Windows Event ID 5152 – Windows Filtering Platform: Network Packet Blocked by Firewall

Start by examining the specific details of Event ID 5152 to understand what traffic was blocked:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5152 using the Filter Current Log option
4. Double-click a recent 5152 event to view details
5. Note the following key fields:
   • Process ID and Application path
   • Source Address and Source Port
   • Destination Address and Destination Port
   • Protocol (TCP/UDP)
   • Filter Run-Time ID

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5152} -MaxEvents 50 | Select-Object TimeCreated, @{Name='Application';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Application*'}).Split(':')[1].Trim()}}, @{Name='SourceIP';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Source Address*'}).Split(':')[1].Trim()}}

Identify which firewall rule is blocking the traffic by examining Windows Defender Firewall configuration:

1. Open Windows Defender Firewall with Advanced Security from Administrative Tools
2. Check both Inbound Rules and Outbound Rules for blocking rules
3. Look for rules with Action: Block that match the application or port from the 5152 event
4. Use PowerShell to list all blocking rules:

Get-NetFirewallRule | Where-Object {$_.Action -eq 'Block' -and $_.Enabled -eq 'True'} | Select-Object DisplayName, Direction, Action, Program | Format-Table -AutoSize

To find rules affecting a specific application:

$AppPath = 'C:\Program Files\YourApp\app.exe'
Get-NetFirewallRule | Where-Object {$_.Program -eq $AppPath} | Get-NetFirewallPortFilter

Determine if the blocked traffic represents legitimate application communication:

1. Identify the application from the 5152 event details
2. Check the application's documentation for required network ports and protocols
3. Use Resource Monitor to observe the application's network activity:
   • Press Win + R, type resmon.exe
   • Go to the Network tab
   • Monitor the application's connection attempts
4. Verify the destination IP addresses and ports against known services
5. Use netstat to check active connections:

netstat -ano | findstr :443
Get-Process -Id [PID_FROM_NETSTAT]

For deeper analysis, use Process Monitor to track file and network access:

# Download and run Process Monitor (ProcMon) from Microsoft Sysinternals
# Filter by Process Name matching the blocked application
# Look for network-related operations that fail

Create appropriate firewall rules to allow legitimate traffic while maintaining security:

1. Create a new inbound or outbound rule in Windows Defender Firewall with Advanced Security
2. Specify the application path, ports, and protocols identified in previous steps
3. Use PowerShell to create firewall rules programmatically:

# Create outbound rule for specific application
New-NetFirewallRule -DisplayName 'Allow MyApp Outbound' -Direction Outbound -Program 'C:\Program Files\MyApp\myapp.exe' -Action Allow -Protocol TCP -RemotePort 443

# Create inbound rule for specific port
New-NetFirewallRule -DisplayName 'Allow Inbound Port 8080' -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow

Enable connection security auditing to monitor the new rule:

# Enable object access auditing
auditpol /set /subcategory:'Filtering Platform Connection' /success:enable /failure:enable

# Verify auditing is enabled
auditpol /get /subcategory:'Filtering Platform Connection'

Monitor the effectiveness of new rules by checking for Event ID 5156 (allowed connections):

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} -MaxEvents 20 | Where-Object {$_.Message -like '*MyApp*'}

Perform deep analysis of Windows Filtering Platform behavior for complex scenarios:

1. Use WFP diagnostic tools to trace packet filtering decisions:

# Start WFP trace (requires elevated privileges)
netsh wfp capture start
# Reproduce the blocked connection
netsh wfp capture stop
# Analyze the capture file with netsh or WPA

2. Examine WFP filters and callouts using netsh commands:

# List all WFP filters
netsh wfp show filters

# Show specific filter by ID (from 5152 event)
netsh wfp show filters filterid=[FILTER_ID]

# Display WFP state information
netsh wfp show state

3. Check for conflicting security software or Group Policy settings:

# Review Group Policy firewall settings
Get-ItemProperty -Path 'HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\*' -Recurse

# Check for third-party firewall services
Get-Service | Where-Object {$_.DisplayName -like '*firewall*' -or $_.DisplayName -like '*security*'}

4. Use Windows Performance Toolkit for advanced analysis:

# Create custom ETW trace for network events
wpr -start GeneralProfile -start Network
# Reproduce the issue
wpr -stop NetworkTrace.etl