4 ms·

I don't believe it's possible to firewall Microsoft products in the general case of a power user that has access to an edge router. You'd have to do something

I don't believe it's possible to firewall Microsoft products in the general case of a power user that has access to an edge router. You'd have to do something insane like IP whitelisting only for services you care about, hope that none of them use MS services like Azure, disable Windows Update entirely, etc. It might be possible in the abstract sense of "right now nothing is getting out" but they have root on your box, it's closed source proprietary software, and you've basically broken the OS with this firewalling anyway. You need to be able to trust them.

bilbo0s 8y ago
This. The fact that you're running Windows means you are potentially already compromised.
lwkl 8y ago
You can Firewall Windows services. There is a inbuilt firewall and there may be default rules but you can customize it the way you want. It would be a pretty big security flaw if they let their services bypass the firewall. They may be profit oriented but not stupid.
- vetinari 8y ago
  To use Windows Firewall, you would have to know what to black- or whitelist. Even most powerusers do not know that, and it could change with every update anyway. Therefore, Glasswire/Little Snitch-type firewalls are being used, where you get an alert during connect() time, and you can create the rule on the spot. Windows Firewall cannot do that, and neither can UIs built on top of it, like TinyWall.
- pritambaral 8y ago
  Windows update has, in the past, bypassed the user's firewall rules to download updates.
- laumars 8y ago
  As discussed in the other thread, Windows firewall is garbage for this particular type of problem: 1/ it's not novice friendly (your best suggestion thus far required users to input dozens off lines of code into cmd.exe) 2/ it's defaults still allow Windows telemetry to get through (which was the exact thing the GP was trying to protect against) 3/ it's a pain in the arse to keep updated compared to any of the other suggestions made in this thread. If the only option was Windows firewall or nothing, then I'd suggest people go with a PiHole since it takes an equal amount of technical know how to get the initial set up done. But at least once PiHole is set up, it's self managing (unlike Windows firewall) and will have much saner defaults too. Thankfully though, there are other software firewalls for Windows that address the limitations I've described above. I've named one, another poster has listed a few others. If the option is software firewall or nothing, then I'd strongly recommend that user go with a third party one instead of relying solely on Windows firewall.

bilbo0s 8y ago

This. The fact that you're running Windows means you are potentially already compromised.

lwkl 8y ago

You can Firewall Windows services. There is a inbuilt firewall and there may be default rules but you can customize it the way you want. It would be a pretty big security flaw if they let their services bypass the firewall. They may be profit oriented but not stupid.

vetinari 8y ago
To use Windows Firewall, you would have to know what to black- or whitelist. Even most powerusers do not know that, and it could change with every update anyway. Therefore, Glasswire/Little Snitch-type firewalls are being used, where you get an alert during connect() time, and you can create the rule on the spot. Windows Firewall cannot do that, and neither can UIs built on top of it, like TinyWall.
pritambaral 8y ago
Windows update has, in the past, bypassed the user's firewall rules to download updates.
laumars 8y ago
As discussed in the other thread, Windows firewall is garbage for this particular type of problem: 1/ it's not novice friendly (your best suggestion thus far required users to input dozens off lines of code into cmd.exe) 2/ it's defaults still allow Windows telemetry to get through (which was the exact thing the GP was trying to protect against) 3/ it's a pain in the arse to keep updated compared to any of the other suggestions made in this thread. If the only option was Windows firewall or nothing, then I'd suggest people go with a PiHole since it takes an equal amount of technical know how to get the initial set up done. But at least once PiHole is set up, it's self managing (unlike Windows firewall) and will have much saner defaults too. Thankfully though, there are other software firewalls for Windows that address the limitations I've described above. I've named one, another poster has listed a few others. If the option is software firewall or nothing, then I'd strongly recommend that user go with a third party one instead of relying solely on Windows firewall.