Windows Embedded Firewall Configuration (Prevent LAN Snooping)

  • Release Candidate 6
    Guest:
    We are at a “proposed final” true release candidate with nothing known remaining to be changed or fixed. For the full story, please see this page in the "Pre-Release Announcements & Feedback" forum.
    /Steve.
  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in:

    This forum does not automatically send notices of new content. So if, for example, you would like to be notified by mail when Steve posts an update to his blog (or of any other specific activity anywhere else), you need to tell the system what to “Watch” for you. Please checkout the “Tips & Tricks” page for details about that... and other tips!

    /Steve.

Intuit

Well-known member
Dec 27, 2020
80
21
Remember Kerio from the Windows XP days?
Used to use that in manual config mode to *very* closely taylor OUTBOUND traffic on my system.

Well, ever since we lost that, have been using the Windows Embedded firewall.
It's not as smart as Kerio since it only validates by path, rather than binary signature, but it's better than nothing.

Anyway, in past SecurityNOW! shows, it became apparent that concerns were growing over LAN snooping by scripts running on websites.

Outbound firewall on, this is how you prevent that.
1613842871553.png


I do this for all of my web browsers also...
1613842841921.png


Plenty of other options to be aware of also...

1613842702191.png

1613842798787.png

1613842821017.png

1613843027225.png

1613843064422.png
 
If you have any experience with firewalls that were like the ancient Kerio product, (but updated with modern features of course,) let me know.

1613843454627.png


1613843505431.png
 
To view the Windows Firewall Logging...

Elevated Command Prompt:
Code:
start "PFirewall.Log" tail -f %systemroot%\system32\logfiles\firewall\pfirewall.log


You have limited ability to customize the logging from the "WF.MSC" utility.
1613845969466.png



The Embedded Windows Firewall logging by the way doesn't tie traffic to a specific process; so must rely on some other tools, including ProcMon, TCPView, and/or looping "NetStat -ANO" to do that.

ProcMon Rulebase here...
ProcessMonitor-NetworkLogger17y09m06d.Reg
Code:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\sysinternals\Process Monitor]
"Filter#NetworkLogger.17y09m06d"=hex:01,17,00,00,00,75,9c,00,00,00,00,00,00,00,\
  18,00,00,00,50,00,72,00,6f,00,63,00,6d,00,6f,00,6e,00,2e,00,65,00,78,00,65,\
  00,00,00,00,00,00,00,00,00,00,00,75,9c,00,00,00,00,00,00,00,1c,00,00,00,50,\
  00,72,00,6f,00,63,00,6d,00,6f,00,6e,00,36,00,34,00,2e,00,65,00,78,00,65,00,\
  00,00,00,00,00,00,00,00,00,00,77,9c,00,00,04,00,00,00,00,10,00,00,00,49,00,\
  52,00,50,00,5f,00,4d,00,4a,00,5f,00,00,00,00,00,00,00,00,00,00,00,77,9c,00,\
  00,04,00,00,00,00,10,00,00,00,46,00,41,00,53,00,54,00,49,00,4f,00,5f,00,00,\
  00,00,00,00,00,00,00,00,00,78,9c,00,00,04,00,00,00,00,10,00,00,00,46,00,41,\
  00,53,00,54,00,20,00,49,00,4f,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,\
  05,00,00,00,00,1a,00,00,00,70,00,61,00,67,00,65,00,66,00,69,00,6c,00,65,00,\
  2e,00,73,00,79,00,73,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,\
  00,00,0a,00,00,00,24,00,4d,00,66,00,74,00,00,00,00,00,00,00,00,00,00,00,87,\
  9c,00,00,05,00,00,00,00,12,00,00,00,24,00,4d,00,66,00,74,00,4d,00,69,00,72,\
  00,72,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,00,\
  00,24,00,4c,00,6f,00,67,00,46,00,69,00,6c,00,65,00,00,00,00,00,00,00,00,00,\
  00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,00,56,00,6f,00,6c,00,75,00,\
  6d,00,65,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,\
  00,00,24,00,41,00,74,00,74,00,72,00,44,00,65,00,66,00,00,00,00,00,00,00,00,\
  00,00,00,87,9c,00,00,05,00,00,00,00,0c,00,00,00,24,00,52,00,6f,00,6f,00,74,\
  00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,\
  00,42,00,69,00,74,00,6d,00,61,00,70,00,00,00,00,00,00,00,00,00,00,00,87,9c,\
  00,00,05,00,00,00,00,0c,00,00,00,24,00,42,00,6f,00,6f,00,74,00,00,00,00,00,\
  00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,00,00,24,00,42,00,61,00,\
  64,00,43,00,6c,00,75,00,73,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,\
  00,00,00,00,10,00,00,00,24,00,53,00,65,00,63,00,75,00,72,00,65,00,00,00,00,\
  00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,00,55,00,70,\
  00,43,00,61,00,73,00,65,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,06,00,\
  00,00,00,10,00,00,00,24,00,45,00,78,00,74,00,65,00,6e,00,64,00,00,00,00,00,\
  00,00,00,00,00,00,87,9c,00,00,06,00,00,00,00,08,00,00,00,3a,00,35,00,33,00,\
  00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,14,00,00,00,50,00,\
  72,00,6f,00,66,00,69,00,6c,00,69,00,6e,00,67,00,00,00,00,00,00,00,00,00,00,\
  00,92,9c,00,00,00,00,00,00,00,12,00,00,00,52,00,65,00,67,00,69,00,73,00,74,\
  00,72,00,79,00,00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,18,\
  00,00,00,46,00,69,00,6c,00,65,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,\
  00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,10,00,00,00,50,00,\
  72,00,6f,00,63,00,65,00,73,00,73,00,00,00,00,00,00,00,00,00,00,00
 
Last edited:
If you don't like those extra lines, try using the code tag instead of the icode (inline code) tag. :unsure: