Windows 7 Firewall blocks incoming connection even though there is an “allow” rule

firewallwindowswindows 7windows firewall

I'm running a (.net WCF) HTTP Service on 0.0.0.0:60001 and a remote client – on the same network – can't connect.
Looking at the windows event log, i can see two related events:

Event ID 5152, The Windows Filtering Platform has blocked a packet.
Network Information:
    Direction:            Inbound
    Source Address:       192.168.2.80
    Source Port:          42989
    Destination Address:  192.168.2.223
    Destination Port:     60001
    Protocol:             6

Caution: Regarding Event 5152, i think that event viewer / log writer is giving false info. 192.168.2.80 is the remote IP . So it can't be Inbound and Destination Address at the same time. I've checked with ipconfig that no local interface is assigned 192.168.2.80.

and:

Event ID 5157, The Windows Filtering Platform has blocked a connection.
Network Information:
    Direction:            Inbound
    Source Address:       192.168.2.223
    Source Port:          60001
    Destination Address:  192.168.2.80
    Destination Port:     42989
    Protocol:             6

Application Information:
    Process ID:           4
    Application Name:     System

Filter Information:
    Filter Run-Time ID:   71532
    Layer Name:           Receive/Accept
    Layer Run-Time ID:    44

UPDATE
I just found out that there's a "McAfee Firewall core Service" running. My best bet is that it's also hooking into Windows Filtering Platform and causing my issues… can anyone confirm whether this is likely true or not?


So naturally i go poking around Windows Firewall with advanced security.
Let me start with saying that i'm using a computer connected to a domain. There are security policies in place so that i can't adjust all settings. The firewall is configured as follows:

Firewall State: On (recommended) (can't change that) 
Inbound connections: Block (default) (can only change that to Block all connection)
Outbound connections: Allow (default) (can't change that)

and it's running on all interfaces (can't change that either).

I've tried adding Inbound Allow rules. This is a summary of the most generic "allow all" one:

Profile: All, Action: Allow, Override: No, Program: Any, Local Address: Any, Remote Address: Any, Protocol: Any, LocalPort: Any, RemotePort: Any, Allowedusers: Any, AllowedComputers: Any

Additionaly I've tried Inbound allow rules:

  • specific to the program.
  • specific to TCP Port 60 001
  • specific to UDP Port 60 001

No combinations of these help.

I've also checked Windows Firewall with Advanced SecurityMonitoringFirewall. It shows all active rules, all of them are Action = Allow. There's no blocking rules. The rules i've created show up in this list.

I've also tried restarting the computer after changing the rules. And I've also restarted the program after every rule change.

Nothing helped so far.

Can you give me a hint what could be causing this? How can i get it working? Could there be domain-policies which prevent me from actually allowing such an incoming connection? If so – how can I check whether there are?

Best Answer

Shut down Mcafee or (better) uninstall Mcafee.... that is probably causing the issue.

Multiple security apps are a recipe for hassle.

Related Question