Windows firewall – Predefined set of computers

firewallnetworkingwindows

In the built-in firewall for Windows (Windows Firewall with Advanced Security), the definition of a firewall rule includes a Scope, which is a set of IP address filters which apply to the rule. There are three basic possibilities: IP Address/Subnet, IP address range, and Predefined set of computers. The first two are self explanatory.

If the Predefined Set option is selected, there are several choices: "Default Gateway", "WINS Servers", "DHCP Servers", "DNS Servers", "Local subnet", "Intranet", "Remote Corp Network", "Internet", "Play To Renderers".

So, my question is about these "predefined" options. I cannot find any definitive documentation which describes what these actually are. Some of them are, again, self explanatory (like "Local Subnet"), but others are mysterious (like "Play To Renderers"). And even the more obvious ones could have subtle permutations (what if there are multiple subnets?).

Where is there documentation (ideally from Microsoft) which describes all these "predefined" options? A nice extra would be documentation for a way to add something to this list (even using something esoteric like a plugin or custom DLL).

Best Answer

I am unable to find any Microsoft documentation detailing what exactly these predefined options refer to. It appears no such documentation exists as even on the TechNet forums no one was able to locate it.

Related Solutions

Windows – How to configure Windows Firewall to allow all ports in use by IIS Express

There are a couple problems you're running into here. One is that iisexpress.exe isn't actually the process responsible for listening to HTTP traffic. That functionality is implemented in http.sys as a kernel-mode part of the Windows networking stack. (This was done for performance reasons. For more information, see Introduction to IIS Architectures.) Therefore, creating a rule for iisexpress.exe won't do anything.

Secondly, http.sys by default doesn't allow programs running as non-admins listen to other computers. According to Serving External Traffic with WebMatrix, you need to run this command in an administrative command prompt to allow all users to listen to other machines via http.sys:

netsh http add urlacl url=http://MACHNAME:PORT/ user=everyone

Replace MACHNAME with the hostname that will be used to contact the site and PORT with the traffic's port. I have read that using * instead of a specific hostname lets it listen on all names/interfaces, but I have not personally tested that, and some documentation uses + instead. Either way, once you've set the ACL, you can then create an inbound firewall rule for the port.

Further reading: Configuring HTTP and HTTPS.

Side comment: There's an actual environment variable that points to the 32-bit version of Program Files: %PROGRAMFILES(X86)%. (The path wasn't your problem, though.)

Windows firewall blocking SSH to secondary subnet

You can create a custom rule that allows all inbound traffic from a certain subnet. Open Windows Firewall with Advanced Security (wf.msc). Right-click Inbound Rules, then choose Add Rule.

On the Rule Type screen, choose Custom.
On the Program screen, choose All programs.
On the Protocol and Ports screen, leave the default values (any protocol).
On the Scope screen, leave the local IP set to Any IP address. Set the remote IP to These IP addresses. Click the Add button. In the This IP address or subnet field, type 192.168.0.0/24 to allow in all traffic from the two subnets. Click OK. Caution: This may expose the machine to attacks from other computers on the network. If possible, set more specific port/program rules.
On the Action screen, choose Allow the connection.
On the Profile screen, check the boxes corresponding to the profiles on which the rule should be active.
On the Name screen, enter an appropriate name and description (if you like), then click Finish to apply the rule.

Alternatively, you can use netstat or TCPView to figure out what specific connections are made, then create more specific firewall rules for those.

Best Answer

Related Solutions

Windows – How to configure Windows Firewall to allow all ports in use by IIS Express

Windows firewall blocking SSH to secondary subnet

Related Question