Simplewall: Rebranding in Windows 10 1709

[pwn0r]

Windows 10 x64 build 1709. Simplewall as the last official version x64.

Recently I have found an interesting glitch: the M$ have rebranded _Windows Firewall_ into _Windows Defender Firewall_. That was done in Win10 build 1709.

Either due to that or some other reason (but most likely due to this rebranding??) the simplewall no longer disables Windows Firewall service when installing filters. Install/Reinstall filters was tried but did not solve the problem.

[henrypp]

Disable service is not necessary, simplewall disable WF profiles through winapi/netsh.

simplewall no longer disables Windows Firewall

Nothing to do with rebranding. It's m$ policy, it disallow configuring windows for themselves with every new window 10 update, sad but true.

[pwn0r]

aha. now I know why some random bugs may appear in LAN environment. When you disable these profiles, are you disabling domain profile as well?

Also just tried now -- for whatever reason it actually disabled here Windows Firewall (this desktop is on 1607 build). However the service was not _stopped_. I.e. when installing filters, the service startup type was changed into disabled but the WF service was still running (stopped it manually).

on 1709 build iirc simple wall does not even change it to disabled.

[ltGuillaume]

So, what does this entail? For example, I now get Windows Defender Firewall dialogs for incoming connections from programs. It looks like the simplewall rules AND the Defender Firewall rules are now enabled simultaneously. What if something is blocked by one and allowed by the other?

[beerisgood]

Disable your Internet, uninstall Simplewall Filter and Reinstall Filter.
Then connect to Internet.
Should be fixed then

[ltGuillaume]

Defender Firewall was only enabled for public networks, after uninstalling and reinstalling the filters the Defender Firewall is now completely disabled.

But before build 1709 I couldn't even see the Inboud/Outbound rules of "Windows Defender Firewall with Advanced Security". I'm still wondering what programs that dynamically set Windows Firewall rules, like Windscribe VPN, and invoking netsh advfirewall firewall add rule (...) does when simplewall is running.

[duttyend]

The way @henrypp does it now is the best way because disabling the service leads to problems with Microsoft Store app (impossible to update apps).

[henrypp]

@ltGuillaume,

I'm still wondering what programs that dynamically set Windows Firewall rules

It's not Windows Firewall rules, all 3-rd party apps used Windows FIltering Patform (WFP) to control network requests, even if WF disabled. From FAQ.

[pwn0r]

while for some disabling service may be a problem, for some NOT disabling the WF service could be a problem. I had problems on two occasions when a remote machine running on win10 restarted after updates and the firewall was blocking everythng (no connections from outside). I certainly have doubts about both simplewall and WF (or WDF) running simultanously. For now I'll try to manually disable the service, as loss of inbound connectivity on restart is a problem for remote machines.

[pwn0r]

it seems that at least with 1607 the new version (i.e. 2.2) works mostly fine. The current behaviour is as follows:

Disable filtering with Enable Windows Firewall: service startup becomes automatic and firewall service up and running.

Enable filtering with Disable Windows Firewall: service startup becomes disabled, according to event viewer firewall becomes disabled for all three profiles, but the service itself keeps running.

updated: worth mentioning that after restart in 1607 the service does not start (it is disabled) and simplewall appears to work correctly (that's an improvement compared to the previous version).

so it seems the firewall is only properly disabled after OS restart. I think that's worth mentioning :)

As for the 1709, the service is neither stopped or disabled, as before.