即使在重置防火墙规则后端口仍保持打开状态

Question

Recently we replaced the.netsh advfirewall to powershell commands but we have observed an issue which doesn't appear always but after opening a firewall rule to another machine and then closing,it doesn't really close the port being used by the program rule.There are two issues after replacing with powershell commands that I have noticed:

Issue 1: When opening the firewall(program rule) rule,I am opening it for the group policy as well as the local firewall.The UI for wf.msc shows two rules(one configured for the local and another for group policy) but the UI shows only the one configured locally is updated.When I checked the Firewall for the group policy,over there it shows the updated rule.Why is the UI for wf.msc not being updated?

Issue 2: After closing the firewall rule,on running a scan to check for open ports,the rule for which the port was open previously,still gets listed as open even after closing the firewall rule. I have checked the registry for firewall,even there it shows the rule as being closed.Is there something I'm missing?

Answer 1

The Windows firewall only blocks creating new sockets. Any existing connection won't be touched and there is no easy way to force an application to close an open connection (Linux have a way of spoffing TCP close connections).

After configuring the firewall, you must restart the "offending" service or program to end the connection (or disable/enable the.network card).

That's why it's important for any firewall to be the first one up on the.network after a reboot (and correctly configured from start).