Advice Request [Discuss] Recommendation for Which Ports and Windows Services should be blocked via Windows Firewall?

[ForgottenSeer 85911]

what about "BranchCache Content Retrieval (HTTP-In)" is it necessary ??

unless you are using a configured branch server it isn't needed
for best benefits you should reasearch each one online yourself

example

BranchCache

This topic provides an overview of BranchCache in Windows Server 2016

docs.microsoft.com

 

[DDE_Server]

unless you are using a configured branch server it isn't needed
for best benefits you should reasearch each one online yourself

yes i would thanks you and sorry for asking to many questions

 

[ForgottenSeer 85911]

do not be the type of person that obsesses if Windows is broke in some unknown, hidden way and weakening your security
that is needless worries

 

[DDE_Server]

do not be the type of person that obsesses if Windows is broke in some unknown, hidden way and weakening your security
that is needless worries

i know but i became a paranoid one

 

[ForgottenSeer 85911]

yes i would thanks you and sorry for asking to many questions

i do not mind questions
just pointing out maximum reward for effort
best method

i know but i became a paranoid one

then you should walk away and find different hobby

 

[DDE_Server]

By the way it is broken now

 

[ForgottenSeer 85911]

By the way it is broken now
View attachment 233956

this is always the risk of tweaking
notice "What failed: tcpip.sys"

just because Microsoft makes all of it tweakable does not mean it will work once you tweak it
first rule of Windows

 

[DDE_Server]

this is always the risk of tweaking
notice "What failed: tcpip.sys"

just because Microsoft makes all of it tweakable does not mean it will work once you tweak it
first rule of Windows

it was an update issue the system reboot with updating process completion not because Windows firewall rule i think

 

[ForgottenSeer 85911]

it was an update issue the system reboot with updating process completion not because Windows firewall rule i think

you cannot know accurately unless you collect memory dump and provide it to someone with the symbol files for dump analysis
what crashed app is not always accruate
also what the OS displays on the BSOD screen is not always accurate

 

[ForgottenSeer 85911]

here is what alexandru (WFC dev) uses as his WF rule set
notice what is only allowed are

browser
DNS
skype
network shares (local network)
printer (local network)

notice he has a rule for Windows Update but it is temporarily disabled
he deletes everything else
and he does not torrent i wonder why ?

this is all that he needs to use his system
he likely using static ip address for his system
you would have to ask him how he has router configured

you can ask karly pados (TinyWall dev) and Alexandru (WFC dev) about the services you speak and different firewall strategies for all the crap Microsoft ships with Windows they both helpful on subject matter

 

[DDE_Server]

here is what alexandru (WFC dev) uses as his WF rule set
notice what is only allowed are

browser
DNS
skype
network shares (local network)
printer (local network)

notice he has a rule for Windows Update but it is temporarily disabled

this is all that he needs to use his system

you can ask karly pados (TinyWall dev) and Alexandru (WFC dev) about the services you speak and different firewall strategies for all the crap Microsoft ships with Windows

View attachment 233957

i wiped all outbound connections installed Binisoft windows firewall control and whitlisted the needed programs
but what about this it keeps popup

 

[DDE_Server]

should i block all inbound rules ??

 

[ForgottenSeer 85911]

i wiped all outbound connections installed Binisoft windows firewall control and whitlisted the needed programs
but what about this it keeps popup

View attachment 233958

so you are already done trying to learn and configure Windows Firewall for yourself ?
FYI alexandru's rules are going to block networking for all your installed apps
his rules only allow browser and skype apps
you can disable IGMP

 

[DDE_Server]

Wiped all inbound connections

 

[ForgottenSeer 85911]

should i block all inbound rules ??

yes it blocks all inbound connection attempts not originating from your system but allows return replies to queries originating from your system

 

[DDE_Server]

this is my current outbound connections

 

[ForgottenSeer 85911]

this is my current outbound connections

View attachment 233959

you might have troubles between your VPN and WFC
FYI
do not be surprised if it happens

 

[DDE_Server]

but i see seed4me VPN is enabled my i try to connect and see if i can

you might have troubles between your VPN and WFC
FYI
do not be surprised if it happens

 

[ForgottenSeer 85911]

but i see seed4me VPN is enabled my i try to connect and see if i can

WFC has problems in past with VPNs
when rules work stop changing stuff on system

 

[ForgottenSeer 823865]

The only person that does that sort of thing here is @Umbra.

The is a guide here Harden Windows 10 for Security. How to secure Windows 10. .

+1 for this site, old but still valid.