Using Internet Connection Sharing (ICS) with different Firewalls than default Windows Firewall

Question

Hello,

This is not a question though, just a contribution, I hope it helps those who somehow end up getting frustated because microsoft thinks it knows best on how they should be using windows and the software bundled with it. I just chanced upon it while doing some search. Could not find this solution with Google so putting it here for others benefit.

My OS config is Microsoft Windows 7 Ultimate x64 with ESET Smart Security 4, I also have a small netbook (acer AOD250). my main computer is connected to the internet ( for the time being I'm using a USB wireless dongle, gives me 3.1 mbps which is descent enough for my usage ) and I connect my netbook using Adhoc Wifi to the main computer for internet access and networking to sync files etc. using SyncBackSE (Excellent Software). What I'm writing down is the way I got it working on my setup, yours might be different or require a bit extra tweaking here and there.

before we start, disable the firewall on all your computers and devices you wish to connect through ICS for internet, including the main computer ICS will run on, this is just temporary to get  everything between windows PCs working otherwise Firewall can poke itself in between and hamper setup. Disconnect from the internet before disabling the firewalls. This should be done through the software itself and NOT services control panel.

On the main computer running the ICS, goto Administrative Tools -> Services or Computer Management -> Services, you'll see ICS and Windows Firewall services but they would not be runnning since they both need each other (by default, we'll change that) and would have been disabled when you install third party firewall like ESET etc.

Now on the network adapter connecting your main computer with internet access to the bunch of other computer like netbooks, mobile phones etc. with Wifi or LAN or whatever, you’ll have to put in the IP address 192.168.137.1, unfortunately this is a limitation by ICS and I can’t do anything my side. Now this means basically is that your network must now use 192.168.137.xxx IP address for ICS to work, but not to despair, you can use upto 254 devices on that IP, good for a small network.

Setup the network, on other devices, including computers, netbooks, smartphones etc. configure them each to “acquire a IP address automatically”, since ICS assigns the 192.168.137.xxx addresses to all the devices, this is one reason nothing is lost and no extra hard work is required.

Start the Windows Firewall and then Internet Connection Sharing using services control panel. Next Select the Network adapter on the main computer which is the connection to the internet, right click -> properties -> sharing tab, select “Allow other network users to connect through this computers internet connection”

Click OK, now ICS configures everything including Windows Firewall for internet sharing, Windows Firewall must be running otherwise ICS will quit with an error.

Once this is done, goto services and Shutdown Windows Firewall service, leave ICS service running, herein comes the next step which is risky but needs to be done to make sure everything is okay. Connect your main computer to the internet. Then connect all other computers to the network. You’ll see them acquiring IP address with 192.168.137.xxx from ICS on main computer. Check every computer on the network has internet access. Then disconnect the internet from the main computer.

Now re-enable your third party firewall on main computer connecting to internet, leave the other computers firewall disabled for the time being. Configure your firewall so it doesn’t block internet traffic to your network. This you need to figure out but for me in ESET, I had to make my network with IP 192.168.137.xxx as a trusted zone. Once your third party firewall is configured. You’re all set to go, re-enable and configure one by one your third party firewalls on your other computers on the network. Mobile phones and other devices should connect without any further problems through your main computer.

Main points to remember:

You can anytime disable Internet Connection Sharing by Shutting down the service itself. Also remove the IP 192.168.137.1 from the adapter on the main computer to connect to other networks, just type it back in when starting ICS service. Windows Firewall needs to be started ONLY when you change your Internet Connection adapter that has to be shared otherwise start just the ICS service if that adapter is the same.

So basically when you do this first time, it needs some time and work (i.e. brain), on subsequent requirements for ICS, lets say for Wifi, it's just 2-3 steps in a minute: Set the IP to 192.168.137.1 on the WiFi Adaptor, Start ICS service and connect other devices to your Adhoc WiFi network on main computer with internet connection active. That's it folks ...

Hope this helps ...

Enjoy!

Answer 1

Hi,

I understand your concerns, but for a person who would do such a thing in the first place would know a little bit more than an average home user, secondly the only "Risk" involved in my post above is the ICS service, which again can be disabled anytime as needed. Being an MCP+I, MCSE myself, I can very well understand the risks involved. Also such modifications are at a level where they may be easily track backed to originality.

BTW the link to the other proxy you gave also didn't work in my case. Just to ponder, why would I install third party stuff when such a simple method works beautifully and without any problems. However in my imagination, I can't help but think that ICS with it's fixation with 192.168.137.1 and Windows Firewall now would be slowly evolved as a new feature in future windows with no such limitation.

Regards,

Answer 2

Hi

I fully appreciate your good intentions.

I spent years helping people getting out of "mess" that is created by workaround that might work well on one individual system and gave grief to thousands of users that their system ended up in “LaLa” land because of such implementations.

While "Playing" around with individual application might deem the specific application useless. Playing around with Network Component/Applications has a much wider implications.

The manipulations with the ICS in the manner that you described might eventually Destabilize the Internet/Network connection of many users.

There is also this freeware solution, http://www.analogx.com/contents/download/Network/proxy/Freeware.htm

---

My posts reflect my understanding and experience. It does not necessarily reflect the opinion or view of Microsoft, or anyone else.

---

Jack - Microsoft MVP, Windows Networking. WWW.EZLAN.NET

Answer 3

I like ICS technique much better, connectify gave me troubles and ads when I tried it, anyway my method is ad free :)

Answer 4

Hi

You can try to use this instead of ICS.

http://www.connectify.me/

---

Jack - Microsoft MVP, Windows Networking. WWW.EZLAN.NET