Boot-Time Filter / Leaks when booting Windows.

[Stiff-lab]

App version

3.8.7

Windows version

Win10 22h2 / 19045.6456

Wireshark displays successful TCP connections despite Boot-Time filter.

40.126.53.18 MICROSOFT-CORP-MSN-AS-BLOCK
2.16.63.57 Akamai International B.V.
23.210.252.238 AKAMAI-AS
20.190.147.5 MICROSOFT-CORP-MSN-AS-BLOCK
23.65.29.168 Akamai International B.V.
40.126.53.15 MICROSOFT-CORP-MSN-AS-BLOCK

I have created user rules for the IPs and it appears that no more connections are being established to these IPs during the boot process. But a boot-time filter should actually work in such a way that it blocks all connections.

Greetings from the West.

[henrypp]

you have set InstallBoottimeFilters=FALSE n INI?

[Stiff-lab]

No, I haven't changed anything in the INI. Freshly installed Windows and Simplewall.
After installation, all incoming and outgoing connections as well as the Boot-time filter are enabled by default.

[henrypp]

so unticked boottime filters in rules settings dialog?

[Stiff-lab]

No. The boot time filter was enabled in the settings. First, two IPs leaked, then I blocked them using user rules, then I restarted the PC and Microsoft established the connection with a new IP.

I blocked the new IP address, and the next time I started up, another different IP was used. After I blocked the last IP address, there were no more leaks. I reinstalled Windows and Simplewall again. Without user rules.

Currently, there are no leaks. This is very strange. I will keep an eye on it.

[Stiff-lab]

Man, your boot time filter isn't working properly. First, I found out that after a fresh installation of Windows and Simplewall, the check mark for “Enable boot-time filter (recommended)” is set in the settings, but the line “InstallBoottimeFilters=true” is completely missing in simplewall.ini. You have to uncheck and then recheck the boot time filter, then “InstallBoottimeFilters=true” is written to the INI file.

Furthermore, despite the line “InstallBoottimeFilters=true” in the INI file, it still established connections, the next time it was restarted.

For example:
199.232.42.172
2.16.63.57
20.190.147.2
23.210.252.238
20.190.177.23
40.126.53.10

There is something wrong with your code. In its current state, it is a disaster for privacy. People believe they are protected, but Windows happily calls home when it boots up. Does the boot time filter work with IP lists?
A boot filter must work in such a way that it does not allow any connections until Simplewall itself or WFP has booted up and whitelist has been activated. Regardless of any IP lists.

Sometimes Windows does not establish connections during the boot process. These connections occur particularly frequently when Windows restarts for the first few times after installation.

The fact that I didn't have any leaks after creating the user rules recently was probably just a coincidence.

[Stiff-lab]

Before shutting down, I now always disable the network adapter using the “netsh interface set interface ethernet disable” command as a cmd script to prevent leaks during bootup. I hope this issue will be fixed in the next version.

[henrypp]

“Enable boot-time filter (recommended)” is set in the settings, but the line “InstallBoottimeFilters=true” is completely missing in simplewall.ini.

shit, you do not know what is "defaults"?

[Stiff-lab]

I told you that even with “InstallBoottimeFilters=true” in the INI file, connections to Microsoft are still made during the boot process. Take an original ISO and Wireshark and test it yourself. It doesn't matter what the default setting is. Connections to Microsoft are still being made. Maybe Microsoft has built something in to bypass WPF filtering.

[tnodir]

@Stiff-lab Please also test several other firewalls, that have boot-time filters. Are they working fine for you on startup?