c,00,00,00,00,00,00,00,\
  18,00,00,00,50,00,72,00,6f,00,63,00,6d,00,6f,00,6e,00,2e,00,65,00,78,00,65,\
  00,00,00,00,00,00,00,00,00,00,00,75,9c,00,00,00,00,00,00,00,1c,00,00,00,50,\
  00,72,00,6f,00,63,00,6d,00,6f,00,6e,00,36,00,34,00,2e,00,65,00,78,00,65,00,\
  00,00,00,00,00,00,00,00,00,00,77,9c,00,00,04,00,00,00,00,10,00,00,00,49,00,\
  52,00,50,00,5f,00,4d,00,4a,00,5f,00,00,00,00,00,00,00,00,00,00,00,77,9c,00,\
  00,04,00,00,00,00,10,00,00,00,46,00,41,00,53,00,54,00,49,00,4f,00,5f,00,00,\
  00,00,00,00,00,00,00,00,00,78,9c,00,00,04,00,00,00,00,10,00,00,00,46,00,41,\
  00,53,00,54,00,20,00,49,00,4f,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,\
  05,00,00,00,00,1a,00,00,00,70,00,61,00,67,00,65,00,66,00,69,00,6c,00,65,00,\
  2e,00,73,00,79,00,73,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,\
  00,00,0a,00,00,00,24,00,4d,00,66,00,74,00,00,00,00,00,00,00,00,00,00,00,87,\
  9c,00,00,05,00,00,00,00,12,00,00,00,24,00,4d,00,66,00,74,00,4d,00,69,00,72,\
  00,72,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,00,\
  00,24,00,4c,00,6f,00,67,00,46,00,69,00,6c,00,65,00,00,00,00,00,00,00,00,00,\
  00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,00,56,00,6f,00,6c,00,75,00,\
  6d,00,65,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,\
  00,00,24,00,41,00,74,00,74,00,72,00,44,00,65,00,66,00,00,00,00,00,00,00,00,\
  00,00,00,87,9c,00,00,05,00,00,00,00,0c,00,00,00,24,00,52,00,6f,00,6f,00,74,\
  00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,\
  00,42,00,69,00,74,00,6d,00,61,00,70,00,00,00,00,00,00,00,00,00,00,00,87,9c,\
  00,00,05,00,00,00,00,0c,00,00,00,24,00,42,00,6f,00,6f,00,74,00,00,00,00,00,\
  00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,00,00,24,00,42,00,61,00,\
  64,00,43,00,6c,00,75,00,73,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,\
  00,00,00,00,10,00,00,00,24,00,53,00,65,00,63,00,75,00,72,00,65,00,00,00,00,\
  00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,00,55,00,70,\
  00,43,00,61,00,73,00,65,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,06,00,\
  00,00,00,10,00,00,00,24,00,45,00,78,00,74,00,65,00,6e,00,64,00,00,00,00,00,\
  00,00,00,00,00,00,87,9c,00,00,06,00,00,00,00,08,00,00,00,3a,00,35,00,33,00,\
  00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,14,00,00,00,50,00,\
  72,00,6f,00,66,00,69,00,6c,00,69,00,6e,00,67,00,00,00,00,00,00,00,00,00,00,\
  00,92,9c,00,00,00,00,00,00,00,12,00,00,00,52,00,65,00,67,00,69,00,73,00,74,\
  00,72,00,79,00,00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,18,\
  00,00,00,46,00,69,00,6c,00,65,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,\
  00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,10,00,00,00,50,00,\
  72,00,6f,00,63,00,65,00,73,00,73,00,00,00,00,00,00,00,00,00,00,00

 

[danlock]

If you don't like those extra lines, try using the code tag instead of the icode (inline code) tag.

 

[Intuit]

@danlock - Hadn't paid attention actually. Fixed. Thanks.