Impossible to stop traffic

[CBGTI]

Even If I enable "Stop traffic" and "Stop internet traffic", I always can go to the web with Firefox or Chrome.
I'm under Fort 3.5.6 and Windows 11 Pro

[tnodir]

What are your options for 1. & 2. in the following screenshot?

(I guess, you've installed as portable, but didn't install the driver.)

[CBGTI]

I have the same setup.

[tnodir]

Do you use some VPN or Proxy?
If yes, then try to turn on the "Filter Local Addresses" flag and remove the "127.0.0.0/8" line from IPv4 Addresses: Internet Adresses: Exclude.

(Now my guess is based on filtering-steps).

[tnodir]

Also do you use an IPv6 protocol?

[CBGTI]

No proxy and no VPN.
I don't know if it's important, but I use the DNS of Google (ivp4 and ivp6).

[CBGTI]

How to be sure that my connection really use ivp4 or ivp6 protocol ?

[tnodir]

How to be sure that my connection really use ivp4 or ivp6 protocol ?

You can use Process Hacker 3's Firewall tab to monitor WFP events: look at "Action"="ALLOW" event for a program and check its "Protocol" column. Also it'll show which provider allowed it by "Rule" column.

[CBGTI]

I have TCP and UDP for ALLOW lines.
I also have lots of red lines (DROP) with, sometimes ICMPV6 protocol.
But I don't know wht it can be! :-)

[tnodir]

As you can see from 1-st screenshot, Chrome and Firefox are connected to IPv6 Remote Addresses.
For ex., Chrome connected to "2a01:e0a:...".

[CBGTI]

Right. Is it a problem?
And I can't block program with IPv6 protocol ?

[tnodir]

Yes, that's a problem until I add IPv6 addresses handling.
Sorry.

[tnodir]

Depends on #24

[CBGTI]

Ok... Thanks for your hard work and explanation. ;-)

[tnodir]

@CBGTI Please check the new v3.5.7.

IPv6 support was added in v3.5.7 for filtering only.
Speed limiting is not supported.

[CBGTI]

I don't have any other Firewall than yours.
Do you think that it's a problem/hole in the security of my computer?

For the graph, It don't work.

[tnodir]

Very strange. There are some FortFilterConnect6 rules for local addresses, but no FortFilterConnect4 rules.

Which Windows version? 32- or 64-bit? Maybe ARM?

There is a Bandwidth indicator near of tray.
Which program is it?

What other programs do you have running?

(I've to reproduce this bug in VM.)

[tnodir]

Also what does the Statistics: Blocked Connections window contain?

Make sure that Options: Statistics: "Collect blocked connections" option is turned on.

[tnodir]

There is a Bandwidth indicator near of tray.
Which program is it?

Ok, I've found the TrafficMonitor.
It does not affect Fort's filtering.

[tnodir]

Also please check the Logs folder for errors.

[tnodir]

@CBGTI Please try the new v3.5.8 and check the Event Viewer: Windows Logs: System for events from Source="fortfw".

[CBGTI]

Hi.
I instelled the v3.5.8.
I checked the Event Viewer.
Is it enough or do you need another view?

[tnodir]

Hi, thanks for checking it.
There should be Error event (not Information) with "fortfw" source.

Also please check the C:\ProgramData\Fort Firewall\logs folder for log files.

[CBGTI]

I don't have any error with "Fortfw" in the Win11 Events Viewer.

But I have somethting in the Logs of Fort :

"2022-06-07 11:39:47.725 I Fort Firewall v3.5.8
2022-06-07 11:39:47.725 W rpc: "Configuration Error" : "Bad Exclude IP address: Error at line 1: Bad mask"

I have this line in all the logs stored in this folder (3.5.6 and over)

[tnodir]

"2022-06-07 11:39:47.725 I Fort Firewall v3.5.8
2022-06-07 11:39:47.725 W rpc: "Configuration Error" : "Bad Exclude IP address: Error at line 1: Bad mask"

I have this line in all the logs stored in this folder (3.5.6 and over)

Ok, we found it finally!
But it's still strange error. Maybe it's due OS Locale (French).
I've to try to change system language to French...

[CBGTI]

If I can help. ;-)
Do you think that Fort is filtering something on my computer actually ?

I already posted these screenhoots, but just to be sure : no link with my settings ?

[tnodir]

Do you think that Fort is filtering something on my computer actually ?

No, it's not filtering.
Because it can't build settings for driver: failing on IPv4 address "0.0.0.0/32" parsing.

I've added French language pack to Windows 11 and changed everything to French, but still can't reproduce the bug...

[tnodir]

@CBGTI I've improved error messages for IP address parsing.
Please try the new v3.5.9-test01 and show Logs for it.
Thanks.

[CBGTI]

I just installed it (v3.5.9 Test) and restarted my computer.

Here is my last log :
2022-06-07 20:22:50.371 I Fort Firewall v3.5.9
2022-06-07 20:22:50.371 W rpc: "Configuration Error" : "Bad Exclude IP address: Error at line 1: Bad mask. Details: [IPv4 mask='443' nbits='443' line='40.90.9.180/443']"

[tnodir]

Can you please show the Options: IP Addresses: Allowed Internet Addresses: Exclude?

It contains 40.90.9.180/443 as shown from logs.
It's an incorrect address definition, why did you enter it?

Maybe you wanted to enter port number 443 for HTTPS as 40.90.9.180:443, but it doesn't work this way.
The Options: IP Addresses should contain only addresses with network masks, not ports.

[CBGTI]

I'm not sure that I entered this one.
All the adresses I entered was to solve conncetion problem with Forza Horizon 5 servers.
It's the official game downloaded from the Microsoft Store.

I (probably) just enter these adresses :
169.254.0.0/16

172.16.0.0/12

192.168.0.0/16

239.255.255.250/32

255.255.255.255/32

I don't know what is the difference between ":" and "/".
I just wanted to bypass Fort Firewall for these some adresses and/or programs.

[tnodir]

Please remove these 4 incorrect addresses from Allowed Internet Addresses: Exclude.

[CBGTI]

Another thing : It could be a problem if Fort isn't installed in the default Folder?
It's on my 2nd HDD (like all my program and games).

[tnodir]

No, it's not a problem.

Just remove those 4 incorrect addresses from Allowed Internet Addresses: Exclude.

[CBGTI]

It's done.

[tnodir]

Ok, thank you for finding the bug.

I've to fix the Options' saving in error state in Service mode.

[CBGTI]

Thanks for your hard work !

[CBGTI]

Is it any way to know why I have now a symbol in front of my Fort icon near the clock?

Is it any link with my log ? -->
"2022-06-07 20:22:50.371 I Fort Firewall v3.5.9
2022-06-07 20:22:50.371 W rpc: "Configuration Error" : "Bad Exclude IP address: Error at line 1: Bad mask. Details: [IPv4 mask='443' nbits='443' line='40.90.9.180/443']"
2022-06-08 14:24:59.573 W util.net.netDownloader: NetDownloader: Error: QNetworkReply::HostNotFoundError "Host api.github.com not found"
2022-06-08 14:24:59.573 W QNetworkReplyImplPrivate::error: Internal problem, this method must only be called once."

[tnodir]

Is it any way to know why I have now a symbol in front of my Fort icon near the clock?

It's an Alert symbol.
You can open the Programs window to see new programs in Alert state.

[CBGTI]

Oups... I forget this information ! :-/

[CBGTI]

Just to confirm : All is working now for me.
I can (really) block web traffic for each program I want.

Thanks for the fix ! Good job!

[tnodir]

I'm glad it works for you.