Home / server / Questions / 1168995
Accepted
Illishar
Asked: 2024-12-17 22:57:49 +0800 CST

How to enable DNS name feature in whitelist-only Windows firewall?

  • 772

I'm building a whitelist-only Windows firewall setup.

I have Windows 10 on VMWare Workstation Pro 17, to experiment.

I've disabled all:

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

netsh advfirewall firewall set rule all new enable=no

And enabled some:

netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv4-In)" new enable=yes
netsh advfirewall firewall set rule name="Remote Desktop - User Mode (TCP-In)" new enable=yes
netsh advfirewall firewall set rule name="Core Networking - DNS (UDP-Out)" new enable=yes
netsh advfirewall firewall set rule name="Core Networking - Dynamic Host Configuration Protocol (DHCP-Out)" new enable=yes
netsh advfirewall firewall set rule name="File and Printer Sharing (SMB-Out)" new enable=yes

I can't get DNS to work. With a standard firewall, I can ping my host by name or IP. When I restrict the firewall, I can only use IP.

One would think that it was just a matter of enabling one of the existing rules. It's easy to and enable all existing rules. This won't make a difference though. (And there's a lot of DNS, SMB, NB etc. sounding rules.)

Do anyone know what should I enable or add in the firewall, if I want to ping my Windows host like so:

ping my-VMware-host
domain-name-system

1 Answers

  1. Best Answer

    These days, TCP 53 is also recommended for DNS. It's the fallback if there's some issue with the UDP packet transmission and is used for some kinds of queries. I believe MSFT is moving to TCP as the default protocol for DNS queries (with UDP still available), but I don't know if that's actually the case yet or which OS versions may be affected.

    Blocking all outbound is quite unusual. I'd suggest enabling all rules in the Core Networking group both inbound and outbound that apply to All/Any profiles (i.e. not including the Core Networking rules for the "Domain" profile, if your machine isn't domain-joined).

    Those rules aren't for application/service access, but more for traffic status and such. You can identify them with the following Powershell:

    # To view
Get-Netfirewallrule -DisplayGroup "Core Networking" | where {$_.profile -eq "Any" -and $_.enabled -eq $false}
# To enable all in "Core Networking"
Get-Netfirewallrule -DisplayGroup "Core Networking" | where {$_.profile -eq "Any" -and $_.enabled -eq $false} | Enable-NetFirewallRule

    If enabling TCP 53 doesn't solve the DNS issue, I definitely recommend enabling the above and see if that helps. If it does help, it should be easy enough to prune unwanted rules from there.

    Also, if you don't want to bother troubleshooting with a packet capture tool, you could enable the "Dropped Packets" text log - default location for the log is %systemroot%\system32\LogFiles\Firewall\pfirewall.log. Instructions to enable it (including with netsh advfirewall commands) are on the Microsoft site.

    • 1