FirewallHardening tool

[Decopi]

Look into the Windows Registry and export the content of the below key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\FirewallRules

Yeah, I was also already aware that I could see the rules and commands in regedit. But both, whether importing the rules through Windows Firewall, or also through regedit, both ways are a more laborious way to view and manipulate the rules and commands (one by one, too much handy work).

I thought that perhaps you had on your hands a simple list of rules and commands, and I thought that perhaps it was simpler to ask you the favor of sharing that list with me.

But don't worry @Andy Ful , I've already taken up too much of your time, I really appreciated your contacts, so thank you.

 

[ErzCrz]

Yeah, I was also already aware that I could see the rules and commands in regedit. But both, whether importing the rules through Windows Firewall, or also through regedit, both ways are a more laborious way to view and manipulate the rules and commands (one by one, too much handy work).

I thought that perhaps you had on your hands a simple list of rules and commands, and I thought that perhaps it was simpler to ask you the favor of sharing that list with me.

But don't worry @Andy Ful , I've already taken up too much of your time, I really appreciated your contacts, so thank you.

You can export the policy by right clicking Windows Defender>

Unfortunately being .wfw extension, not something you can import into the likes of WFC as that uses .wpw Anyway, manually adding doesn't take all that long and most AVs and FWs leave Windows Firewall running. E.g. Comodo and Windows Firewall run along side each other so you can still use the hardening rules and those files will be blocked natively by windows firewall. In the case of WFC, at long as a conflicting rule created it works fine.

 

[Decopi]

You can export the policy by right clicking Windows Defender>

Unfortunately being .wfw extension, not something you can import into the likes of WFC as that uses .wpw Anyway, manually adding doesn't take all that long and most AVs and FWs leave Windows Firewall running. E.g. Comodo and Windows Firewall run along side each other so you can still use the hardening rules and those files will be blocked natively by windows firewall. In the case of WFC, at long as a conflicting rule created it works fine.

Thank you.
Import/Export through Windows Firewall is what @Kongo had already suggested in previous messages, and I was also already aware of this possibility.
It happens that import/export through WF or Regedit, both are two very laborious ways to view and manipulate (around 100) rules and commands. And I was looking for a simple list with the rules/commands.
Anyway, once again, thank you all very much for your intention to help.

 

[Andy Ful]

I thought that perhaps you had on your hands a simple list of rules and commands, and I thought that perhaps it was simpler to ask you the favor of sharing that list with me.

The exact list of rules is that one exported from the Windows Registry. There is no simpler list of rules.
To manage many LOLBins, you must use a program. This can be done by using a file that contains the paths of LOLBins and the script that reads the paths one by one from that file , creates the firewall rule for each path, and writes the rules into the Windows Registry.

 

[simmerskool]

@Andy Ful -- I have used your tools before but not in a systematic controlled way (my_bad -- trying again)
I have ESET Nod32 on win10_VM and I had Windows Firewall Control running with but suspect that your Firewall Hardening Tool is better, so I uninstalled WFC, installed FWH, selected: Recommended + LOLBins + ms_office + adobe_acrobat & rebooted. No issues seen. I was looking for written instructions for FWH, ie, if any are needed and didn't find any on github. I also enabled Log, but not sure what where blocks are logged. I guess if you noticed something blocked, check the Log and change the rule if brave, or stupid...
PS I often check dnsleaktest.com (labeled as ivpn site) and now no return it stays blank, while other dns checkers work ok. Sorta wondering what dnsleaktest is doing to get blocked by FWH. -- I know check the Log...

 

[Andy Ful]

Sorta wondering what dnsleaktest is doing to get blocked by FWH. -- I know check the Log...

If you suspect something is wrong, you can use the Firewall-Hardening Log - especially if you activated many LOLBins. Most of the blocked events are not harmful (telemetry) and do not disturb running applications.
If you want to know what the DNS leak test does, you may post to the FirewallHardening thread:

FirewallHardening tool

FIREWALLHARDENING (new ver. 3.0.0.1, July 2024) FirewallHardening is a part of the Hard_Configurator project and can be used also as a standalone application among a few others included in the H_C_HardeningTools repository...

malwaretips.com