In windows xp sp2, windows firewall has many new features, including: default for all connections to the computer, new global configuration options for all connections, for global configuration New dialog sets, new operating modes, boot security, local network restrictions, and abnormal traffic can be specified by the application file name for built-in support for Internet Protocol version 6 (ipv6)
Using netsh and group policies New configuration options
This article will detail the dialog set used to manually configure the new Windows Firewall. Unlike the icf in windows xp (pre-sp2), these configuration dialogs can configure both ipv4 and ipv6 traffic. The icf setting in windows xp (pre-sp2) contains a single checkbox (on the <quo;Advanced” tab of the connection properties) to protect my computer and network by restricting or blocking access to this computer from the internet. ” checkbox) and a "Settings" button that you can use to configure traffic, log settings, and allowed icmp traffic.
In windows xp sp2, the checkbox on the “Advanced" tab of the connection properties is replaced with a "Set" button that you can use to configure general settings, programs, and services. Permissions, settings specified for the connection, log settings, and allowed icmp traffic.
The new windows firewall dialog contains the following tabs:
“General”“Exception”“Advanced”“General” Tab
On “General” Tab On top, you can choose from the following options:
“Enable (Recommended)”
Select this option to enable Windows Firewall for all network connections selected on the “Advanced” tab.
Windows Firewall will only allow requested and abnormal incoming traffic when enabled. Abnormal traffic can be configured on the "Exceptions" tab.
“About Abnormal Traffic"
Click this option to allow only incoming traffic for the request. This will not allow abnormal incoming traffic. The settings on the "Exceptions" tab will be ignored and all connections will be protected regardless of the settings on the “Advanced" tab.
“Disable”
Select this option to disable the Windows Firewall. This is not recommended, especially for network connections that are directly accessible via the internet.
Note: For all connections and newly created connections to computers running Windows XP SP2, the default setting for Windows Firewall is “Enable (recommended)”. This can affect the communication of programs or services that rely on unsolicited incoming traffic. In such cases, you must identify those programs that are no longer working and add them or their traffic as abnormal traffic. Many programs, such as internet browsers and email clients (such as Outlook Express), do not rely on unsolicited incoming traffic, so they can operate correctly with Windows Firewall enabled.
If you are using Group Policy to configure the Windows Firewall on a computer running Windows XP SP2, the Group Policy settings you configured may not allow local configuration. In such cases, the options on the "General" tab and other tabs may be grayed out and cannot be selected, even local administrators cannot make selections.
Group Policy-based Windows Firewall settings allow you to configure a domain profile (a set of windows firewall settings that will be applied when you connect to a network that contains a domain controller) and a standard profile (a set will be on you) Connect to a Windows Firewall setting that is applied when a network like the internet does not contain a domain controller). These configuration dialogs only show the Windows Firewall settings for the currently applied profile. To view the settings of a profile that is not currently applied, use the netsh firewall show command. To change the settings of a profile that is not currently applied, use the netsh firewall set command.
& ldquo;Exceptions &
On the "Exceptions" tab, you can enable or disable an existing program or service, or maintain a list of programs or services that define unusual traffic. . Abnormal traffic will be rejected when the “Allow Unwanted Traffic" option is selected on the “General" tab.
For windows xp (pre-sp2), you can only define abnormal traffic based on the Transmission Control Protocol (tcp) or User Datagram Protocol (udp) ports. For windows xp sp2, you can define abnormal traffic based on the tcp and udp ports or the file name of the program or service. This configuration flexibility makes configuring anomalous traffic easier when the tcp or udp port of the program or service is unknown or needs to be dynamically determined at the start of the program or service.
There is a set of pre-configured programs and services, including:
File and Print Sharing, Remote Assistant (enabled by default), Remote Desktop, upnp framework, these predefined programs and services are not removable.
If Group Policy allows, you can also create additional anomalous traffic based on the specified program name by clicking "Add Program", and create a tcp or udp based on the specified by clicking “Add Port” Abnormal traffic on the port.
When you click “Add Programs, the "Add Programs" dialog box will pop up, where you can select a program or browse the file name of a program.
When you click “Add Port", the “Add Port” dialog box will pop up where you can configure a tcp or udp port.
One of the features of the new Windows Firewall is the ability to define the range of incoming traffic. The scope defines the network segment that is allowed to initiate abnormal traffic. When defining the scope of a program or port, you have two options:
“any computer” allows abnormal traffic from any ip address.
“Only my network (subnet)”
Only allow abnormal traffic from the following ip address, ie it matches the local network segment (subnet) to which the network connection receiving the traffic is connected . For example, if the IP address of the network connection is configured to 192.168.0.99 and the subnet mask is 255.255.0.0, then the abnormal traffic only allows ip addresses from 192.168.0.1 to 192.168.255.254.
When you want to allow a local home network to connect to a computer on the same subnet to access a program or service, but you don't want to allow potentially malicious internet users to access it, then "just my network" Network) & rdquo; The set address range is very useful.
Once a program or port has been added, it is disabled by default in the "Programs & Services" list.
All programs or services enabled on the "Exceptions" tab are enabled for all connections selected on the "Advanced" tab.
“Advanced<quo;tabs
“Advanced”tabs contain the following options:
Network Connection Settings, Security Log, icmp, Default Settings
“Network Connection Settings”
In <quo;Network Connection Settings", you can:
1. Specify the interface set on which you want to enable Windows Firewall. To enable Windows Firewall, check the box next to the network connection name. To disable the Windows Firewall, clear the check box. By default, Windows Firewall is enabled for all network connections. If a network connection does not appear in this list, then it is not a standard network connection. Examples of this include custom dialers provided by the internet service provider (ISP). 2. Configure the advanced configuration of the individual network connections by clicking on the network connection name and then clicking on “Settings". If you clear all the checkboxes in the "Network Connection Settings", Windows Firewall will not protect your computer, regardless of whether you have selected "Enable (Recommended)" on the “General” tab. . If you select "Allow abnormal traffic" on the “General" tab, then the settings in "Network Connection Settings" will be ignored, in which case all interfaces will be protected. When you click “Set", the “Advanced Settings” dialog box will pop up. On the “Advanced Settings” dialog, you can configure specific services in the “Services” tab (configured only on tcp or udp ports) or enable specific types in the “icmp” tab. Icmp traffic. These two tabs are equivalent to the settings tab of the icf configuration in windows xp (pre-sp2 version).
“Security Log"
In the "Security Log", please click "Settings" to specify the configuration of the Windows Firewall Log in the "Log Settings" dialog box, in &ldquo In the Log Settings dialog box, you can configure whether you want to log dropped packets or successful connections, as well as specify the name and location of the log file (the default is systemrootpfirewall.log) and its maximum capacity.
“icmp”
In “icmp”, click “Set" to specify the allowed icmp traffic type in the “icmp” dialog box, in the “icmp” dialog box, You can enable and disable the type of icmp messages that Windows Firewall allows for incoming connections on all the options selected on the “Advanced tab. The icmp message is used to diagnose, report error conditions, and configuration. By default, no icmp messages are allowed in this list.
A common step in diagnosing connection problems is to use the ping tool to verify the address of the computer you are trying to connect to. At the time of verification, you can send an icmp echo message and then get an icmp echo reply message as a response. By default, Windows Firewall does not allow incoming icmp echo messages, so the computer cannot send back an icmp echo reply message as a response. In order to configure the Windows Firewall to allow incoming icmp echo messages, you must enable “Allow incoming echo requests” settings.
“Default Settings
Click “Restore Defaults to reset the Windows Firewall back to its initial installation state. When you click “ Restore Defaults>, the system prompts you to verify your decision before the Windows Firewall settings change.