*nix-like firewall for Win10?

Rainmaker · 10 Nov 2019 at 21:59

I have a Windows 10 Pro install that I spin up as needed, which isn't often tbf. One thing that's really holding me back is the lack of a decent easy to use firewall as you'd find in Linux, BSD or similar. More specifically, since I have a WireGuard VPN with a public IP and all ports open, I want to set up policies/rules per interface - or at a push by CIDR/network. For example on Linux it's as simple as:

Shorewall:

Code:

ACCEPT net vpn 6789

UFW:

Code:

ufw allow from any to $(vpn_ip) port 6789

Berkley pf:

Code:

pass in log on $vpn inet proto tcp from any to ($vpn_ip) port 6789 keep state

Each of the rules does the same thing - the firewalls have default-deny and block everything inbound, but are now set to pass traffic on one port, on the WireGuard interface only. The same port remains closed to my usual ISP WAN. A single line of code/text in each case, simply picking the preferred engine based on current OS/circumstances.

On Windows though, it's much more convoluted and overly simplistic (Public or Private). While I've not delved into Powershell for Windows Firewall, from what I've read so far it's not really possible in the way I want - at least not without cobbling things in ways that weren't intended.

Can anyone recommend from experience a decent firewall for Windows that allows such functionality and isn't a mess? I tried Comodo Firewall but it's convoluted and buggy. Eset's firewall was a buggy ****show to the point where, once set up, it didn't work as stated and allowed through connections from WAN silently. The devs acknowledged the design flaw (it was intentional!) but gave me a load of sarky abuse and froze me out of the forums once I documented and published it.

Any others that actually work, are flexible and customisable and easy to use? I can issue one line on *nix and it's sorted - on Windows? I've only been looking for three days!...

darael · 10 Nov 2019 at 23:29

I like Windows Firewall Control.

Rainmaker · 10 Nov 2019 at 23:40

darael said:
I like Windows Firewall Control.

Yes I bought a licence for that (before MBAM bought it and made it free-for-now). AFAIK it doesn't allow the kind of granular per-interface/network settings I need though?

darael · 11 Nov 2019 at 00:01

Rainmaker said:
Yes I bought a licence for that (before MBAM bought it and made it free-for-now). AFAIK it doesn't allow the kind of granular per-interface/network settings I need though?

I see, I'm not sure if has such fine control or not.

I use ESET Internet Security firewall set to interactive. There are a lot of preset rules out of the box, was it these you had an issue with?

Rainmaker · 11 Nov 2019 at 01:20

darael said:
I see, I'm not sure if has such fine control or not.

I use ESET Internet Security firewall set to interactive. There are a lot of preset rules out of the box, was it these you had an issue with?

No, it was the firewall engine itself. On macOS it doesn't see - or manage - utun network interfaces. However, you can set up a whole list of rules in policy mode (eg default deny / block all from/to 10.0.0.0/8) and it will report the rule is active... but actually behind the scenes it silently allows all traffic to and from that network, if it's on a virtual interface. As you can imagine, a "firewall" reporting that it's enabled but actually allowing all traffic is not a firewall at all - it's not even a chocolate fireguard. It's inherently dangerous.

The devs took a while and then said 'meh, we designed it like that and just didn't mention it'.

On the Windows side it has broken rule setting and logging - again the response was 'We know but what can you do?'... LOL Hard nope from me.