Windows Firewall: Block rules take precedence over Allow rules
Posted by jpluimers on 2018/05/07
Reminder to self for Windows Firewall: Block rules take precedence over Allow rules (see * below as actually it is even more complex); [WayBack] Firewall Rule Properties Page: General Tab has
Firewall rules are evaluated in the following order:
- Allow if secure with Override block rules selected in the Customize Allow if Secure Settings dialog box.
- Block the connection.
- Allow the connection.
- Default profile behavior (allow or block as specified on the applicable Profile tab of the Windows Firewall with Advanced Security Properties dialog box).
Within each category, rules are evaluated from the most specific to the least specific. A rule that specifies four criteria is selected over a rule that specifies only three criteria.
Which means that this will block TCP port 1024 traffic to bar.exe:
The Block rules are inserted by Windows if you click “Cancel” on a dialog like this (note the lowercase path, despite the application being at C:\Program Files (x86)\Foo\Bar.exe):
The problem is that the “Windows Firewall with Advanced Security” does not refresh with the F5, so initially you will not see the Block rules. Only after a manual refresh through the context menu helps:
After that, you disable the rule (or delete it, but then Windows will re-add it when you restart the application and cancel out of the dialog), then the Allow rule will take effect:
* Precedence is even more complex
Actually the precedence is even more complex, as explained by 
[WayBack] Order of Windows Firewall with Advanced Security Rules Evaluation, the order is this:
- Windows Service Hardening
- Connection security rules.
- Authenticated bypass rules.
- Block rules.
- Allow rules.
- Default rules.
–jeroen
PS:
Referenced by [Wayback] Linux HowTo: Windows AdvFirewall Subnet/Port/Program Conflicting Rules – TECHPRPR with these references of which I missed the first in my post:
The Wiert Corner - irregular stream of stuff 
Linux HowTo: Windows AdvFirewall Subnet/Port/Program Conflicting Rules - TECHPRPR said
[…] Windows Firewall: Block rules take precedence over Allow rules […]