{"id":235,"date":"2009-12-11T15:11:44","date_gmt":"2009-12-11T21:11:44","guid":{"rendered":"http:\/\/www.briandeyo.us\/brd\/wp\/?p=235"},"modified":"2009-12-31T15:14:57","modified_gmt":"2009-12-31T21:14:57","slug":"port-exception-not-showing-in-gui-for-windows-firewall-if-gpo-allows-same-port","status":"publish","type":"post","link":"https:\/\/www.briandeyo.us\/index.php\/2009\/12\/11\/port-exception-not-showing-in-gui-for-windows-firewall-if-gpo-allows-same-port\/","title":{"rendered":"Port Exception not showing in GUI for Windows Firewall if GPO allows same port"},"content":{"rendered":"
NOTE: I have only verified this topic with Windows server 2003.\u00a0 I expect the same or similar behavior from Windows XP.\u00a0 It is possible that Windows Vista, 7 , server 2008 and everything after is affected if you use only the simple GUI.\u00a0 I doubt this will be an issue with the “advanced config” tool.<\/address>\n

There is a scenario with a GPO that allows traffic on lets say port UDP 8081.\u00a0 You computer has the GPO applied and has been restared.\u00a0 Inside the GUI you would see the GPO defined port exception listed.\u00a0 And if your GPO settings allow you to add an additional local exceptions, you could add an additional local exception for UDP 8081.\u00a0 Perhaps\u00a0deviating from the GPO by\u00a0only the scope.\u00a0 The port exception will show up in the GUI in bold and all seems well.\u00a0 But then you restart you computer and the newly added local exception disappears from the GUI.\u00a0 When you try to re-add the exception you receive the error<\/p>\n

“The Port ‘EXCEPTION NAME (43)’ cannot be added.\u00a0 An entry for the same port ‘EXCEPTION NAME (PROTOCOL PORT)’ already exists.”<\/p>\n

\u00a0\"Windows<\/p>\n

No it doesn’t… it’s not in the GUI!\u00a0 As it turns out the rule does still exist.\u00a0 As you add host-based port exceptions that operate on the same port as the GPO, you will need to look elsewhere for your disappearing rules.<\/p>\n

You can try in the registry:<\/p>\n

check the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\
\n(continued)Parameters\\FirewallPolicy\\DomainProfile\\GloballyOpenPorts\\List<\/p>\n

Or you can try the command-line interface for the firewall:<\/p>\n

    \n
  1. open a command prompt and run command “netsh”<\/li>\n
  2. type “firewall” to switch to the firewall interface<\/li>\n
  3. type “show portopening”<\/li>\n
  4. if your port exceptions are already defined\u00a0 you will seem them here.<\/li>\n<\/ol>\n

    \"Windows<\/p>\n

    If you like you can delete them here using the command:<\/p>\n

    type “delete portopening NAME_OF_EXCEPTION” example “delete portopening TCP 9898” and then recreate your port opening in the GUI.<\/p>\n

    Even if you do recreate your rule in the GUI it will disappear from there the next time you restart.\u00a0 Become familiar with the\u00a0CLI if you plan on using Windows Firewall with GPO’s and local port exceptions.<\/p>\n

    This flaw does give me a bit of pause to consider the security ramifications of this. If I were aware of this flaw it would be very easy to hide a firewall rule from the average user under the above circumstances. It’s a good thing that most people who are part of a domain using GPO’s do not use Windows Firewall as the sole mechanism blocking malicious traffic. This also shows that Linux admins are right when they talk about needing to know the CLI for your OS.<\/p>\n

    Thanks to DJ JohnnyK for helping on this!<\/address>\n","protected":false},"excerpt":{"rendered":"

    NOTE: I have only verified this topic with Windows server 2003.\u00a0 I expect the same or similar behavior from Windows XP.\u00a0 It is possible that Windows Vista, 7 , server 2008 and everything after is affected if you use only the simple GUI.\u00a0 I doubt this will be an issue with the “advanced config” tool. …<\/p>\n","protected":false},"author":12,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-235","post","type-post","status-publish","format-standard","hentry","category-tech"],"_links":{"self":[{"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/posts\/235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/comments?post=235"}],"version-history":[{"count":12,"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/posts\/235\/revisions"}],"predecessor-version":[{"id":242,"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/posts\/235\/revisions\/242"}],"wp:attachment":[{"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/media?parent=235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/categories?post=235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.briandeyo.us\/index.php\/wp-json\/wp\/v2\/tags?post=235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}