Firewall and VPN issue on Windows
up vote
0
down vote
favorite
I was looking for a basic firewall program for outbound blocking. The only feature I needed was a notification for any new outbound connection so I could choose to allow or block.
The free "Windows Firewall Control" (by binisoft) did what I needed. Except one problem that I need help with:
After initial setup, the "connection log" remains mostly empty (as expected), BUT when I'm connected to a VPN, it fills up rapidly with blocked outgoing connections for svchost.exe. Even though I have previously granted full access to svchost. The VPN connection itself works fine and I can connect to the internet, but the log keeps adding new entries every second and fills to 100s of lines.
Screenshot
The expected behavior would be for me to get a notification to allow/block the outgoing connection, but I don't get any. Even if manually allow svchost full access, these entries keep coming.
To troubleshoot, I tried another firewall program called "Simplewall". Here I don't see similar entries on it's default setting, but I see them again if I enable "Dropped packets log". And they look like:
12/8/2018 9:37:27 AM,NT AUTHORITYNETWORK SERVICE,C:windowssystem32**svchost.exe**,192.168.X.X:53 (Remote),192.168.X.X:54108 (Local),udp,OpenVPN,#288909,OUT,BLOCK
Even with this firewall I don't get any new notification asking for access. And I have already granted full access to all VPN .exe files and svchost.exe (I basically said Yes to all initial notifications to allow everything). The internet/VPN works fine, but these numerous blocked attempts keep accumulating.
Sounds like it's something to do with "dropped packets" (and that these are not "normal" outgoing connection attempts).
Anyone familiar with this and can help figure out what's going on?
(Btw, I tried a third firewall called "Windows 10 Firewall Control" by sphinx software. Same phenomenon when on VPN. If I don't connect to VPN, I don't see the blocked connection entries)
vpn firewall openvpn windows-firewall
asked Dec 8 at 20:10
kayan1
12
|
show 2 more comments
up vote
0
down vote
favorite
I was looking for a basic firewall program for outbound blocking. The only feature I needed was a notification for any new outbound connection so I could choose to allow or block.
The free "Windows Firewall Control" (by binisoft) did what I needed. Except one problem that I need help with:
After initial setup, the "connection log" remains mostly empty (as expected), BUT when I'm connected to a VPN, it fills up rapidly with blocked outgoing connections for svchost.exe. Even though I have previously granted full access to svchost. The VPN connection itself works fine and I can connect to the internet, but the log keeps adding new entries every second and fills to 100s of lines.
Screenshot
The expected behavior would be for me to get a notification to allow/block the outgoing connection, but I don't get any. Even if manually allow svchost full access, these entries keep coming.
To troubleshoot, I tried another firewall program called "Simplewall". Here I don't see similar entries on it's default setting, but I see them again if I enable "Dropped packets log". And they look like:
12/8/2018 9:37:27 AM,NT AUTHORITYNETWORK SERVICE,C:windowssystem32**svchost.exe**,192.168.X.X:53 (Remote),192.168.X.X:54108 (Local),udp,OpenVPN,#288909,OUT,BLOCK
Even with this firewall I don't get any new notification asking for access. And I have already granted full access to all VPN .exe files and svchost.exe (I basically said Yes to all initial notifications to allow everything). The internet/VPN works fine, but these numerous blocked attempts keep accumulating.
Sounds like it's something to do with "dropped packets" (and that these are not "normal" outgoing connection attempts).
Anyone familiar with this and can help figure out what's going on?
(Btw, I tried a third firewall called "Windows 10 Firewall Control" by sphinx software. Same phenomenon when on VPN. If I don't connect to VPN, I don't see the blocked connection entries)
vpn firewall openvpn windows-firewall
asked Dec 8 at 20:10
kayan1
12
Why aren't you using the Windows Defender Firewall?
– harrymc
Dec 8 at 20:29
It does not give a notification to allow or block an outgoing connection when a new program tries to do so.
– kayan1
Dec 8 at 20:42
Yes, it does - link.
– harrymc
Dec 8 at 20:44
Are you saying that if I turn on Outbound blocking (which is disabled by default), it will show a popup notification asking me to allow or block every new application?
– kayan1
Dec 8 at 20:50
No, this is the normal functioning of the firewall.
– harrymc
Dec 8 at 20:51
|
show 2 more comments
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I was looking for a basic firewall program for outbound blocking. The only feature I needed was a notification for any new outbound connection so I could choose to allow or block.
The free "Windows Firewall Control" (by binisoft) did what I needed. Except one problem that I need help with:
After initial setup, the "connection log" remains mostly empty (as expected), BUT when I'm connected to a VPN, it fills up rapidly with blocked outgoing connections for svchost.exe. Even though I have previously granted full access to svchost. The VPN connection itself works fine and I can connect to the internet, but the log keeps adding new entries every second and fills to 100s of lines.
Screenshot
The expected behavior would be for me to get a notification to allow/block the outgoing connection, but I don't get any. Even if manually allow svchost full access, these entries keep coming.
To troubleshoot, I tried another firewall program called "Simplewall". Here I don't see similar entries on it's default setting, but I see them again if I enable "Dropped packets log". And they look like:
12/8/2018 9:37:27 AM,NT AUTHORITYNETWORK SERVICE,C:windowssystem32**svchost.exe**,192.168.X.X:53 (Remote),192.168.X.X:54108 (Local),udp,OpenVPN,#288909,OUT,BLOCK
Even with this firewall I don't get any new notification asking for access. And I have already granted full access to all VPN .exe files and svchost.exe (I basically said Yes to all initial notifications to allow everything). The internet/VPN works fine, but these numerous blocked attempts keep accumulating.
Sounds like it's something to do with "dropped packets" (and that these are not "normal" outgoing connection attempts).
Anyone familiar with this and can help figure out what's going on?
(Btw, I tried a third firewall called "Windows 10 Firewall Control" by sphinx software. Same phenomenon when on VPN. If I don't connect to VPN, I don't see the blocked connection entries)
vpn firewall openvpn windows-firewall
asked Dec 8 at 20:10
kayan1
12
I was looking for a basic firewall program for outbound blocking. The only feature I needed was a notification for any new outbound connection so I could choose to allow or block.
The free "Windows Firewall Control" (by binisoft) did what I needed. Except one problem that I need help with:
After initial setup, the "connection log" remains mostly empty (as expected), BUT when I'm connected to a VPN, it fills up rapidly with blocked outgoing connections for svchost.exe. Even though I have previously granted full access to svchost. The VPN connection itself works fine and I can connect to the internet, but the log keeps adding new entries every second and fills to 100s of lines.
Screenshot
The expected behavior would be for me to get a notification to allow/block the outgoing connection, but I don't get any. Even if manually allow svchost full access, these entries keep coming.
To troubleshoot, I tried another firewall program called "Simplewall". Here I don't see similar entries on it's default setting, but I see them again if I enable "Dropped packets log". And they look like:
12/8/2018 9:37:27 AM,NT AUTHORITYNETWORK SERVICE,C:windowssystem32**svchost.exe**,192.168.X.X:53 (Remote),192.168.X.X:54108 (Local),udp,OpenVPN,#288909,OUT,BLOCK
Even with this firewall I don't get any new notification asking for access. And I have already granted full access to all VPN .exe files and svchost.exe (I basically said Yes to all initial notifications to allow everything). The internet/VPN works fine, but these numerous blocked attempts keep accumulating.
Sounds like it's something to do with "dropped packets" (and that these are not "normal" outgoing connection attempts).
Anyone familiar with this and can help figure out what's going on?
(Btw, I tried a third firewall called "Windows 10 Firewall Control" by sphinx software. Same phenomenon when on VPN. If I don't connect to VPN, I don't see the blocked connection entries)
vpn firewall openvpn windows-firewall
vpn firewall openvpn windows-firewall
asked Dec 8 at 20:10
kayan1
12
asked Dec 8 at 20:10
kayan1
12
edited Dec 8 at 20:20
asked Dec 8 at 20:10
kayan1
12
asked Dec 8 at 20:10
kayan1
12
asked Dec 8 at 20:10
kayan1
12
12
Why aren't you using the Windows Defender Firewall?
– harrymc
Dec 8 at 20:29
It does not give a notification to allow or block an outgoing connection when a new program tries to do so.
– kayan1
Dec 8 at 20:42
Yes, it does - link.
– harrymc
Dec 8 at 20:44
Are you saying that if I turn on Outbound blocking (which is disabled by default), it will show a popup notification asking me to allow or block every new application?
– kayan1
Dec 8 at 20:50
No, this is the normal functioning of the firewall.
– harrymc
Dec 8 at 20:51
|
show 2 more comments
Why aren't you using the Windows Defender Firewall?
– harrymc
Dec 8 at 20:29
It does not give a notification to allow or block an outgoing connection when a new program tries to do so.
– kayan1
Dec 8 at 20:42
Yes, it does - link.
– harrymc
Dec 8 at 20:44
Are you saying that if I turn on Outbound blocking (which is disabled by default), it will show a popup notification asking me to allow or block every new application?
– kayan1
Dec 8 at 20:50
No, this is the normal functioning of the firewall.
– harrymc
Dec 8 at 20:51
Why aren't you using the Windows Defender Firewall?
– harrymc
Dec 8 at 20:29
Why aren't you using the Windows Defender Firewall?
– harrymc
Dec 8 at 20:29
It does not give a notification to allow or block an outgoing connection when a new program tries to do so.
– kayan1
Dec 8 at 20:42
It does not give a notification to allow or block an outgoing connection when a new program tries to do so.
– kayan1
Dec 8 at 20:42
Yes, it does - link.
– harrymc
Dec 8 at 20:44
Yes, it does - link.
– harrymc
Dec 8 at 20:44
Are you saying that if I turn on Outbound blocking (which is disabled by default), it will show a popup notification asking me to allow or block every new application?
– kayan1
Dec 8 at 20:50
Are you saying that if I turn on Outbound blocking (which is disabled by default), it will show a popup notification asking me to allow or block every new application?
– kayan1
Dec 8 at 20:50
No, this is the normal functioning of the firewall.
– harrymc
Dec 8 at 20:51
No, this is the normal functioning of the firewall.
– harrymc
Dec 8 at 20:51
|
show 2 more comments
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1381959%2ffirewall-and-vpn-issue-on-windows%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1381959%2ffirewall-and-vpn-issue-on-windows%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Why aren't you using the Windows Defender Firewall?
– harrymc
Dec 8 at 20:29
It does not give a notification to allow or block an outgoing connection when a new program tries to do so.
– kayan1
Dec 8 at 20:42
Yes, it does - link.
– harrymc
Dec 8 at 20:44
Are you saying that if I turn on Outbound blocking (which is disabled by default), it will show a popup notification asking me to allow or block every new application?
– kayan1
Dec 8 at 20:50
No, this is the normal functioning of the firewall.
– harrymc
Dec 8 at 20:51