Windows Event ID 5157 – Windows Filtering Platform: Network Connection Blocked by Firewall

Start by examining the specific details of Event ID 5157 to understand what connection was blocked and why.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5157 by right-clicking the Security log and selecting Filter Current Log
4. Enter 5157 in the Event IDs field and click OK
5. Double-click a recent Event ID 5157 entry to view detailed information
6. Review key fields in the event details:
   • Application Information: Process path and ID
   • Network Information: Source and destination IPs, ports
   • Filter Information: Filter ID and layer name that blocked the connection
7. Note the Direction field to determine if this was inbound or outbound traffic
8. Check the Protocol field to identify TCP, UDP, or other protocols involved

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5157} -MaxEvents 50 | Select-Object TimeCreated, @{Name='ProcessName';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Application Name:*'}) -replace '.*Application Name:\s*',''}}, @{Name='SourceIP';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Source Address:*'}) -replace '.*Source Address:\s*',''}}

Examine current firewall rules to identify which rule is blocking the connection and determine if modification is needed.

1. Open Windows Defender Firewall with Advanced Security by running wf.msc
2. Review Inbound Rules and Outbound Rules sections
3. Look for rules with Block action that match the blocked connection details
4. Check rule properties including:
   • Scope (specific IP addresses or ranges)
   • Protocols and Ports settings
   • Programs and Services restrictions
5. Use PowerShell to list all blocking rules:

# List all firewall rules that block connections
Get-NetFirewallRule | Where-Object {$_.Action -eq 'Block' -and $_.Enabled -eq 'True'} | Select-Object DisplayName, Direction, Action, Enabled | Format-Table -AutoSize

# Get detailed information about specific blocking rules
Get-NetFirewallRule -Action Block | Get-NetFirewallPortFilter | Select-Object InstanceID, Protocol, LocalPort, RemotePort

6. Cross-reference the Filter ID from Event 5157 with firewall rule properties
7. Document any rules that may be overly restrictive for legitimate applications

Configure detailed firewall logging to capture more information about blocked connections for ongoing analysis.

1. Open Windows Defender Firewall with Advanced Security
2. Right-click Windows Defender Firewall with Advanced Security in the left pane
3. Select Properties
4. For each profile (Domain, Private, Public), configure logging:
5. Click Customize next to Logging
6. Set the following options:
   • Log dropped packets: Yes
   • Log successful connections: Yes (optional, for comparison)
   • Size limit: Increase to 32768 KB or higher
   • File path: Note the location (typically %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log)
7. Click OK to apply settings

Use PowerShell to configure logging programmatically:

# Enable firewall logging for all profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -LogAllowed True -LogBlocked True -LogMaxSizeKilobytes 32768

# Verify logging configuration
Get-NetFirewallProfile | Select-Object Name, LogAllowed, LogBlocked, LogMaxSizeKilobytes, LogFileName

7. Monitor the firewall log file for real-time blocked connection details
8. Use PowerShell to parse firewall logs:

# Parse recent firewall log entries
$logPath = "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log"
Get-Content $logPath -Tail 100 | Where-Object {$_ -like "*DROP*"} | ForEach-Object {
    $fields = $_ -split ' '
    [PSCustomObject]@{
        Date = $fields[0]
        Time = $fields[1]
        Action = $fields[2]
        Protocol = $fields[3]
        SrcIP = $fields[4]
        DstIP = $fields[5]
        SrcPort = $fields[6]
        DstPort = $fields[7]
    }
}

Focus on specific applications that are being blocked to determine if firewall exceptions are needed.

1. Identify the application from Event ID 5157 details in the Application Name field
2. Verify the application's legitimacy and network requirements
3. Check if the application has existing firewall rules:

# Find firewall rules for a specific application
$appPath = "C:\Program Files\YourApp\app.exe"
Get-NetFirewallApplicationFilter | Where-Object {$_.Program -eq $appPath} | Get-NetFirewallRule | Select-Object DisplayName, Direction, Action, Enabled

4. Create a new firewall rule if the application requires network access:
5. Open Windows Defender Firewall with Advanced Security
6. Right-click Inbound Rules or Outbound Rules and select New Rule
7. Choose Program and specify the application path
8. Select Allow the connection
9. Choose appropriate profiles (Domain, Private, Public)
10. Provide a descriptive name for the rule

Use PowerShell to create firewall rules programmatically:

# Create inbound rule for specific application
New-NetFirewallRule -DisplayName "Allow MyApp Inbound" -Direction Inbound -Program "C:\Program Files\MyApp\myapp.exe" -Action Allow -Profile Domain,Private

# Create outbound rule with specific ports
New-NetFirewallRule -DisplayName "Allow MyApp Outbound" -Direction Outbound -Program "C:\Program Files\MyApp\myapp.exe" -Protocol TCP -LocalPort 80,443 -Action Allow

10. Test the application functionality after creating the rule
11. Monitor Event ID 5157 to confirm the blocks are resolved

Perform deep analysis of Windows Filtering Platform filters and layers for complex blocking scenarios.

1. Use the Windows Performance Toolkit to capture detailed WFP information:
2. Install Windows SDK or download WPT separately
3. Run Command Prompt as Administrator
4. Capture WFP trace data:

# Start WFP tracing
netsh wfp capture start file=c:\temp\wfp.etl

# Reproduce the blocked connection issue
# Stop tracing after reproducing the issue
netsh wfp capture stop

5. Analyze WFP filters and layers using netsh commands:

# Show all WFP filters
netsh wfp show filters file=c:\temp\filters.xml

# Show specific layer information
netsh wfp show state file=c:\temp\wfpstate.xml

# Display filter information for specific layer
netsh wfp show filters layer=FWPM_LAYER_ALE_AUTH_CONNECT_V4

6. Cross-reference the Filter ID from Event 5157 with WFP filter output
7. Examine filter conditions and weights to understand blocking logic
8. Check for conflicting filters or unexpected filter priorities
9. Use PowerShell to query WFP programmatically:

# Get WFP filter information using WMI
Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_NetFirewallRule | Where-Object {$_.Action -eq 3} | Select-Object InstanceID, DisplayName, Direction

# Analyze network connections and their states
Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | Select-Object LocalAddress, LocalPort, OwningProcess, @{Name='ProcessName';Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}

10. Review third-party security software that might be adding WFP filters
11. Check for Group Policy settings that might be creating restrictive filters
12. Document findings and create comprehensive firewall rule modifications