If your application or service listens for unsolicited incoming traffic—for example, it is a server, a listener, or a peer—then the default configuration of Windows Firewall is to drop the unsolicited incoming traffic for your application or service unless there is an exception that is configured and enabled. Exceptions for applications that listen for traffic on your computer are configured in the following ways:
By enabling one of the exceptions from the Exceptions tab of the Windows Firewall component of Control Panel. Built-in exceptions include File and Printer Sharing, Remote Assistance, Remote Desktop, and UPnP Framework.
When the application is run, it uses Windows Firewall application programming interface (API) function calls to request that exceptions be created. If a local administrator runs the application, the exceptions are configured and enabled.
When an application that does not use the Windows Firewall API runs and attempts to listen on TCP or UDP ports, Windows Firewall prompts a local administrator with a Windows Security Alert dialog box, from which they can specify to add to the list of exceptions on the Exceptions tab of the Windows Firewall component of Control Panel but block the traffic for all users (the Keep Blocking option), to add to the exceptions list and allow the traffic for all users (the Unblock option), or to block the traffic for now and prompt again the next time the application is run (the Ask Me Later option).
To determine the path of the application from the Windows Security Alert dialog box, place the mouse pointer over the name or description of the application. The displayed tool tip text indicates the path to the application.
If the user is not a local administrator, the Windows Security Alert dialog box informs that the traffic is being blocked, and to contact their network administrator for more information.
A local administrator manually configures an exception from the Exceptions tab of the Windows Firewall component of Control Panel.
Services do not prompt the user with a Windows Security Alert dialog box. Therefore, you should configure manual exceptions for them.
Manually configured exceptions can either be based on program names, in which all of the ports needed by the application or service are automatically opened and closed by Windows Firewall as needed, or based on TCP and UDP ports, in which the specified ports are opened, regardless of whether the program using the ports is running or not. The recommended method for security and ease of configuration is to configure program-based exceptions, rather than port-based exceptions.
To manually configure a program-based exception, do the following:
From the Windows XP desktop, click Start, click Control Panel, click Security Center, and then click Windows Firewall.
Click the Exceptions tab.
Click Add Program and specify the program (the application or service) from the list or using the Browse button and, if needed, its scope. For information about specifying the scope, see Manually Configuring Windows Firewall in Windows XP Service Pack 2.
Click OK to save changes to the exception.
To manually configure a port-based exception, do the following:
From the Windows XP desktop, click Start, click Control Panel, click Security Center, and then click Windows Firewall.
Click the Exceptions tab.
Click Add Port and specify the TCP or UDP port name and number and, if needed, its scope.
Click OK to save changes to the exception.
Note You cannot configure an exception based on an IP protocol.
To determine the set of TCP or UDP ports to configure as exceptions, see the program's user guide or Web site for information about how to configure firewalls to allow the program's traffic. If you cannot determine the traffic for your program or the program still does not work after configuring the exception, see the "General Methodology for Determining and Configuring Exceptions" section in this article.
TCP and UDP-based exceptions only work for programs that use static ports. With static ports, the program uses a specific set of ports and those ports do not change. However, some programs use dynamic ports, which change each time the program runs or while it is running. A program that needs to listen on dynamic ports must be configured as a Windows Firewall program-based exception, rather than a TCP or UDP-based exception.
|
