Inbound Firewall Rule Ignored - Does capitalization and / or unicode matter?

A

attobias

Hi All,


I have an application specific Inbound Connection firewall rule configured in Windows 10 x64. The application is 32-bit and installed in regular "Program Files (x86)". The firewall rule is configured to allow:


- For all profiles (Domain, Private, Public),

- Allow *any* remote IP,

- To talk to *any* local IP,

- Using *any* protocol,


More concise from CSV rule export feature from Advanced Firewall configuration:


Name,Group,Profile,Enabled,Action,Override,Program,Local Address,Remote Address,Protocol,Local Port,Remote Port,Authorized Users,Authorized Computers,Authorized Local Principals,Local User Owner,Application Package,

MyApp,,All,Yes,Allow,No,C:\Program Files (x86)\My Path\Bin\MyApp.exe,Any,Any,Any,Any,Any,Any,Any,Any,Any,Any,



However, when the application starts I still get "Windows Defender Firewall has blocked some features of this app". The prompt references the same application. With the only difference being that the path given in the prompt is all small caps ('C:\program files (x86)\my path\bin\myapp.exe').


The inbound firewall rule is configured with a Powershell script calling 'netsh advfirewall firewall add rule ...' and the path argument is given as


"C:\\Program\u0020Files\u0020(x86)\\My\u0020Path\\Bin\\myapp.exe"


with unicode escape sequence used to represent 'SPACE'.


Question:


- What could the reasons be for this Inbound rule seemingly being ignored?

- Does capitalization of the given path matter?

- Is the firewall configuration unable to deal the unicode escape sequence? And if so, should specify two rules - one with ASCII 'SPACE' and one with the unicode string?



Thank you for taking the time to read this and for any suggestions as to why this is not working for me,

T

Continue reading...
 
Back
Top Bottom