Vista's Firewall

Restrict by application. To illustrate how flexible and granular a Windows Firewall rule can be, let's look at the rule for the Background Intelligent Transfer Service (BITS)—a service used to download updates from remote computers. This rule lets you lock down only the BITS service by specifying the parent application and the network port as follows. In the Windows Firewall with Advanced Security snap-in, click Inbound

Exceptions in the left-hand pane and double-click the BITS Service rule in the middle pane to bring up the rule's properties. On the General tab, you can name the rule, enable it, and specify whether all programs or only specific programs should use it. As Figure 2 shows, I've specified that only svchost.exe (the executable wrapper that services run under) can use the rule. When I click OK, all other programs are immediately restricted from using the rule. The Actions section lets me allow or block all connections or select Allow only secure connections. Secure connections rely on IPsec to configure the encryption and integrity of the network communication and let you specify a user or computer to authenticate the connection.

Restrict by protocol and port. The first version of Windows Firewall let you configure the remote port of only two protocols: TCP and UDP. For example, if you wanted to permit inbound HTTP connections, you'd specify the protocol and port number (e.g., TCP 80) for the connections. Vista's firewall lets you specify more than 20 predefined protocols or define your own and also lets you specify the local port as well as the remote port. You can also associate multiple ports with a single rule. For example, to cover both encrypted and unencrypted Web traffic, you could define a rule called Web Traffic to allow TCP over ports 80 and 443. On the Protocols and Ports tab for the BITS Service rule, Microsoft defines BITS traffic as TCP over local port 2126. You can also specify predefined Internet Control Message Protocol (ICMP) settings, such as echo request and router reply, or a custom ICMP type and code.

Restrict by network address. The Scope tab lets you define the local and remote network-addresses that the rule will apply to. You can specify an IP address or subnet (e.g., 10.0.0.10, 192.168.0.0/24) or an address range (e.g., 192.168.0.0 to 192.168.0.10). For the remote address, you can select a predefined address, such as the default gateway or DHCP servers, as Figure 3 shows. Predefined addresses make it easy to reconfigure rules when your environment changes. For example, you can let file transfer protocols access only computers on your local subnet. Dynamic rules let you restrict traffic without configuring individual rules for every network.

Restrict by interface type. The Advanced tab lets you apply an exception to a specific interface type: Local Area Network, Remote Access, or Wireless. When a user who's connected to your company network also needs to connect to a remote network and you don't want to risk the remote network accessing data on your local network, you can configure an exception to block all inbound connections and apply it to the remote access interface. Users can still accept new connections from the LAN, but not from a remote network.

Restrict by service. You'll recall that the preconfigured BITS Service rule allows inbound connections on TCP port 2126 by the svchost.exe program. Microsoft further restricts the communication to only the BITS Service under the Services dialog box. You can configure which services apply to a rule by clicking the Advanced tab in the BITS Service Properties dialog box, then clicking Settings, which is next to the Services section. In many cases you'll just want to restrict traffic to a protocol and port, but in other cases you can be much more granular by specifying the service whose network communication you want to permit or block.

Outbound Connections
The Vista firewall lets you configure outbound connections in much the same way you do inbound connections. The ability to recognize and filter outbound connections is one of the firewall's best features because it lets you exercise granular control over how a computer is using the network. Outbound exceptions let you permit Microsoft Internet Explorer (IE), Outlook, and other known network programs to access the network but disallow all other outbound traffic.

For example, if your company requires use of an authenticated proxy server that uses TCP port 8080 by default, you could log and block all outbound TCP port 80 (standard HTTP) traffic to prevent rogue programs from bypassing the proxy server in an attempt to communicate with an external Web server. Users often unknowingly install spyware or unapproved software that accesses the Web, and you can create an exception that blocks them from doing so at the host.

Unlike some third-party host-based firewalls, the beta version of Vista's firewall doesn't alert you when it blocks an outbound connection. However, if you configure firewall logging, you can view blocked connections in the log file.

Couple outbound connection filtering with Windows Firewall's remote connection features, and you can remotely lock down a suspicious computer, such as one that you suspect might be infected with a virus or worm. The only options you had with earlier versions of Windows Firewall were to either unplug the computer or disable the network interface. Vista's firewall lets you remotely connect to the suspect computer using MMC, enable outbound blocking, and turn on logging while permitting only specified computers to have port access. This approach lets you contain the threat and still be able to remotely manage the computer.