Eset Internet Security Firewall not fully blocking app defined in rule

[blazej222 0]

Hi!

For a few days I've been trying to setup ESET Firewall to block Steam from accessing the internet on my computer (on a certain firewall profile called Steam_block.) 

I've created a rule to block all communications (inbound and outbound, all protocols) for local applications steam.exe and steamwebhelper.exe.

It partially works, because when applied, I can't browse store/community/workshop, but my friend list still works and I can send and receive chat messages. I am sure those two processes are responsible for chat messages also, because when I send/receive message windows network monitor shows steam.exe is sending/receiving data, even though it shouldn't.

I've tested another firewall application, and it is sufficient to block steam.exe there - steam immediately shows it's disconnected from the internet and friend list/chat functionality stops working. Am I doing something wrong?

In attachements I included screenshots of how the firewall rule is set. 

Thanks in advance for any help.

[Marcos 5,070]

I'd toggle the display of pre-set rules and put this rule on top. Also the question is if the profile "Block_steam" is actually being used in your network. Check if the profile is used by both wire and wi-fi network (if applicable) under "Profiles assigned to network adapters". I'd prefer using the default profile and creating rules there and create custom fw profiles and bind them to adapters only when it works with the default profile.

[blazej222 0]

1 hour ago, Marcos said:

I'd toggle the display of pre-set rules and put this rule on top.

I've already done this.

1 hour ago, Marcos said:

Check if the profile is used by both wire and wi-fi network (if applicable) under "Profiles assigned to network adapters". 

I connect to the internet only with ethernet cable, so I don't think it's applicable here. Wifi is disabled most of the time.

Every network adapter has Default firewall profile set to "Inherit default global profile" and Prefer network profile set to "Yes".

The problem is, the rule seems to be working but only partially - sometimes I get a notification from ESET that network activity was blocked according to my rule, but I don't receive it when chatting, etc.

1 hour ago, Marcos said:

I'd prefer using the default profile and creating rules there and create custom fw profiles and bind them to adapters only when it works with the default profile.

It unfortunately doesn't work on the default profile either.

[Marcos 5,070]

You could do the following:

1. Enable advanced logging under Help and support -> Technical support
2. Reboot the machine
3. Reproduce the issue
4. Stop logging
5. Collect logs with ESET Log Collector and upload the generated archive here (only the ESET staff can access attachments).

 

[blazej222 0]

Ok, including the file in the attachment. It contains everything except ESET SysInspector journal - when I tried to create logs with SysInspector it would cause log collector to wait indefinitely.

eis_logs.zip