1
I have a publicly-facing Windows 10 box (with a public IP) that I would to configure so that I, and only I, can remotely VNC to it.
Fortunately I can ensure that I will only be connecting to my server from a single remote host (198.51.100.1 in this example). So I have the firewall rules setup on the Windows 10 host in this way:
Specifically, under the "Scope" setting for the rule, I have configured "Remote IP address" to allow only 198.51.100.1. Under "Advanced", I have the rule set to apply to Domain, Private and Public profiles. Under "Protocols and Ports", the incoming rule applies to local port 5900. No other customizations are present.
However this rule does not appear to be working. I can still VNC to this Windows 10 server from any remote PC, not just 198.51.100.1
Why is this rule not blocking connections from all IPs except the one I want?
Thanks, Appleoddity, that was it. UltraVNC had unexpectedly installed two different firewall rules. The "vnc5900" one was already in place, and I had hoped by modifying it to allow only certain IPs I could tighten up the rule and limit access. But it had also installed a "WinVNC" rule which was application based (winvnc.exe) rather than port based, and apparently that rule tool precedence over the "vnc5900" rule, causing my IP restrictions on that rule to have no effect. Consolidating the two rules into one now has the firewall working as expected. – David White – 2019-05-12T03:31:18.427
@DavidWhite: As the answer explained, it's not a matter of precedence. Failure to match an "allow" rule does not mean instant denial -- the firewall keeps evaluating rules all the way down the list until one matches. – Ben Voigt – 2019-05-12T03:55:52.593