Endpoint Protection

 View Only
  • 1.  How to specify 'any' for ports on firewall rules

    Posted Jun 28, 2017 10:00 PM

    Hi, I have been trying to create a rule on a test firewall policy to allow Miracasting to work from a Surface Pro 4 to a projector.

    Based on testing and log monitoring so far, I have created a rule with these details:
    Action: Allow
    Application: Blank = Any
    Host: Blank = Any
    Service
    TCP: Local Port 7236, Remote Port 7236, Direction Both (someone else actually put this in, don't think it's required)
    UDP: Local 67,68, Remote 67,68, Direction Both
    ICMPv6: Type 143, Code 0, Direction Both (not sure what this is, but it kept being blocked during testing)
    UDP: Local blank, Remote 5355, Direction Outgoing
    Log: Write to traffic log
    SEPMireCastRule.JPG

    I'm seeing blocks in the Network Threat Protection Traffic Log:
    Outgoing, UDP, Remote Port 5355, Local Port changes each time, ranges from 51895 to 65340, application C:\Windows\System32\svchost.exe.
    This is blocked by the (default?) 'Block IPv6' rule.

    Can someone plese confirm that leaving Local Port blank when adding UDP Protocol under Service means 'Any', I want any outoing traffic to Remote Port 5355 to be allowed.
    I've also tried with Local Port 0, it won't let me put in *.

    If I untick\disable all rules, then it connects.

    Thanks
     



  • 2.  RE: How to specify 'any' for ports on firewall rules

    Posted Jun 29, 2017 06:49 AM

    Don't know about the blank, have you tried 0-65535?



  • 3.  RE: How to specify 'any' for ports on firewall rules

    Posted Jun 29, 2017 08:18 AM

    Leaving it at just the 'UDP' protocol with no ports defined should allow any type of UDP traffic.

    The last rule in the stack, 'Block all other traffic and don't log' may be causing the problem. Do you have logging turned on for this rule? 



  • 4.  RE: How to specify 'any' for ports on firewall rules

    Posted Jul 03, 2017 04:30 PM

    I had logging enabled for all blocking rules, it was the 'Block IPv6' rule that was blocking stuff.

    Turns out it eventually started working with the rule as is, UDP remote port 5355, direction = outgoing.
    It connected maybe 6/10 times, but would usually not re-connect until I logged off\on.
    IP type 2 was still blocked, it seemed appear more than usual when trying to connect to the projector so I added a rule to allow that too in case it was causing issues, Protocol IP, Protocol Type 2, direction Outgoing.