Results 1 to 6 of 6

Thread: Windows update passes firewall somehow.

  1. #1
    Join Date
    Jul 2007
    Posts
    23

    Windows update passes firewall somehow.

    I used to have windows autoupdate turend on but blocked with firewall, now i reinstalled windows and loaded my previous settings to firewall, and when i start windows i getting windows update notification of avalaible updates, though when i try to download em it outpost blocks it.
    Question: why it gets trough outpost at startup?
    I remember seeing some option to start outpost before other programs at windows startup, but cant find it now, can it be because its disabled some programs send info to internet before outpost loaded?

    Also i remember clicking Disable policy and then back to Block Most from system tray, can this disable command edit some settings that did not restore when i sellected Block Most?

  2. #2
    Join Date
    Oct 2003
    Location
    Georgia, USA
    Posts
    12,714

    Re: Windows update passes firewall somehow.

    Windows Update is a thorny issue.

    OP, if you are running in the service mode rather then the application, starts before the network drivers so that it will block any traffic. Changing the policy should make little difference as long as it was moved back. It's unlikely that the update service snuck through while you had the firewall disabled. However, the logs can tell you if that happened.

    The problem is likely due to load sharing by Microsoft. The IP addresses for WU does change around a bit. If you have it blocked by IP it's possible that it used another address and some other rule allowed the traffic. You'll have to show us your logs in order to figure that out.

    Still, why fight it? Just turn off WU if you don't want notifications.
    Regards,
    Manny Carvalho
    MS-MVP Windows since 2002

  3. #3
    Join Date
    Jul 2007
    Posts
    23

    Re: Windows update passes firewall somehow.

    Nah i blocked not by IP, but completely blocked all activity except programs i use and enabled svchost.exe only for DHCP (in/out) and UDP out to DNS_Servers macro, and for windows autoupdate you should also enable svchost.exe TCP out to port 80 (which i had not set up at that moment).
    So it should not get to windows update, and it wasnt before i reinstalled windows. I think some settings i had was imported, but some wasnt.
    I dont worry much about windows autoupdate, i worry more about some programs may leak out when i boot my pc, or there is some hole in my settings.
    Okay it saying Service Mode in title, this means outpost starts before network drivers, how i can change mode to application?

  4. #4
    Join Date
    Feb 2003
    Location
    North West, United Kingdom
    Posts
    10,354

    Re: Windows update passes firewall somehow.

    Switching Outpost to start as an application is not recommended for most users since it means Outpost will not protect your system until you login.

    As Manny has stated, your logs should provide details of what was allowed and checking these carefully should reveal how (or if) Windows Update was able to detect new downloads.

    Changing Outpost's background policy (Options/Policy/Advanced/Firewall Policy) from Block Most to Stop All should prevent any network connections until Outpost's GUI has started, but it may cause problems with network connectivity since it will also block DHCP initially.
    Last edited by Paranoid2000; 22 Sep 2007 at 10:35.

  5. #5
    Join Date
    Jul 2007
    Posts
    23

    Re: Windows update passes firewall somehow.

    My logs was deleted, but i think it was global rule i created that enabled DNS when dirrection is OUT and protocol is UDP, i could not make internet work without this rule while using block most policy.

    P.S.
    Entertainment mode = normal mode from Options/General?
    How i change mode from service mode to application?

  6. #6
    Join Date
    Nov 2004
    Location
    Canada
    Posts
    1,396

    Re: Windows update passes firewall somehow.

    Quote Originally Posted by HelloWorld View Post
    and for windows autoupdate you should also enable svchost.exe TCP out to port 80 (which i had not set up at that moment).
    I'm not sure how, exactly, you have this rule set up, but you should restrict svchost to specific MS update server ip addresses. There are several of them so it is a bit of a painstaking process, but it is far better than simply allowing svchost to connect to any remote host on TCP port 80.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. [Outpost Free Firewall] Windows XP firewall won't stay off
    By Amethyst in forum Outpost Free Security Suite/Firewall/Anti-Virus General Discussions, Support, and Troubleshooting
    Replies: 8
    Last Post: 05 Oct 2009, 02:47
  2. windows update and win defender update
    By digit3l in forum Outpost Pro FIREWALL General Discussions, Support, and Troubleshooting
    Replies: 5
    Last Post: 14 Apr 2006, 18:24
  3. PC Audit Leaks - that passes the firewall :(
    By Advent in forum Outpost Pro FIREWALL General Discussions, Support, and Troubleshooting
    Replies: 4
    Last Post: 26 Jan 2004, 15:32
  4. tools passes through outpost
    By nfs_champ in forum Retired Threads
    Replies: 2
    Last Post: 11 Feb 2002, 16:43

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •