Windows Embedded Firewall Configuration (Prevent LAN Snooping)

  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in:

    This forum does not automatically send notices of new content. So if, for example, you would like to be notified by mail when Steve posts an update to his blog (or of any other specific activity anywhere else), you need to tell the system what to “Watch” for you. Please checkout the “Tips & Tricks” page for details about that... and other tips!

    /Steve.
  • Larger Font Styles
    Guest:

    Just a quick heads-up that I've implemented larger font variants of our forum's light and dark page styles. You can select the style of your choice by scrolling to the footer of any page here. This might be more comfortable (it is for me) for those with high-resolution displays where the standard fonts, while permitting a lot of text to fit on the screen, might be uncomfortably small.

    (You can permanently dismiss this notification with the “X” at the upper right.)

    /Steve.

Intuit

Active member
Dec 27, 2020
34
7
Remember Kerio from the Windows XP days?
Used to use that in manual config mode to *very* closely taylor OUTBOUND traffic on my system.

Well, ever since we lost that, have been using the Windows Embedded firewall.
It's not as smart as Kerio since it only validates by path, rather than binary signature, but it's better than nothing.

Anyway, in past SecurityNOW! shows, it became apparent that concerns were growing over LAN snooping by scripts running on websites.

Outbound firewall on, this is how you prevent that.
1613842871553.png


I do this for all of my web browsers also...
1613842841921.png


Plenty of other options to be aware of also...

1613842702191.png

1613842798787.png

1613842821017.png

1613843027225.png

1613843064422.png
 

Intuit

Active member
Dec 27, 2020
34
7
If you have any experience with firewalls that were like the ancient Kerio product, (but updated with modern features of course,) let me know.

1613843454627.png


1613843505431.png
 

Intuit

Active member
Dec 27, 2020
34
7
To view the Windows Firewall Logging...

Elevated Command Prompt:
Code:
start "PFirewall.Log" tail -f %systemroot%\system32\logfiles\firewall\pfirewall.log


You have limited ability to customize the logging from the "WF.MSC" utility.
1613845969466.png



The Embedded Windows Firewall logging by the way doesn't tie traffic to a specific process; so must rely on some other tools, including ProcMon, TCPView, and/or looping "NetStat -ANO" to do that.

ProcMon Rulebase here...
ProcessMonitor-NetworkLogger17y09m06d.Reg
Code:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\sysinternals\Process Monitor]
"Filter#NetworkLogger.17y09m06d"=hex:01,17,00,00,00,75,9c,00,00,00,00,00,00,00,\
  18,00,00,00,50,00,72,00,6f,00,63,00,6d,00,6f,00,6e,00,2e,00,65,00,78,00,65,\
  00,00,00,00,00,00,00,00,00,00,00,75,9c,00,00,00,00,00,00,00,1c,00,00,00,50,\
  00,72,00,6f,00,63,00,6d,00,6f,00,6e,00,36,00,34,00,2e,00,65,00,78,00,65,00,\
  00,00,00,00,00,00,00,00,00,00,77,9c,00,00,04,00,00,00,00,10,00,00,00,49,00,\
  52,00,50,00,5f,00,4d,00,4a,00,5f,00,00,00,00,00,00,00,00,00,00,00,77,9c,00,\
  00,04,00,00,00,00,10,00,00,00,46,00,41,00,53,00,54,00,49,00,4f,00,5f,00,00,\
  00,00,00,00,00,00,00,00,00,78,9c,00,00,04,00,00,00,00,10,00,00,00,46,00,41,\
  00,53,00,54,00,20,00,49,00,4f,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,\
  05,00,00,00,00,1a,00,00,00,70,00,61,00,67,00,65,00,66,00,69,00,6c,00,65,00,\
  2e,00,73,00,79,00,73,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,\
  00,00,0a,00,00,00,24,00,4d,00,66,00,74,00,00,00,00,00,00,00,00,00,00,00,87,\
  9c,00,00,05,00,00,00,00,12,00,00,00,24,00,4d,00,66,00,74,00,4d,00,69,00,72,\
  00,72,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,00,\
  00,24,00,4c,00,6f,00,67,00,46,00,69,00,6c,00,65,00,00,00,00,00,00,00,00,00,\
  00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,00,56,00,6f,00,6c,00,75,00,\
  6d,00,65,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,\
  00,00,24,00,41,00,74,00,74,00,72,00,44,00,65,00,66,00,00,00,00,00,00,00,00,\
  00,00,00,87,9c,00,00,05,00,00,00,00,0c,00,00,00,24,00,52,00,6f,00,6f,00,74,\
  00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,\
  00,42,00,69,00,74,00,6d,00,61,00,70,00,00,00,00,00,00,00,00,00,00,00,87,9c,\
  00,00,05,00,00,00,00,0c,00,00,00,24,00,42,00,6f,00,6f,00,74,00,00,00,00,00,\
  00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,12,00,00,00,24,00,42,00,61,00,\
  64,00,43,00,6c,00,75,00,73,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,05,\
  00,00,00,00,10,00,00,00,24,00,53,00,65,00,63,00,75,00,72,00,65,00,00,00,00,\
  00,00,00,00,00,00,00,87,9c,00,00,05,00,00,00,00,10,00,00,00,24,00,55,00,70,\
  00,43,00,61,00,73,00,65,00,00,00,00,00,00,00,00,00,00,00,87,9c,00,00,06,00,\
  00,00,00,10,00,00,00,24,00,45,00,78,00,74,00,65,00,6e,00,64,00,00,00,00,00,\
  00,00,00,00,00,00,87,9c,00,00,06,00,00,00,00,08,00,00,00,3a,00,35,00,33,00,\
  00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,14,00,00,00,50,00,\
  72,00,6f,00,66,00,69,00,6c,00,69,00,6e,00,67,00,00,00,00,00,00,00,00,00,00,\
  00,92,9c,00,00,00,00,00,00,00,12,00,00,00,52,00,65,00,67,00,69,00,73,00,74,\
  00,72,00,79,00,00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,18,\
  00,00,00,46,00,69,00,6c,00,65,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,\
  00,00,00,00,00,00,00,00,00,00,92,9c,00,00,00,00,00,00,00,10,00,00,00,50,00,\
  72,00,6f,00,63,00,65,00,73,00,73,00,00,00,00,00,00,00,00,00,00,00
 
Last edited:

danlock

Well-known member
Sep 30, 2020
114
31
If you don't like those extra lines, try using the code tag instead of the icode (inline code) tag. :unsure: