So I got a chance to play with Vista and its firewall today at work and I have to admit, it had me a little befuddled. As a brief background, I'll say most of my firewalling experience has been either using OpenBSD
pf,
ipchains/
iptables, or
ipfw. So I was happy to see that Vista brought with it a stateful packet inspecting
firewall to replace the joke that was in XP.
Unfortunately, Microsoft assumes a lot of things and abstracts a lot from the user. The best example of this is with the network profiles. The network profile is straight forward; it allows you to create a set of networking configuration info for a specific network or scenario in a network. By default, they provide a "public" (most restrictive), "private" (less restrictive), and "domain" (domain specified) profiles. You can create your own profiles as well. This is a nice addition, but really makes the firewall configuration more difficult if you don't agree with Microsoft's rulesets provided with their profiles. The simple control panel interface doesn't help with this at all either.
For example, lets say your computer is on a large private network (using some IANA reserved space, like 10.x.x.x) and your computer is not part of a domain. Now, lets say you want to allow remote administration via RPC either for vulnerability scanning, or your own remote control from other points on the network. You'll find that even when you enable "Remote Administration" in the Vista control panel, that unless you are on the local network segment, you won't be able to access those ports.
What makes it that much more irritating is that the dummy firewall control panel doesn't really provide you with any useful information about how its restricting or not restricting access to specific services. In order to find out what's really happening, you have to either find the Advanced Firewall adminstrator tool, or you have to use the
netsh command line tool to inspect the firewall rules directly.
After doing this, I realized that by default, the applications listed in the dummy control panel interface are nothing more than their ruleset "Groupings" and within each of these groupings are one or more rules which may be configured differently for each default network profile. So, going back to our Remote Administration via RPC example, I noticed that for the "Remote Administration" grouping, there were two rulesets: the first applied to
public and
private network profiles and inbound connections were only allowed from
LocalSubnet. The second profile applid to the
domain network profile and allowed inbound connections from
Any. Even though both rules were enabled, only the former was being honored since the computer was using the
private network profile.
This is fine once you realize it, but its not very obvious from the perspective of a new novice or power user of Vista. There's no link in the Firewall control panel to the Advanced Firewall interface, and the command line interface is one of those things that most Windows users (even the power users) likely won't use. Hell, even for a nix junkie like me, I found
netsh to be a horrible pain to use.
So for what its worth, if you're using one of Microsoft's default profiles and/or you've enabled an application to accept inbound connections via the firewall control panel, but you can't connect to it from computers outside your local subnet, you probably need to pull up either
netsh or the Advanced Firewall Configuration interface to tweak or add new rules to do what you want.