Stopped windows firewall service during ICS, how is this possible?

Question

Although windows firewall is required to be on when you "start" Internet Connection Sharing, you can stop the WF service with MMC. When done a client can still use the host machines internet. The firewall had port 80/http blocked, and now it is open for incoming traffic. However other ports used by applications on the host and client which communicate with each other still seem to be blocked. Can anybody explain what might be happening here? Doesn't ICS need windows firewall for NAT?

Note: I am not actually seeing anything in the firewall logs after stopping the service, but even packets sent localhost on the host machine never arriving on these other random ports.

Answer 1

When a connection is already established, changing the firewall settings doesn't affect the connection usually until you drop the connection and redo it. This is because if the connection has been allowed with previous setting, it is not in "new" status anymore but in "established" (or related) status and these need to be allowed by any working (and usefull) firewall because if they weren't allowed, you couldn't receive answers from the outside on connections you made. This could explain why the NAT is still working but if you reboot the client, you probably won't be able to connect internet unless your firewall deactivation is not applied yet (waiting for a service restart or a reboot).

For the connections not allowed after turning firewall down, are you sure the firewall is already down and not pending waiting for a reboot or a firewall service restart? (the config change has not been applied yet).

Anyways, you firewall should block ports for outside communication and probably not for internal (LAN) communications. As you are saying "However other ports used by applications on the host and client which communicate with each other still seem to be blocked", are you sure your firewall is applied on the external interface? I don't remember well where it is on windows (in an Advanced Tab somewhere) but you have to deactivate the firewall on the internal LAN interface for your machine to be accessible from other machines on the LAN.