Why does Windows Firewall let inbound traffic from an IP get thjrough to MalwareBytes?

Question

Hello,

I am trying to block all incoming network traffic from an IP address.

I’m running on Windows 10 Professional (version: 20H2) and MalwareBytes 4.3.0.98).

My concern is that after defining an Inbound Rule on Windows Firewall, traffic is getting through to MalwareBytes. How can this be? Why doesn’t the firewall block the traffic? Here is a screen capture that shows the problem:

Here is what I have done to define the Inbound Rules. Below are the screens that defined the rule:

1. The rule type is custom:

2. Program:

3. Protocol and Ports:
4. Scope
   5. Action:
   
   6. Profile:
   
   7. Name:

And my Inbound rule is now defined.

Any suggestions will be greatly appreciated.

Charles

Answer 1

Hi,

Thanks for posting in Q&A platform.

I have tested in my lab, and found that the method you provided worked well in my lab. I added a new rule in Inbound rules to block the traffic from specific IP. And then I initiated ping and access to the shared folder on local machine from the remote machine with the specific IP, all these actions were failed which means the rule in Inbound rules in Windows firewall was taken effect.

Based on my knowledge, the traffic can be detected is a normal behavior. The traffic from the specific IP can send to our local machine and our machine can receive this traffic, but since we have enabled inbound rule in windows firewall to block traffic from this IP, this traffic will be dropped by the rule in firewall.

If we need the specific IP cannot sent the traffic to our local machine, I would suggest you located to the device with the specific IP and block the outgoing traffic from its side.

Best Regards,
Sunny

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello, we are expericiencing the same issue.

On Sunny Qi response, the question is not wether Windows Firewall manages to block the incoming connections, but why, in the first place, Malwarebytes continues to see them coming thru. This could only means that Malwarebytes is sitting before Windows Firewall, which is not what I would expect!

Answer 3

Same problem for me.

Is possible to put Malwerbytes behind the Windows Firewall in packet analysys flow ?

Thanks