Simplewall: 3.0.8 stops checking if Windows Firewall is enabled

[ltGuillaume]

Concerning https://github.com/henrypp/simplewall/issues/554 and https://github.com/henrypp/simplewall/commit/776bdd04dcf386f26fe520c528dc1bd84ad357c2

It looks like this means that every time a new connection becomes available for Windows, the Windows Firewall is enabled again, but simplewall will _not_ check the Windows Firewall state at start-up... thus both will be active, which allows for overrides from the Windows Firewall without any knowledge of that for simplewall users.

As far as I know, you can simply tell Windows to stop giving you the notifications about the Windows Firewall being disabled (the issue https://github.com/henrypp/simplewall/issues/554). This is far better than stopping simplewall from checking if the Windows Firewall is enabled.

In fact, I would say it's best that simplewall would check if the Windows Firewall is enabled after a new connection is made (or just periodically, _at least not just_ at start-up) and disable the Windows Firewall if necessary.

[Tester798]

It looks like blocking rules have priority whether they are in simplewall or in Windows Firewall. So as long as you (or some program) don't add blocking rule to Windows Firewall, simplewall should have priority.

[ltGuillaume]

No, there always seems to be a chance that another program creates rules that override this. See this whole thing: https://github.com/henrypp/simplewall/issues/254

[Tester798]

In that conversation I don't see how rules in Windows Firewall can have "allow" priority over simplewall.
Other programs that use WFP API - seems like they can, they can even uninstall simplewall if they want :)

[ltGuillaume]

That might be true, might not be. I found the documentation lacking. Better to be safe than sorry in such cases (unless someone can point us to a primary source that properly describes this).

[elesiuta]

According to https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration#configurable-override-policy

The basic policy is as follows.

• Actions are evaluated in priority order of sub-layers from highest priority to lowest priority.
• "Block" overrides "Permit".
• "Block" is final (cannot be overridden) and stops the evaluation. The packet is discarded.

Further down it mentions a "soft block" which can be overridden by a permit, so it depends if simplewall uses "Allow override" (FWPS_RIGHT_ACTION_WRITE is set) or not.

[privacyguy123]

Surely Simplewall should explicity turn off Windows Firewall and check if it is disabled?

[ltGuillaume]

According to https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration#configurable-override-policy

The basic policy is as follows.

• Actions are evaluated in priority order of sub-layers from highest priority to lowest priority.
• "Block" overrides "Permit".
• "Block" is final (cannot be overridden) and stops the evaluation. The packet is discarded.

Further down it mentions a "soft block" which can be overridden by a permit, so it depends if simplewall uses "Allow override" (FWPS_RIGHT_ACTION_WRITE is set) or not.

1. Since simplewall uses a whitelist system, I figure the overall block can only be a soft block; it would otherwise be impossible to create "Allow" rules on top of it.
2. I don't think anyone would benefit from Windows Firewall being active while using simplewall. It makes the whole filtering platform confusing and unpredictable to the end user.
3. Pop-ups like https://github.com/henrypp/simplewall/issues/562 will keep turning up.
4. Again, when new connections are made (e.g. the first time you plug in a cable into your ethernet adapter), Windows Firewall re-enables itself. Simplewall should recognize this behavior and disable Windows Firewall again.

[privacyguy123]

I have Windows Defender Firewall completetely disabled so my system favours Simplewall - am I misunderstanding something here?

[ltGuillaume]

As I already said, Windows Defender Firewall can re-enable itself. Simplewall used to check its status on start-up, but since 3.0.8 it doesn't do so anymore.

[henrypp]

As I already said, Windows Defender Firewall can re-enable itself.

Hmm. Proof!?

[ltGuillaume]

As I already said, it happens when I plug in a network cable and Windows does not have a network profile for this connection yet.

This probably means it will also do this when connecting to a new wireless network.

This can be reproduced by disconnecting from your network, then removing that network profile from the registry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and reconnecting.