Windows Firewall
From Wikipedia, the free encyclopedia
Windows Firewall is a personal firewall, included with Microsoft's Windows XP and newer operating systems.
Contents |
[edit] Overview
When Windows XP was originally shipped in October 2001, it included a limited firewall called "Internet Connection Firewall". It was disabled by default due to concerns with backward compatibility, and the configuration screens were buried away in network configuration screens that many users never looked at. As a result, it was rarely used. In mid-2003, the Blaster worm attacked a large number of Windows machines, taking advantage of flaws in the RPC Windows service. Several months later, the Sasser worm did something similar. The ongoing prevalence of these worms through 2004 resulted in unpatched machines being infected within a matter of minutes.[1] Because of these incidents, as well as other criticisms that Microsoft was not being proactive in protecting customers from threats, Microsoft decided to significantly improve both the functionality and the interface of Windows XP's built-in firewall, and rebrand it as, simply, "Windows Firewall".
ICF supports a security log which can record IP addresses and other data relating to connections originating from the home or office network or the Internet. It can record both dropped packets and successful connections. This can be used, for instance, to track every time a computer on the network connects to a website. This security log is not enabled by default; the administrator must enable it. The security log is stored in pfirewall.log. If the maximum allowable size for pfirewall.log is exceeded, the information that pfirewall.log contains is saved as pfirewall.log.old, and new information is saved as pfirewall.log. If the maximum allowable size for pfirewall.log is exceeded again, the information that pfirewall.log contains is saved as pfirewall.log.old, and the information that had been in pfirewall.log.old is overwritten.[2]
[edit] Versions
[edit] Windows XP
Windows Firewall was first introduced as part of Windows XP Service Pack 2. Every type of network connection, whether it is wired, wireless, VPN, or even FireWire, has the firewall enabled by default, with some built-in exceptions to allow connections from machines on the local network. It also fixed a problem whereby the firewall policies would not be enabled on a network connection until several seconds after the connection itself was created, thereby creating a window of vulnerability.[3] A number of additions were made to Group Policy, so that Windows system administrators could configure the Windows Firewall product on a company-wide level. XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.
Windows Firewall turned out to be one of the two most significant reasons (the other being DCOM activation security)[4] that many corporations did not upgrade to Service Pack 2 in a timely fashion. Around the time of SP2's release, a number of Internet sites were reporting significant application compatibility issues, though the majority of those ended up being nothing more than ports that needed to be opened on the firewall so that components of distributed systems (typically backup and antivirus solutions) could communicate.
[edit] Windows Server 2003
In March 2005, Microsoft released Windows Server 2003 Service Pack 1, which incorporated the same improvements to the firewall product into their server operating system.
[edit] Windows Vista
Windows Vista significantly improves the firewall to address a number of concerns around the flexibility of Windows Firewall in a corporate environment:[5]
- IPv6 connection filtering.
- Outbound packet filtering, reflecting increasing concerns about spyware and viruses that attempt to "phone home". (Although outbound rules can only be configured using the management console, see below.)
- With the advanced packet filter, rules can also be specified for source and destination IP addresses and port ranges.
- Rules can be configured for services by its service name chosen by a list, without needing to specify the full path file name.
- IPsec is fully integrated, allowing connections to be allowed or denied based on security certificates, Kerberos authentication, etc. Encryption can also be required for any kind of connection.
- A new management console snap-in named Windows Firewall with Advanced Security which provides access to many advanced options, and enables remote administration. This can be accessed via Start -> Control Panel -> Administrative Tools -> Windows Firewall with Advanced Security, or by running "wf.msc"
- Ability to have separate firewall profiles for when computers are domain-joined or connected to a private or public network. Support for the creation of rules for enforcing server and domain isolation policies.
[edit] See also
- Comparison of firewalls
- Security and safety features new to Windows Vista
- List of Microsoft Windows components
- Personal firewall
- Microsoft Internet Security and Acceleration Server
[edit] External links
- Understanding Windows Firewall
- Customizing Windows Firewall
- Adding Windows Firewall Exceptions
- Working with Windows Firewall API using VC++ (Examples)
[edit] References
[edit] Notes
- ^ These multiple vulnerabilities were fixed by Microsoft over the course of several months; Microsoft security bulletins MS03-026, MS03-039, and MS04-012 cover this in more detail.
