WindowsFirewallHelper icon indicating copy to clipboard operation
WindowsFirewallHelper copied to clipboard

Failures handling address ranges in windows firewall that don't align on a single netmask or cidr

Open TimesliceTechnologies opened this issue 9 months ago • 0 comments

Given the following remote addresses and address ranges configured in a firewall rule: 13.110.220.0 - 13.110.222.200 13.110.234.124 13.110.234.126 13.110.224.0/20 13.110.230.0/24

Problem 1: Rule.RemoteAddresses only returns 2 IAddresses instead of 5: 13.110.224.0/255.255.240.0 13.110.220.0-13.110.222.200

Problem 2: NetworkAddress.TryParse() FAILS when trying to parse range 13.110.220.0 - 13.110.222.200 NetworkAddress.TryParse() FAILS when trying to parse range 13.110.220.0 - 13.110.222.200 The range 13.110.220.0 - 13.110.222.200 can't be converted to a single netmask which is somewhat understandable however not getting the full list of RemoteAddresses when such a range is in the rule's scope is definitely NOT ok.

This screenshot shows the address range from Iaddress, however NetworkAddress.TryParse fails: NetworkAddress-TryParseFail

Both issues are probably related to a range that doesn't align on a strict CIDR boundary

This is fundamentally problematic - FIrewall Helper is not returning the full scope of the rule - This is critical if there are many addresses in the rule's scope, especially if you update the rule with only a few addresses / ranges you think exist where there were previously many addresses / ranges

TimesliceTechnologies avatar May 20 '24 19:05 TimesliceTechnologies