Share via

Windows Filtering Platform Blocked a Packet

Anonymous
2024-10-29T19:23:32+00:00

I set up a Windows Server 2022 Datacenter Hyper-V machine hosting a few Red Hat VMs. In the Security Logs I'm logging several Event IDs 5157 and 5152 per second showing blocked connections and blocked packets from my VMs. The Windows Filtering Platform is blocking UDP packets sent to the broadcast address for the virtual network hosting the VMs. This traffic is intentional and needs to be allowed. See screenshots below.

Connection Blocked

Packet Blocked

I have Windows Firewall allow rules implemented to allow all Inbound and Outbound UDP to the subnet just to see if it clears up the issue. I also unchecked the WFP from the virtual switch the VMs are connected. I'm not sure what additional steps to take to have the WFP allow this traffic.

Windows Server Networking Software-defined networking

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-10-31T09:14:03+00:00

    Hello,

    When the audit displays the Filter Origin and Interface Index, you can determine the root cause of the network packet drop and on which interface it occurred. You can refer to the following links for troubleshooting:

    Filter origin audit log | Microsoft Learn

    Best Regards

    Zunhui

    0 comments
  2. Anonymous
    2024-11-05T15:52:15+00:00

    The WSH Default filter origin. When I try to create an explicit allow rule for \device\harddiskvolume3\windows\system32\svchost.exe I get a message stating that "Windows services have been restricted with rules that allow expected behavior only."

    0 comments