Programs : Windows 7 Firewall Control

Applications
Programs List

The Programs List contains all the applications registered and controlled by Windows 7 Firewall Control. The list contains two columns - application name and application access permission.
All the operations with the listed programs are performed via the toolbar, the right mouse click menu or the hotkey (see the menu for the hotkey assistance). So the programs can be inserted, deleted and/or edited.

Edit Application Access

If an unlisted application requires network access or you edit a listed application access, "Edit Application" dialog will allow you to set or change the security zone, i.e. to allow/prohibit the application network activity. Choosing "EnableALL" allows the application access in the both directions (incoming and outgoing). DisableAll prohibits the network access. IncomingOnly/OutgoingOnly allows access only in specified direction.
The common rule of the network protection supposes minimal application network access allowed. So, do not allow the access for unknown/unrequired applications. Usually user level network active applications (not system services/servers) require outgoing access allowed only, therefore the best permission for them is OutgoingOnly.
"Allow in Mode: Expensive/Insecure Connection" marks the application to follow the zone set in "Mode: Expensive/Insecure Connection" (available via Tray Icon/Right Click menu) as well. All the other unmarked applications will not be allowed to access the network when the mode is set.
Note: Some applications may require the network access in both directions always (FTP clients, instant messengers etc)

Extra information (Plus version only)

Two additional columns are included:
  • Run - to show whether the application is currently running
  • Ext - to indicate the application is configured for external/worldwide access via Port Forwarding
The columns information is not updated immediately. There is a delay 5-10 seconds to save the computer resources.


Server Edition : Windows 7 Firewall Control

Server Edition

Windows 7 Firewall Control Server Edition allows you to set application network [image] access permission individually per-user. As the result, you can set zones for Administrator, Guest and any other user for a particular application separately. The feature is extremely useful with Terminal Server (Windows Server 2008 or Windows 7 Server), however, the Server Edition can be launched on any Vista and Windows 7 running computer.
You can determine Internet Explorer (for instance) is able to connect to any site for administrators, to corporate local network web server only for regular users and unable to browse any web server for guests.

How to configure the per-user access

The "User" column shows the username for application and access zone set in the Programs tab of Windows 7 Firewall Control Server Edition. The "User" parameter can be changed with Edit Application dialog by the user selection option available in Server Edition only. You can set a separate zone to every separate user registered on the computer, server or the domain.
The following per-user management logic must be supposed. If a specific user is set to an application with a zone the application will follow the chosen access zone when the application is launched in name of the user only. If the application with the zone is set to "Any User", the application will follow the zone when the application is launched in name of all the other users.
For example, you have Internet Explorer set to Web+FTPZone for "Any User", Internet Explorer set to DisableAll for Guest and Internet Explorer set to LocalOnly for JohnSmith. As the result, Internet Explorer will follow the rules for the users above as specified and Web+FTPZone for the other users including Administrators, regular users and so on.
Please bear in mind Windows 7 Firewall Control is able to detect non-listed applications only, so if you have an application set to a specific user and do not have the application set to "Any User", the application launched in name of any other user will not be detected for the second time and will be entirely blocked as any other initial access attempt is blocked. The hint may be used to create special security schemes however.


System Integration : Windows 7 Firewall Control

System Integration (API)

Windows7FirewallControl can be integrated in a third party product/system to control applications access following the third party system requirements. Windows7FirewallControl can be represented in several forms
  • native Windows 32 (or 64) bit DLL for direct usage
  • InProc 32/64 bit COM server
  • OutProc 32/64 bit COM server
  • 32/64 bit COM server in the form of Windows Service

Windows7FirewallControl can be used in Vista/Window7 based systems to control user applications activity to limit redundant traffic (application auto updates, for instance) in expensive (satellite) network channels.

There are some additional modules for Windows7FirewallControl based network management

  • Complex processing (detecting/modifying) traffic content
  • Bandwidth Limiting
  • Native Windows Internet Connection Sharing (ICS)/Bridge management on per-IP (and/or per traffic content) basis


F.A.Q. : Windows 7 Firewall Control

Frequently Asked Questions

How to Un-install

Windows7FirewallControl un-installer requires Windows7FirewallControl's control panel (for desktop version) is not running. The requirement prevents you from redundant necessity of reboot after the un-installation. As the result, to uninstall the product, please close Windows7FirewallControl first: TrayIcon/RightClick/Close.

Windows 7 Firewall Control and the Built-in Firewall

Windows7FirewallControl is completely based on Windows Filtering Platform (WFP), the security core introduced in Windows Vista and does not install any third party kernel drivers. The Built-in Firewall is based on the same WFP as well. The both products work entirely independently. Windows7FirewallControl uses the Built-in Firewall only once, at the first start to grab the initial settings. Due to complete product independence you can switch the Built-in Firewall ON or OFF at your option.
My Application is Blocked...

Windows7FirewallControl is completely based on Windows Filtering Platform (WFP), as the result some WFP specifics should be taken into consideration. _Any_ initial access attempt of _any_ unlisted application is rejected. Unfortunately, The rejection is the only way to detect new application access by catching the blocking notification. Probably it is not a bad choice, as the firewall should block any malware trying to send everything on the start.
After the rejection the default zone (DisableAll only for free version) is applied immediately and you are shown with "Edit Program" dialog to choose a zone. Pressing Apply (or ApplyOnce), the chosen zone is applied.
Usually applications make several attempts to reestablish the connection so everything goes "smoothly". Unfortunately, some applications make only one attempt, so you have to force "reconnection" manually. Hopefully it occurs only once, while the application is not listed only.
Web Installers

If you have set "EnableAll" to an application and forced the "reconnect" you may still be blocked. The reason is sometimes simple. The application (mostly web installer) downloads/uses the actual installing component every time under a new name (or in a new directory). So the actual installing component is always new (unlisted, always initially rejected) for Windows7FirewallControl and so, the scenario of initial rejection repeats endlessly. To avoid that, you can find real path of the web-installer (find the application in the Application List, chose Edit and see the path) and invoke it manually rather than refreshing the entire web-page, where the installer is originated from.
Permanent Disk activity

Unexpected disk activity is encountered while running Windows7FirewallControl. The activity is mostly related to wfpdiag.etl file and detected by some "monitoring" programs (for instance, AMON/NOD32). The activity is not caused by Windows7FirewallControl directly.
Actually VFC performs some polling actions to underlying network core - Windows Filtering Platform (WFP), but never originates a direct file access for that. The polling is used for real-time application access detection and for blocked event notification. We have no official information regarding WFP internals, but the file name is self descriptive. So Windows7FirewallControl does not "touch" the file, WFP does. We are working for the solution.

I have found a leak

There are some on-line leak tests saying "failed" to Windows7FirewallControl. Strictly speaking, VFC is completely based on Windows Filtering Platform (WFP) - security core introduced in Vista. (Note: The built-in Windows7/Vista firewall is based on the same security core). So any leaks detected in Windows7FirewallControl should be probably addresses to Microsoft directly. Anyway, Windows7FirewallControl is not able to affect quality of the underlying core neither positively nor negatively, Windows7FirewallControl is a user friendly front-end to WFP.
On the other hand, there is not a big problem to write a program, which communicating with a site, says "failed". No detailed information on the performed test is usually provided. The same tests sometimes claim that the world market leaders can not pass the test. Sometimes the only program passed the test is advertised at the same page. Please make your own conclusion regarding the "purpose" of the test.

An application is enabled, but the notifications are coming

The notification balloon shows the entire blocked events regardless of their origin. So the blocking events shown may be originated by another program or even by the network "peer". You can set temporarily "Mode:EnableAll" in the tray menu to verify the blocking origin. The option switches of the firewall entirely.

How to disable blocking notifications in Free versions

User Regedit.exe (an utility from your Windows installation) to set in HKEY_CURRENT_USER\Software\sphinx-soft\Vista-Wall\1.0\GUI\1.0 "BalloonMax" parameter to zero (the desktop versions only). Refer to Regedit manual if required. To disable notification in Portable/U3 versions find YourComputerName.cfg (CFG file with the name equal to your computer name) in the installation directory and using a text editor (Notepad, for instance) find/change the same parameter. The program has to be restarted to reflect the changes. The option is available starting from version 1.2

"System" applications default zone

The Free version can not protect "system" applications, formally located in C:\windows\*. So the Free version blocks any initial network access attempts of the "system" applications (as explained above), forcibly/implicitly sets "EnableAll" zone always and prompts you with "Now Enabled:" in the notification balloon. The behavior provides system/network related services with unlimited network access.

"Blockall" are set to "EnableAll"

Windows7FirewallControl Plus grabs initial settings from native built-in firewall. The native initial settings sometimes include entries with "Blockall" style names. However, the entries do not include blocking rules, so the entries disable nothing and, therefore, are in "EnableAll" state. As the result, Windows7FirewallControl shows "Blockall" names in "EnableAll" state to reflect the built-in firewall state. Probably, the entries of the built-in firewall are actually placeholders to set the blocking later.

"Heavy load" message

Sometimes Windows7FirewallControl shows "The operation can not be completed now because of your computer is under heavy load. Please retry". The message is not sign of a problem. The message is intended to inform you that a current Windows7FirewallControl operation can not be performed instantly and is scheduled for the next period (within next 20-30 seconds mostly). It happens mostly when CPU or disk are heavy loaded (peak values are important, not average ones) by other applications leaving not enough resources behind to perform security related operations. Even the message is shown you are still protected, but temporary "deprived" of an ability to change the security settings.


Port Forwarding : Windows 7 Firewall Control

Port Forwarding (Plus version only)
Abstract

There are applications require external incoming access from the internet:
  • Server applications (ex: Web and/or FTP Server)
  • Communication applications (ex: Internet/IP phones, instant messengers and even Skype, which sound quality can be improved by enabling direct incoming connections
  • Peer-to-Peer applications may not work at all without direct incoming access (ex: eMule, eDonkey etc)

Usually home (SOHO) users are connected to the Internet via so called connection sharing box - external firewall/router/NAT, which connects several computers to the Internet through a single providers line and provides with some internet security.

The connection box has incontestable benefits; it protects from most incoming threats/attacks and allows using of single provider's IP address for multiple computers via NetworkAddressTranslation (NAT).

There is a side affect, however. There is no an automatic way to get incoming connections to a computer behind NAT. The single provider's (external) IP address belongs to all the computers behind NAT simultaneously and does not belong to a separate computer. The solution - so called - port forwarding - allows to configure external access from a selected external port to a selected internal port of the computer behind NAT.

There are three difficulties, unfortunately
  • Port Forwarding setting is a manual procedure. You have to connect to the sharing box via Web and turn on/off the Port Forwarding manually every time you do (or do not) need it.
  • Port Forwarding is to be configured to a selected port of a single computer only. The computer is determined by IP address, which is usually dynamic, is set by the sharing box automatically and so can be changed
  • Forwarded Ports are stayed forwarded up to a moment you manually switch them off. It is potential security hole, as all the incoming worldwide traffic to the external port of the sharing box goes to the local port regardless of a application "listening" the port. Moreover, due to dynamic IP address assignment mode the incoming activity can be directed to another (random) computer in the LAN behind NAT.

Windows7FirewallControl offers the solution to automate and secure the process via synchronization between Port forwarding settings and running applications.

Requirements

There are some requirements to automate and secure Port Forwarding to computer behind NAT with Windows7FirewallControl
  • The connection sharing box must be uPnP (universal Plug-and-Play) compatible. Most of modern connection sharing (firewall/NAT/router) boxes are uPnP compatible
  • uPnP must be enabled in the connection sharing box
  • uPnP infrastructure must be installed on the computer running Windows7FirewallControl. It is mostly installed by default.
  • uPnP infrastructure must be enabled and not disabled by a third party or native Windows firewall.
Port Forwarding

Windows7FirewallControl tracks applications requiring external incoming access (see Zones) and switches the Port Forwarding accordingly the application is running or not.

The Port Forwarding List allows you to manually insert/delete/modify Port Forwarding settings for current computer.
The List also shows (in read only mode) all port forwarding application requirements. Active Port Forwardings (for all the manual forwardings and the forwardings required by running applications) are marked with the "globe" sign.

The List content is refreshed automatically when a new application is configured to require the external incoming access and when the access requirement is deleted/modified. The refreshment does not occur immediately. There may be a delay of 5-10 seconds.

Anytime you can refresh the list manually by pressing refresh button. Be aware the refresh process can not be finished immediately due uPnP device discovery specifics. Maximum delay of about 9 seconds should be expected.


Windows 7 Firewall Control

Protects your applications from undesirable network incoming and outgoing activity, controls applications internet access. Allows you to control personal information leakage via controlling application network traffic.

Manages and synchronizes port forwarding provided by external network connection (firewall/router) box with applications requirements and activity.

Features

  • Designed for Windows 7 & Vista
  • Free versions available
  • Decreases expenses of mobile/satellite connections
  • Zone based network permissions management
  • Integration with Window Explorer for direct access permission management
  • Integration with Windows Security Center
  • Instant notifications of blocked activity
  • Special editions for portable devices (USB flash/HDD drives, iPod etc)
  • Special editions for U3 smart devices
  • Protection from incoming and outgoing threats
  • External network connection (firewall/router) box support
  • Automatic network connection box detection/management
  • External/worldwide access to selected local application
  • Port Forwarding management
  • Automatic Port Forwarding-to-applications synchronization
  • Simplicity of operation
  • Per-application security settings
  • Group zone and application network access permission management
  • IPv6 support


Settings : Windows 7 Firewall Control

Settings
(Plus version only)

The settings tab allows to
  • Adjust multiple security rules at once
  • Reflect changes and adjust multiple network parameter changes at once
  • Set the security zone to be used as default when an application network activity is detected
  • Enable/Disable notification dialog to set the initial security zone for an application, which network activity is initially detected
  • Enable/Disable blocked network attempts logging
LANs

If you connect the computer to a different internet provider, add/remove a network adapter or a network interface is switched on/off, the connection parameters of your computer are changed. So you have new LAN environment, you should have a way to change all the rules related to LAN in all existing zones at once.
Pressing the button Windows 7 Firewall Control collects all active network interfaces parameters into single list and allows editing them. Each the network interface found is appended with the LAN prefix. As the result all the network interfaces are represented as a list of separate access rules. After the editing of the list is finished all rules with the same prefix from all the zones are replaced with the new rule set. So, you can keep the same security for the applications in a new LAN

Rules

The button allows collecting of all the rules from all the zones (and the applications) and editing them in the single list. It gives a possibility to change one or many rules with the corresponding names in all the zones and all the applications at once. For example, you have a special rule for disk sharing. The rule participates in multiple zones enabling/disabling some details for each person using your shared information. If a person changes his connection parameters you need to reflect changes in all the zones. Using the feature you can change a rule and distribute the changes to all the zones, where the rule participates in.


User's manual : Windows 7 Firewall Control

Abstract

A network-connected application should not be supposed completely safe if it can be connected from and to any point of a network and/or the internet. Only rare the applications are to be allowed to connect to anywhere. A web browser should not be limited to connect the internet in ordinary circumstances. However, there are situations in which even the web browser should be limited in its connection ability (parental control etc).
Usually the applications are to be limited in its connection abilities to increase the security. If you have decided to share your disks (for example), the sharing hardly has to be provided to all over the world. Probably you would like to share your disks with trusted persons or trusted networks only. Windows 7 Firewall Control is the utility to simplify application network access management and to provide the application network security.
Application security is provided by setting an appropriate set of network access rules (or security zone), determining which network connections are to be allowed or rejected separately for each application. The network access rule is a named set of parameters describing a network connection (IP address or address range, port number etc) The rules are united under a unique name in zones. The zones then are applied by its name, setting correspondent set of the rules at once, simplifying the network access management. Windows 7 Firewall Control provides suitable procedure for group zone and/or rule management on zone/rule name basis.

User's manual

After the program launch you will see the [image] icon on the task-bar (usually next to the clock). The right mouse button click on the icon gives you the access to the program menu.

Special Modes

Windows 7 Firewall Control allows you to set special modes for all the controlled applications at once. The modes are available in the Tray Icon menu via right click:
  • Mode: Normal - The applications are allowed/prohibited following the zones set in Application List;
  • Mode: EnableAll - Enables all the applications, so switches the firewall off;
  • Mode: DisableAll - Disables all the applications regardless of per-application zone settings;
  • Mode: Expensive/Insecure Connection - Special mode for the use when Internet connection is made over Expensive or Distrusted network, for instance via mobile phone/operator or satellite. In the mode only applications marked as "Allow in Mode: Expensive/Insecure Connection" (see "Edit Application Access") are allowed following the zones set to the applications. All the other applications are blocked (excepting some system vital activities). The mode allows you to use only selected (specially allowed/trusted) applications to access the network preventing all other redundant (not required immediately) operations, auto updates, background network operations and so on. (Plus version only)

Windows Explorer integration
(Plus version only)

Windows 7 Firewall Control allows application network access control directly from the desktop with the context menu.


Wireless Security : Windows 7 Firewall Control

Wireless Security
(Plus version only)

The Home Approach

Almost any personal firewall uses a security approach divides all potentially accessible computers into two main categories - trusted and unsafe. Trusted computers are located in same local/home network and accessible locally/directly. All the other computers are accessible via the Internet and so expected unsafe.
The approach mostly works. Actually your home PC can hardly be attacked from a "kitchen" PC or from a computer based home theater. As the result, all the network activities are expected safe and enabled by default in almost any personal firewall. Frequently personal firewalls do not make any distinctions between different types of activities in home network and enable all the traffic completely.
The entire home network is mostly protected by a standalone internet connection device (firewall/router). The connection device blocks all especially dangerous incoming connections from the Internet. Even if the computer is connected to the Internet directly all the incoming the connections are perfectly protected by Windows Firewall. Outgoing connections are (sometimes mistakenly) expected safe by definition or managed by a personal firewall.

The Wireless Threats

All the wireless home connections may be supposed safe as the wireless connection medium in home local networks is functionally equal to wired one. Of course, some actions must be undertaken to limit those wireless connections to home network only - disable SID broadcasting and encode transmitting data by WEP/WPA at connection point side of the network. Anyway nothing should be done at PC side.
The situation is changed completely on public wireless connections. Imagine your local network is entire airport, entire library, entire cafe or entire hospital. All the computers in such networks are connected to the Internet via a single connection device (firewall/router), so your PC is still in local network but other local network computers of such network may not be expected trusted or safe.
Any approaches based on WEP/WPA traffic encoding do not help. The encoding saves from direct intercepting of the data between your PC and public connection point. Those approaches are rather works to protect the access point and the public infrastructure, but for your PC such approaches do nearly nothing. Even under WEP/WPA your computer is easily accessible from other local network participants.
The Solution

All what you need to satisfy the both types of requirements - home and public wireless connection security - is a firewall capable to take into account the both environments and manage them correspondingly and separately.
Windows7FirewallControl Plus has a special mode - Mode: Expensive/Insecure connections. You can configure Windows7FirewallControl for your home local network as usual setting proper security zones for internet active application in the regular manner.

Selected application vitally required for public wireless network operability can be marked as "Allow in "Mode: Expensive/Insecure connections"". No special configuration options are required then. You can operate in your home local [image] network as usual.
All you have to do before entering into a public wireless network is to choose "Mode: Expensive/Insecure connections" in the TrayIcon menu. As the result, all the vitally required and marked as "Allow in "Mode: Expensive/Insecure connections"" applications will operate under selected security zone, but all the other applications will be gently blocked from the Internet and public wireless network access. Returning back to your home network will require only reverting to "Mode:Normal" again.

Another benefit

Practically the same problem arises on expensive connections: mobile, satellite or another expensive media. You need to suppress almost any background internet activity of almost any application excepting several vitally required ones. Actually you would hardly need a heavy windows or antivirus update via expensive connection channel. Such updates can wait for regular home connection.


Zones : Windows 7 Firewall Control

Zone List
(Plus version only)

The Zone List is a list of predefined zones (sets of the network access rules) to apply them for the applications from Programs List. You can add/remove/edit each zone from the list with toolbar, the right mouse click menu or the hotkey.
Zone names must be unique. So if you decided to edit a zone's name, you would actually create a new zone. If you do not need the zone with the previous name, do not forget to delete it. All the zones operations are performed on by-copy basis. So, every time you are applying a zone to an application, you are actually making the copy of the zone's rules. So, the copy of the zone (as a named set of the network access rule) can be then independently modified.
If you have made modifications to a zone from Zones List, all the applications from Programs List, which zone names are matched with the zone you have changed, would be given with the new changed zone (the new network access rule set), giving you the ability to change zones for multiple applications at once. A zone consists of network access rule set. The rule set and other zone parameters can be edited via "Zone Editor".

Zone Editor

The zone is a set of network access rules and options to make the decision of permission or prohibition of the network access. Each time an application accesses to internet, it has the parameters of the connection trying to perform (address and port of the remote computer, used protocol and interaction (in or out) direction). Each time an application accesses the network, the firewall compares the connection parameter with the correspondent zone rules. The firewall looks over all the rules sequentially. When a rule is matched, the firewall uses result of the rule as a final permission for the application's internet access. If no rules are matched the overall zone's result is used as the final verdict for the application's internet access.
Because of the rules flexibility and adjustability, Windows 7 Firewall Control provides you with the zones manipulations at any level of details, from big computer groups to single computers, from unlimited application types to single applications. As the result, network access administration can be performed precisely for each application on your computer.

External/Forwarded Port

There is a possibility to automatically configure incoming external/worldwide access to selected application via Port Forwarding by external network connection (firewall/router) box.
To enable/configure External Port you have to have a separate rule with:
  • TCP or UDP protocol set
  • Incoming direction set
  • Local Port set
  • Rule result set to Enable
External Port value, in that case, means instruction to external firewall/router box to create a port forwarding from worldwide ExternalPort to this computer LocalPort. Windows7FirewallControl will turn the Port Forwarding on for the ExternalPort/chosen protocol to LocalPort of this computer every time the application, which has the corresponding zone applied, is started and switch the Port Forwarding off when the application is terminated.