Kate978

I turned off fast startup in Control Panel. Control Panel=>Power Options=>Choose what the power buttons do=>Change settings that are currently unavailable=>Turn off fast startup=>Save changes I can't explain this fact, but now firewall is working fine.

Now the firewall is fully functional. It seems the problem was in conflict with fast boot. Very thank you.

I disabled the fast boot. I really saw the initialization window with ESET logo. Now it sometimes appears, sometimes not, but the firewall is fully working both after shutdown the computer and after rebooting. Then I turned on Interactive mode and here are my rules. Firewall rules Name Protocol Direction Local Remote Ask traffic for openvpn.exe TCP and UDP In Deny incoming connections Any In Allow traffic for ProtonVPN.exe TCP and UDP Out Allow traffic for ProtonVPNService.exe TCP and UDP Out Ask traffic for firefox.exe TCP and UDP Out Ask traffic for tor.exe TCP and UDP Out Allow traffic for egui.exe TCP and UDP Out Allow traffic for ekrn.exe/ekrn TCP and UDP Out Allow traffic for dnscrypt-proxy.exe TCP and UDP Out Allow traffic for svchost.exe/Dnscache TCP and UDP Out Allow traffic for svchost.exe/Dhcp TCP and UDP Out Deny outgoing connections Any Out Deny traffic for svchost.exe/CryptSvc TCP and UDP Out Deny outgoing multicast DNS requests UDP Out IP: 224.0.0.252 Port: 5355 Deny outgoing NETBIOS requests TCP and UDP Out Port: 445,137-139 Deny outgoing LDAP requests TCP and UDP Out Port: 389,3268,49152-49159 But... There is still a leakage of traffic, which is forbidden not only in the firewall rules, but in the system. These are NetBIOS, mDNS, SSDP, UDP. It seems to be ekrn.exe file. So it is a component of ESET Internet Security. It connects to various not Eset IP addresses (224.0.0.22, 192.168.0.1, 192.168.0.100, 65.52.98.233, etc.) using NetBIOS protocol. But is it normal behavior?

Hidden default rules are at the bottom of the list. Only blocking incoming connections rules are active. Others are inactive. There is a leakage of such traffic as dns-client, dnscrypt-proxy, ekrn, part of ProtonVPN. Even forbidden protocols like MDNS, NBNS, SSDP get access to the Internet without any permission. This initialization window with ESET logo is also missing.

These are my firewall rules. Firewall rules Name Protocol Direction Local Remote Ask traffic for openvpn.exe TCP and UDP In Deny incoming connections Any In Ask traffic for ProtonVPN.exe TCP and UDP Out Ask traffic for ProtonVPNService.exe TCP and UDP Out Ask traffic for firefox.exe TCP and UDP Out Ask traffic for tor.exe TCP and UDP Out Ask traffic for egui.exe TCP and UDP Out Ask traffic for ekrn.exe/ekrn TCP and UDP Out Ask traffic for dnscrypt-proxy.exe TCP and UDP Out Ask traffic for svchost.exe/CryptSvc TCP and UDP Out Ask traffic for svchost.exe/Dhcp TCP and UDP Out Deny outgoing multicast DNS requests UDP Out IP: 224.0.0.252 Port: 5355 Deny outgoing NETBIOS requests TCP and UDP Out Port: 445,137-139 Deny outgoing LDAP requests TCP and UDP Out Port: 389,3268,49152-49159 Ask outgoing connections Any Out Deny traffic for svchost.exe/Dnscache TCP and UDP Out

The firewall is in Policy-based mode, not Automatic mode. Custom rules are configured in such way that all incoming connections are blocked and all outgoing connections are asked. Such behavior of the firewall looks suspicious. Like hacking a computer. But maybe this is just a bug?

Hello. There is the following problem with the firewall after ESET Internet Security 12 installing. The firewall is configured to block all incoming connections and request all outgoing. When you first connect to the Internet, everything works fine. But after the first connection the firewall begins to allow some outgoing traffic without permission. This problem is observed immediately after the computer is turned on and disappears upon reboot. Is this a bug of ESET Internet Security or is it a sign of hacking a computer? Operating system: Windows 10 64-Bit.