Windows Defender Firewall dropping traffic despite allow rule

Question

Hello,

I created an inbound allow rule for a specific app in Defender Firewall, but I can still see dropped traffic, despite having this rule enabled.
What can I do further to check what is causing the drop? I tested with the firewall disabled and everything works fine, so the issue is related to the firewall.
There's no other rule that can interfere.

Thanks!

Answer 1

Hello Nicusor,

Windows Defender Firewall is only one of several services that use WFP (Windows Filtering Platform) BFE (Base Filtering Engine).

The output of the command netsh wfp show netevents is perhaps the best source of information about why a packet is blocked. If that command produces no output, you might need to enable netevents with the command netsh wfp set options netevents = ON

Gary