In this article, you will learn everything you need to know about the Firewall product.
1. Description
2. How does Firewall work?
3. HEIMDAL Agent - Firewall
4. Firewall view
5. Firewall Management settings
DESCRIPTION
The Firewall product allows you to control the Windows Firewall from the Heimdal Management Portal.
HOW DOES FIREWALL WORK?
The Firewall product controls the Windows Firewall with Advanced Security and enables you to manage firewall rules from the HEIMDAL Dashboard (through the Heimdal.Firewall.Exe process). It also intercepts any Brute Force attack attempts and automatically blocks the RDP Port to stop the attack. The Firewall module allows you to isolate a computer in case of suspicious activity. The detection of Brute Force Attacks is based on Event ID 4625, which can be found in the Event Viewer -> Windows Logs -> Security -> Audit Logs (Logon category).
HEIMDAL AGENT - FIREWALL
Firewall (inside the HEIMDAL Agent) displays the Firewall Rules that are set by the HEIMDAL Administrator in the Group Policy settings.
In the Firewall Alerts section, you can see the alerts that were triggered on a computer with information on Local IP, Attempts, Detection Type, and Date.
FIREWALL view
The Endpoint Detection - Firewall view displays all the information collected by HEIMDAL Agent that is running on the endpoints in your organization. The collected information refers to the Windows Firewall rules and alerts intercepted by the HEIMDAL Agent. At the top, you see a statistic regarding the number of Infected Files, the number of Suspicious Files, and the number of Quarantined Files.
The collected information is placed in the following views: Firewall Rules and Firewall Alerts.
-
Firewall Rules
This view displays a table with the following details: Hostname, Username, Application, Port, Profile type, Protocol, Direction, Permission, and Timestamp.
The entries that you see in this view include all the new rules that Windows automatically creates in the Windows Firewall (this event is logged in the Event Viewer Logs, under Microsoft -> Windows -> Windows Firewall with Advanced Security -> Firewall -> event ID 2004, 2071, and 2097). When a new application has a new rule in the Windows Firewall with Advanced Security, the HEIMDAL Agent sends it to the HEIMDAL Dashboard to be displayed in the Firewall view -> Firewall Rules (if there is no other rule that is matched in the Group Policy under Firewall). The rules created in the Firewall Management settings will not be displayed in the Firewall Rules view. These custom rules will be displayed ONLY in the specific Group Policy, under the Firewall Management sub-tab where they are created. -
Brute Force Attacks
This view displays a table with the following details: Hostname, Username, Local IP, Most targeted username, Main source IP, Main source Country, Detection type, Timestamp, and Risk Level.
The checkbox allows you to select an entry and add the IP Address to the Brute Force Attack Allowlist. The entries that you see in this view include a list of all the unwanted connections that are interpreted as Brute Force Attacks.
A Brute Force Attack is triggered when a user fails to insert the correct password (event 4625) at least 100 times in less than 5 minutes. The detection types are classified as BruteForceAttackPrivate (these attacks are originating from an IP Address on the same network as the affected endpoint/server - 192.x.x.x, 172.x.x.x, 10.x.x.x), BruteForceAttackPublic (these attacks are originating from an IP Address that is coming from outside the network/public IP Address).
Brute Force Attacks alerts are triggered when the local user fails several password attempts:- Low Risk - under 150 failed attempts;
- Medium Risk - between 150 and 200 failed attempts;
- High Risk - over 200 failed attempts.
An external user will trigger a High Risk of Brute Force Attack when a minimum of 100 failed attempts are performed in less than 5 minutes. The failed password attempts are found in the Event Viewer Logs, under Windows Logs -> Security -> Event ID 4625. During a Brute Force Attack, the Heimdal.Firewall.exe process might use a higher CPU usage (depending on the interval of the Brute Force Attack attempts) of 1% to 60%.
The BFA by Country view presents data grouped by country, allowing users to analyze attack patterns based on geographic location:
In the detailed view, clicking on the device number (attempts registered to that specific country) displays all alerts originating from that location. Upon selecting entries from the detailed view (after clicking on a country) you can also add to the Allowlist from here.
The BFA by IP view presents data grouped by IP, providing insight into attack sources.
In the detailed view, clicking on the number of devices displays all alerts originating from that IP address. Upon selecting entries from the view, you can also add to the Allowlist from here.
The BFA by User view showcases data grouped by user, helping track targeted accounts. Clicking on the number of devices displays all alerts associated with that user account, along with the relevant information.
FIREWALL MANAGEMENT SETTINGS
This module allows you to control the Windows Firewall from the Heimdal Dashboard.
Firewall Management - turns the management of the Windows Firewall ON or OFF. Turning Firewall Management ON will enable the Windows Firewall on the endpoints if it is disabled; turning it OFF will not disable the Windows Firewall on the endpoints.
Note: Apart from Allow ICMP echo requests and the Firewall Rules grid, the options described below are only visible when Advanced mode is enabled in the Group Policy editor.
General Settings
Preserve the firewall rules in the GP when the endpoint is isolated - keeps the firewall rules specified in the Group Policy even when the endpoint is isolated, so that rules added in the Group Policy are not disabled by the Heimdal Agent when the endpoint gets isolated.
Allow ICMP echo requests - permits incoming ping requests to the endpoints, aiding in network diagnostics and connectivity testing.
Auto-collect logs on endpoint isolation - allows the Heimdal Agent to automatically upload the Heimdal logs when an isolation event occurs. This option is available only when Endpoint isolation is enabled.
Firewall Profiles - allows you to enable or disable the Windows Firewall profiles (Domain, Private, Public) and configure default rules for Incoming and Outgoing connections within each profile. When enabled, the Firewall Profiles section below becomes available.
Firewall Profiles
For each profile (Domain, Private, Public), tick the profile to enable it, then set its Inbound connection and Outbound connection default rule (Allow or Block) from the dropdowns.
Firewall Rules
The Firewall Rules are a set of instructions that tell the firewall exactly what network traffic to allow or block, based on predefined criteria. This section allows you to add, edit, or remove firewall rules in the Windows Defender Firewall. Click Add new rule and complete the following fields:
- Name - the rule name (must be unique). Each rule includes a suffix corresponding to the protocol type (e.g., Block SQL Server port-TCP or Block SQL Server port-UDP).
- Application - the application path, or * for any application (e.g., C:\path\program.exe, %ProgramFiles%\app.exe).
- Remote IP - a single IP, comma-separated IPs, em dash-separated IP ranges, or a combination; * (or blank) for any IP.
- Port - the port value, or * for all ports (e.g., 80,443,5000-5010); values can be set only for TCP or UDP protocols.
- Direction - the direction of the flow (In, Out, or Both).
- Protocol - the protocol type (TCP, UDP, or Any). Ports can only be set for TCP and UDP; other protocols default to ANY.
- Permission - whether to Block or Allow.
- Profile Types - the profile(s) the rule applies to (Domain, Private, Public).
Tick Additional Settings to reveal the following optional fields (please note that it can take up to 2 hours to discover new AD Computer Groups):
- Local AD Computer Groups - applies the rule only if the source computer is part of the specified computer groups.
- Local IP - applies the rule only if the source computer has the specified local IP(s); multiple IPs can be separated by commas.
- Remote AD Computer Groups - applies the rule to any remote IP belonging to computers in the specified groups, respecting the selected IP type (public/private/both).
- IP Type - Public, Private, or Both.
Click Save Rule to add it to the grid, or Cancel to discard it. Existing rules are listed with the Name, Application, Remote IP, Port, Direction, Protocol, Permission, Profile Type, and Action columns.
Firewall Predefined Rules
This section allows you to enable or disable predefined rules based on a list of firewall groups. These groups are mapped to provide network connectivity for Windows programs and services, and the user cannot alter them. Use the Select Firewall Groups picker to choose groups and search the list; each rule is shown with its Status (On/Off), Group name, Rule Name, Rule Description, and Rule Direction. Click a rule name to open its details.
Isolation Rules
Endpoint isolation - isolates an endpoint in your network from the rest of the endpoints while retaining remote support capabilities. When isolated, the endpoint reroutes all external connections through Heimdal services, and the system automatically generates any missing firewall rules required for your selected remote access tool. Once the option is enabled, select an Isolation Profile from the dropdown and click Add Profile to add the predefined rules for that product (e.g., TeamViewer, Heimdal RD); only the non-existent rules are created. Any Heimdal process/application is allowed by default. All temporarily created rules are automatically deleted when the endpoint is taken out of isolation. Once enabled, an endpoint can be isolated from the Device Info view by selecting it and pressing the Isolate button (the same procedure applies to Unisolate the endpoint).
Note: For the setting to take effect, the isolation profile needs to be enabled in the Group Policy BEFORE the isolation event takes place. If the isolation profile is enabled and machine isolation is triggered via any of the available methods, a new firewall rule is added to the Windows Firewall.
Note: The Isolate and Unisolate actions take around 5 to 10 minutes to be applied on the local endpoint if Real-time communication is enabled in the Group Policy applied to that endpoint. If the endpoint has more than 100 firewall rules applied, the isolation might take more than 10 minutes, depending on the number of rules the agent needs to disable.
If your Firewall settings are managed through another application/vendor or Intune, the Heimdal Agent will not be able to perform the isolation. If you are using Microsoft Intune to manage the Firewall settings, disable any policy that interacts with it. For example, set the Firewall settings to Not configured (Endpoint security -> Security baselines -> Security Baseline for Windows 10 and later -> Intune Security Baseline Policy -> Properties, edit the Configuration settings, and set the Firewall settings to Not configured).
Isolate on tamper detection - automatically isolates the endpoint if any Heimdal services are detected as being tampered with (for example, when the end user tries to stop or pause the Heimdal services, breaking the Anti-Tamper Protection), preventing bypass attempts. Enabling this option also enables the Firewall module if it is disabled. This option is available only when Endpoint isolation is enabled.
Device protection actions - enables automated defensive actions upon threat detection. A dedicated grid is displayed in which you can select one or multiple actions (Isolation, Shutdown, or Logout) for each module (Firewall, Next-Gen Antivirus, and Ransomware Encryption Protection).
IMPORTANT
If Device protection actions are enabled and the Firewall module is disabled, the latter will be enabled automatically, as will the Endpoint isolation setting. If the Ransomware Encryption Protection module is disabled or not licensed, its row in the grid will be disabled (not actionable). For the Firewall module, the only available protection action is Isolation, and it is triggered after a minimum of 50 occurrences of public Brute Force Attacks. Disabling this setting after a Group Policy update will trigger a toast message informing you that disabling Device protection actions will not disable the Firewall module or the Endpoint isolation setting.
If multiple actions are selected for a module, they are executed in order: Isolation first, followed by Shutdown, and then Logout (depending on the combination of actions, in some scenarios the Logout action will no longer be performed).
An email alert/notification is sent whenever an automatic machine isolation occurs (either as a result of a selection made in Device protection actions or because the Isolate on tamper detection functionality kicks in). The email notification is generated and sent to the users (corporate customer and reseller levels) who have the Next-Gen Antivirus alert enabled in the Accounts section of the Heimdal Dashboard. (corporate customer notification)
(reseller notification)
(email example)