Firewall CSP blocks WNS communication

Question

We deployed a firewall CSP with following config:

• DefaultInboundAction,DefaultOutboundAction Block
• DisableInboundNotifications, DisableOutboundNotifications False

Once applied, device is unable to receive any WNS notification. WNS comm completely stopped. We have to allowlist WpnService in both inbound and outbound rules.

Have several questions:

• OMADMClient and other MDM-related services are by-default allowlisted. (could see them in firewall rules UI), is there any reasons critical service like WNS is not allowlisted by-default?
• In order for WNS to perform properly, is it sufficient to just allowlist WpnService? we noticed there's also a user-lvl WNS service (WpnUserService_randomId)
  • how OMADMClient interacts with WpnService? (interprocess?)
    • WpnUserService unique id changes every time during user signon. does Firewall CSP take wildcard?

Thanks

Answer 1

@Doodoogama, Thanks for posting in Q&A.

For WNS Traffic, you can add the list of approved WNS FQDNs or VIPs to their exemption list to allow the WNS traffic to pass through the firewall. Here is a link with more details:

https://learn.microsoft.com/en-us/windows/apps/design/shell/tiles-and-notifications/firewall-allowlist-config

For the reason why the WNS is not allowed by default, this is not mentioned in official article. You can feedback to windows to see if it can be added into the default allow list in the future.

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.