Enable Ping in Windows 7 Firewall

firewallpingwindows 7

Server Fault tells that the new syntax to enable ping on Windows Server 2008 is

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request"
    protocol=icmpv4:8,any dir=in action=allow

but this doesn't work with Windows 7. Here I get

C:\Windows\system32>netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

A specified value is not valid.

Usage: add rule name=<string>
...

What is the correct new syntax?

Best Answer

The problem is copy and paste. With the right quotation marks

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request"
    protocol=icmpv4:8,any dir=in action=allow

does the job. I'm not sure from which source I copied the problematic version.

Related Solutions

Windows firewall blocks outbound connection that is allowed by a rule

After asking for help in the Windows Filtering Platform (WFP) forum on MSDN I learned that you can capture the activity of WFP (which the firewall employs) using the following commands:

netsh wfp capture start
netsh wfp capture stop

The resulting log file is XML which makes it human readable and from that file I learned that wermgr.exe is blocked by the rule WSH Default Outbound Block with the description Blocks all outbound traffic for services who have been network hardened. Apparently, this rule takes precedence over my "allow" rule.

I'm not sure exactly why wermgr.exe is affected by the Windows Service Hardening default rule but I assume that one of the hardened services execute wermgr.exe to perform a task of connecting to the server at 65.55.53.190 (a Microsoft IP address), and wermgr.exe is then blocked just as the service would be.

Windows Firewall – How to Enable Ping

The reason for it working when "All programs" is selected and not when using the ping.exe seems to be that the firewall does not see the source/destination program for the ICMPv4 traffic, and only sees the "System" process and that the "System" process falls under the "All programs" category.

Note that

In the field where it is asking for a full path to the executable you can just write: System
you will need to have your rules applied to the correct network profile of Domain, Private, or Public for your current connection
the "tracert" program is particularly usefull for diagnostics.

The default when adding a new ICMPv4 rule, allows all ICMPv4 types and codes. There are a bunch of icmp types and codes, see http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml for full detail. You may not want to allow all of the them.

For ping to work, it at least needs both outbound and inbound traffic for the

Echo request (ping) ICMP type 8
Echo reply (pong) ICMP type 0

Being MS they've tried to dumb it down a bit and hide the full detail. If you look in the "Advanced firewall area -> rule properties -> protocol and ports tab -> customise button" you will see the area for types and codes. On my system, which I believe is still in its default state, it has

outbound - ICMPv4 "Echo Request"
Inbound
- ICMPv4 "Echo Request" - (I'm assuming "Echo Request" in microsoftese means either request or reply)
- ICMP Type 3 (destination unreachable) code 4 (Fragmentation Needed and Don't Fragment was Set). Though I'm not sure why only code 4 is allowed when the other type 3 codes are quite useful to know.

Best Answer

Related Solutions

Windows firewall blocks outbound connection that is allowed by a rule

Windows Firewall – How to Enable Ping

Related Question