Serious Discussion Fort Firewall

[tnodir]

Fort Firewall 3.17.4

• UI: Options: Statistics: Add "Clear connections on exit (reduce disk writes)" flag (#502).
• UI: Connections: Copy as filter by "Ctrl+Shift+C".
• UI: ProgramEdit: Fix wildcard switch saving with edited path (#501).
• UI: Detect wildcard path for "-c prog ..." commands (#501).

Attention: The "Clear connections on exit (reduce disk writes)" flag will be enabled by default for new installations from next release!

 

[tnodir]

Fort Firewall 3.17.5

• UI: Options: My Fort: Add "Auto-Show Window" flag (#506).
• UI: Rule: Fix name changes checking (#504).
• Driver: fortconf: Exaustive search of path prefix (#507).
• Driver: fortlog: Increase a path limit to 1024 chars (#511).

 

[tnodir]

Fort Firewall 3.17.6

• Driver: fortbuf: Fix buffer handling for long paths (v3.17.5 regression).

 

[ranecogofi]

Should Windows Firewall be disabled when using Fort? Is there a possibility for conflict if both are running? i.e traffic should be blocked by Fort rules but is allowed because of Windows Firewall rules.

 

[tnodir]

Should Windows Firewall be disabled when using Fort?

FAQ: Do I need to / Should I have - Windows Firewall (Microsoft Defender Firewall) enabled and running together with Fort Firewall?

 

[ranecogofi]

FAQ: Do I need to / Should I have - Windows Firewall (Microsoft Defender Firewall) enabled and running together with Fort Firewall?

Hi @tnodir, thanks for the link.

I saw your comment here

Keep in mind, the standard Windows Firewall (WFw) has built-in rules for 0.0.0.0 address.
If the WFw is not turned off, then Windows can connect to DHCP server on startup after some time.

Is this still relevant?
Does it mean that if Windows Firewall is not turned off there is a possibility that a connection is allowed when it's set to block in Fort rules?
Or am I not understanding it properly?

 

[tnodir]

Is this still relevant?

Let me double check it tomorrow...

I remember some annoyancy when enabled/disabled a network adapter.

But generally, if the connection is blocked by either WFw or Fort (or any other firewall), then it'll be blocked.

 

[Parkinsond]

Hi @tnodir, thanks for the link.

I saw your comment here

Is this still relevant?
Does it mean that if Windows Firewall is not turned off there is a possibility that a connection is allowed when it's set to block in Fort rules?
Or am I not understanding it properly?

No, it will not be allowed.
Consider it as having two consequent sieves; in order to pass the pore have to be open in both.

 

[tnodir]

Is this still relevant?
Does it mean that if Windows Firewall is not turned off there is a possibility that a connection is allowed when it's set to block in Fort rules?

Yes, it's relevant: the `0.0.0.0` for IPv4 or `::` for IPv6 are treated in special way by WFP and not filtered by Fort Firewall, because they are allowed early.

I've double checked today by disabling/enabling a network adapter and monitoring connections by "System Informer": Firewall tab.
DHCP requests to `0.0.0.0` address are implicitly allowed by WFP.

I don't know, if those filters will be removed when turning off the WFw.
It's an exercise for your own..

 

[ranecogofi]

Yes, it's relevant: the `0.0.0.0` for IPv4 or `::` for IPv6 are treated in special way by WFP and not filtered by Fort Firewall, because they are allowed early.

I've double checked today by disabling/enabling a network adapter and monitoring connections by "System Informer": Firewall tab.
DHCP requests to `0.0.0.0` address are implicitly allowed by WFP.

I don't know, if those filters will be removed when turning off the WFw.
It's an exercise for your own..

Tried toggling a network adapter, System Informer seems to show that connection to 0.0.0.0 is blocked.

Is it normal that System Informer only shows DROP action? I don't see anything other than DROP, allowed connection just does not show up.

 

[tnodir]

Is it normal that System Informer only shows DROP action?

I see also "ALLOW" action.
Do you have any allowed connection?

Which version of Windows do you have?

BTW, install nightly version of System Informer.

 

[ranecogofi]

Which version of Windows do you have?

I am on Win11 24H2

Do you have any allowed connection?

I do have allowed connections, they showed up on Fort statistics but not on System Informer, I have tried the canary build as well.
Only DROP showed up for me.

Spoiler: screenshot

 

[tnodir]

@ranecogofi Run System Informer as Admin.

 

[ranecogofi]

@ranecogofi Run System Informer as Admin.

It's already running as admin, the firewall tab will not show anything without admin.

 

[ranecogofi]

@tnodir do you know if I need to set up my firewall a certain way for allow rules to show up on System Informer or should it just be by default?
So allowed connections on Fort, normally should show up in System Informer?
It's weird since even on a fresh install of Windows only drop showed up for me.

 

[tnodir]

@ranecogofi System Informer should work by default. I use it on virtual machines with various Windows versions and it works fine.

Please try to ask on System Informer's issues in GitHub. Also check this thread.

I use only portable zip archive of System Informer from canary builds.

 

[ranecogofi]

@ranecogofi System Informer should work by default. I use it on virtual machines with various Windows versions and it works fine.

Please try to ask on System Informer's issues in GitHub. Also check this thread.

I use only portable zip archive of System Informer from canary builds.

Ah, I found it, there is this "FwIgnoreAllow" setting that needs to be disabled on System Informer for it to show allowed connections.
It's working now, thanks for your support @tnodir.

Spoiler: img

 

[tnodir]

Fort Firewall 3.17.7

• UI: Statistics: Rework Traffic view (#208, #226).
• UI: Statistics: Open original program entry (#523).
• UI: Options: Backup: Export/Import Statistics traffic (#253).
• UI: Connections: Copy selected text with replaced new-lines (#522).
• UI: Update SQLite to 3.49.2

 

[tnodir]

Fort Firewall 3.17.8

• UI: Options: Interface: Fix "Windows11" style; Add "WindowsVista", "Windows" styles (#527).
• UI: Statistics: Traffic: Default tab on open (#530).
• UI: Tray: Change color for "Block LAN Traffic" (#531).

 

[Parkinsond]

Fort Firewall 3.17.8

• UI: Options: Interface: Fix "Windows11" style; Add "WindowsVista", "Windows" styles (#527).
• UI: Statistics: Traffic: Default tab on open (#530).
• UI: Tray: Change color for "Block LAN Traffic" (#531).

Did it receive Ask (interactive) mode?