Relution Signet Customer Hub

Windows Firewall

The Windows Firewall policy configuration manages the Windows firewall on managed devices. It consists of three parts: global properties, settings per network profile and individual firewall rules.

Global properties

The global properties apply across profiles to the entire device and are located in the General section. They are unlocked with the Configure global settings toggle; without it, the following fields cannot be edited and are not transferred. If the toggle is disabled, the previously transferred global properties are removed from the device again.

  • Block stateful File Transfer Protocol (FTP)
  • Security association idle time before deletion: number of seconds without network traffic after which a security association is deleted (300–3600).
  • Pre-shared key encoding
  • IPsec exemptions (selection):
    • None
    • Neighbor discover IPv6 ICMP type-codes
    • ICMP
    • Router discover IPv6 ICMP type-codes
    • Both IPv4 and IPv6 DHCP traffic
  • Certificate revocation list (CRL) verification (required, default: Disabled):
    • Disabled
    • Fail CRL verification on revoked certificate only
    • Fail CRL verification on any error encountered
  • Opportunistically match authentication set per keying module
  • Enable packet queuing (default: Disabled):
    • Disabled
    • Queue inbound encrypted packets only
    • Queue packets after decryption is performed for forwarding only

Profile properties

Each network profile – Domain (workplace) network, Public (non-discoverable) network and Private (discoverable) network – has its own section with the Configure profile properties toggle. Only when it is enabled can the following settings be edited, and only then are they transferred to the device. If it is disabled, the previously transferred settings of the profile are removed from the device again.

  • Enable firewall
    • Shielded: only selectable if Enable firewall is set; together with the firewall, it blocks all incoming traffic.
  • Allow default action for inbound connections (default: enabled)
  • Allow default action for outbound connections (default: enabled)
  • Disable inbound notifications
  • Disable stealth mode
    • IPsec secured packet exemption with Stealth Mode: only selectable if Disable stealth mode is set.
  • Disable unicast responses to multicast broadcasts
  • Authorized application firewall rules from the local store (default: enabled)
  • Global port firewall rules from the local store (default: enabled)
  • Allow firewall rules from the local store (default: enabled)
  • IPsec rules from the local store (default: enabled)

If the default actions for inbound or outbound connections are not allowed, a firewall rule is required that permits the connections with Relution. Otherwise, Relution can no longer manage the device.

Firewall rules

The firewall rules are shown in a list with the columns Rule name, Rule description, Traffic direction and Rule enabled. Rules are created, changed or removed via Add, Edit and Delete. A maximum of 100 firewall rules is possible per configuration.

Application, ports and network types can be defined per rule:

  • Rule name (required)
  • Rule description
  • Rule enabled (default: enabled)
  • Allow connection for this rule (default: enabled): specifies whether the rule allows or blocks the network traffic.
  • Edge Traversal setting enabled (default: disabled)
  • Traffic direction: Incoming or Outgoing (default)
  • Network types (required, multiple selection):
    • All existing network sets and any future network sets (default; excludes the other options)
    • Domain
    • Private
    • Public
  • Package family name, Full file path and Windows service (Application section)
  • Local address range and Remote address range (IP Address section): IPv4 or IPv6 addresses, as a single address or as a range with Lower range limit and Upper range limit
  • IP Protocol: number from 0 to 255, with a list of suggestions (e.g. 6 - TCP, 17 - UDP)
  • Local port range and Remote port range: ports from 1 to 65535, as a single port or as a range
  • Interface types (multiple selection, default: all): Local Area Network, Wireless, Remote Access
  • Local user authorization list: authorized local users in SDDL format; if not specified, the rule applies to all users. No list is possible for rules that target a Windows service.

A maximum of 20 entries is possible per range list (Local port range, Remote port range, Local address range, Remote address range); ranges within a list must not overlap. Port ranges are only available if 6 - TCP or 17 - UDP is selected as IP Protocol.

  • VPN → — VPN profiles for Windows devices.
  • Custom CSP → — settings that have no dedicated configuration.