firewall rules
Posts tagged “firewall rules”.
How to block a country on Windows
Windows has no country switch, so you block the country's IP ranges with firewall rules. NetSecWall does it with one right-click; geolocation is approximate, and CDNs and VPNs blur borders.
How to block a program in Windows Firewall, two ways
Create an outbound rule for the program's .exe in Windows Defender Firewall with Advanced Security, set to Block the connection. Or right-click the program in NetSecWall and choose Block.
Keep the app, cut its internet: blocking without uninstalling
Block the program's outbound connections instead of removing it. The app still opens and works offline; it just can't reach the internet until you lift the block.
Why you need a firewall and an antivirus, and what each one misses
An antivirus judges files and program behavior; a firewall judges connections. Each misses what the other sees, from a clean-looking tool phoning out to malware that never touches the network.
Inbound and outbound connections, in plain English
A connection is outbound when your PC starts it, inbound when another machine does. Your router and Windows Firewall stop most unsolicited inbound traffic, so outbound is where apps phone home.
Living off the land: when Windows' own tools go rogue
Attackers often skip custom malware and use tools Windows already ships, such as PowerShell, certutil and mshta. The files are genuine, so the tell is behavior, like those tools reaching the internet.
Managing firewall policy across dozens of PCs without a cloud console
Group the PCs on a Management Server you host yourself, set one policy with the wizard, lock what users mustn't change, and let each PC apply it at its next check-in. No cloud console.
What is a port? 443, 53, 3389 and friends
A port is a number from 0 to 65535 that tells a computer which program a piece of network traffic is for. Servers wait on well-known ports like 443 or 53; your side uses a random high port.
Windows Firewall allows outbound traffic by default: why that matters
Out of the box, Windows Defender Firewall blocks unsolicited inbound connections but lets every program connect out. That keeps things working, and it means nothing stops an unwanted app phoning home.
What is svchost.exe doing on my network?
svchost.exe hosts Windows services, and several of them need the internet: Windows Update, BITS, Delivery Optimization, time sync and the DNS Client. The real question is always which service.
What is the Windows Filtering Platform?
The Windows Filtering Platform (WFP) is the engine inside Windows that decides whether network traffic may pass. Windows Defender Firewall is built on it, and so are many VPNs and security tools.