wokhan/wfn

Windows Firewall Notifier extends the default Windows embedded firewall by allowing to handle and notify about outgoing connections, offers real time connections monitoring, connections map, bandwidth usage monitoring and more...

wfn's Issues

Notifications fixed?

Hello and welcome to GitHub!

I read this user-submitted reply on your old site, and am wondering if it has been fixed as of Beta 2:

The 1.9 branches aren't being updated anymore. 2.0 is still in alpha stages, yes. So far, all versions seem to be suffering from a notification spam, that blows up task manager and causes 100% CPU usage. The developers are working hard to fix this issue, but none of them are getting paid, so it may take awhile for them to find a proper fix for it.

Try each of them as they all give different results per user. The notification spam only happens with the "Block and Prompt" setting for outbound connections, but you can always try it with the other settings.

Lots and lots of notifier.exe

What are all those instances of Notifier.exe doing? They don't use much CPU each, but it really adds up (to 100% CPU usage!)

Allow temporarily is invalid now

Notification window is stuck until clicked icon on taskbar, to remove temporary rule, and yet permanent allow rule is created. W7, beta 2.

Blocking seems to work fine now, thanks.
Can you add "EnableWFN.cmd" to setup without GUI?

ALLOW and SKIP buttons not working

Reference version 2 beta 2
I set the firewall to block and alert on all outgoing connections.
I used the SKIP PROGRAM function and continue to see prompts from same program.
The program was for APC UPS monitoring (Powerchute Business Edition Server).
Same for Host Process for Windows Services.
I stopped using WFN at that point because repeated prompts for same program is the problem I've had since the start.
I thought when I clicked ALLOW that I was adding a rule for the alerting program. I see lots of allowed programs in the Firewall Rules, so the ALLOW button doesn't seem to work either.

No notifications on Win10 Creators Update (v2 beta 1)

Hi Daniel,

I'm using WFN for years now and really like it. But now, i have an issue with it again:

• windows task scheduler does not start WFN
• it says, task was never running
• I thinkt this problem starts after updating to Creators Update
• I have a few more issues with other tasks which won't run correctly after this update, i think MS has worked a lot on task scheduler.

I use the update-check from vlc-player for triggering WFN. There is no rule for it, so it will be blocked. An Entry in the event log will be created, like it should:

---

• 5157 1 0 12810 0 0x8010000000000000 28073 Security JB-AW
• 5692 \device\harddiskvolume4\program files\vlc\vlc.exe %%14593 192.168.2.104 1753 88.191.250.2 80 6 365769 %%14611 48 S-1-0-0 S-1-0-0

---

In my opinion, it should run the task, but it doesn't. The only thing, i noticed, is, that sometimes the LayerRTID is 50 instead of 48, but i can find both entries, so either way it should work?!

referring to https://wfn.codeplex.com/workitem/5245
After reading this, i put WFN to C:, but no change.
Problem seems not to be WFN but the trigger of the task
Same issue with WFN v2 alpha 12

Do you see any reason for this behaviour?

Greetings
Jörg

how to --> definitely <-- uninstall wfn please....

hello,

yesterday i asked how to uninstall wfn since there is no installation/uninstallation process
see topic #33

today when i set zonealarm to ask me for new connections it asked me if notifier.exe has to be allowed.... i answered no.
at this moment notifier.exe tryed to reach 127.0.0.1 (my own machine), why? wasn't it supposed to be inactive?

how to definitely "uninstall" wfn.

the fact that the folder with extracted files is always on my desktop is the reason of this activity?

Clarify why WFN itself needs to connect to servers

new user. how to install

hello,
ive just download wfn.
after i extract the files there is no installation file,
i launch wfn.exe but do i have to launch it manually each time i reboot the computer?

WFN becomes unstable when alerts are ignored (beta 3)

Event ID 1000

Faulting application name: Notifier.exe, version: 2.0.0.0, time stamp: 0x5a9abcf8
Faulting module name: KERNELBASE.dll, version: 6.1.7601.23915, time stamp: 0x59b94abb
Exception code: 0xe0434352
Fault offset: 0x0000c54f
Faulting process id: 0x8ef0
Faulting module path: C:\Windows\syswow64\KERNELBASE.dll

Event ID 1026

Application: Notifier.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileLoadException
at Wokhan.WindowsFirewallNotifier.Notifier.Program.Main(System.String[])

Crash on alert dialog

PF has blocked outgoing TCP (6) [S] packet from [] to [] (https)

Need a method of clearing the security log

When I start tweaking firewall rules which tend to generate lots of log entries, I usually clear the log manually when finished, so it's easy to verify at a glance that my adjustments were successful and no new activity has appeared. This is a feature which seems to be missing in WFN.

Logging

Currently, logs are saved in the base directory of the application. The purpose of this issue is to establish a plan for where logs will be stored. Ultimately I imagine we can make this a user-selectable option, but by default it could go like this:

1. Pick Windows Event Reporting by default
2. Save the log file to a temp folder (fall back here if writing to WER fails)
3. Save the log file to the current working directory
4. Don't do any writing at all (unwritable file system?)

Prerequisites

The discussion of logging was brought about from discussing the need for a portable mode or option where the application can run self-contained in its own directory (this is how it currently operates), rather than being installed to the system. In portable mode, it may make sense to change the priorities of logging. This issue depends on #21.

To log or not to log?

As WFN becomes more developed, it may be worthwhile to ask if logging should be enabled by default at all. In a production environment, it may be desirable to have as little logging as possible, at least having some sort of management system in place to prevent log files from growing out of control. Logging could be disabled by default in release mode (but optionally enabled by the user of course), then enabled by default in debug mode. In addition, WFN could keep a memory buffer of events, then dump them to the requested log location when necessary.

Can't allow outgoing traffic for Ubuntu bash on Windows

With the current version (2.0 Beta 1) and the previous alpha, i'm not able to allow outgoing traffic for the ubuntu bash. When i run apt-get upgrade for example WFN popup reports a "Pico" application (see screen below). Even if i allow all kind of traffic it keeps asking me to allow such application and the outgoing traffic is never allowed.

https://drive.google.com/open?id=0B1ToRp4AD1hkSW8tSEdKWDdxV0k

CIDR Notation for Existing Firewall Rules

Hi,

I have a number of my own rules for blocking ranges of IP addresses using CIDR notation. I suspect WFN is not finding a match for these, because I still get notifications that it is blocking the connection. Shouldn't it NOT notify me when an existing rule covers the connection?

Brian

"UPDATE RATE" And Other Display Settings Should Be Made Persistent

Most sections in WFN's menu have an UPDATE RATE drop-down box in the top-right corner. In the case of the FIREWALL RULES screen, this is replaced by a "SHOW" setting.

While it's a useful feature, the problem is that the setting does not persist even during the same session. For example, if you set the "SHOW" option to "WFN RULES" in the FIREWALL RULES screen, then momentarily switch to any other menu entry and then come back, the setting will have reverted to the default "SHOW ALL" option.

The same also goes for the UPDATE RATE setting in the other screens. It keeps getting reset to the default value of "1", and it's a little annoying to have to keep setting the value each time the menu entry is visited.

It would be nice if these page display settings are made permanent, or at least don't get reset until you quit the program. Thanks.

Possible to create a portable version?

Would it be possible to create a portable version?

Windows Firewall Control by Sphinx Software (http://sphinx-soft.com/Vista/order.html) is able to offer a portable version. It would be great if this open-source project could do the same.

How do you install WFN?

What's the method to install WFN? It appears that if you simply drag the extracted folder to, say, C:\ and run it, no actual notifications arise when outbound connections occur.

Is there some missing documentation that reveals the secrets to this gem of an app?...

[bug] Minimize to console not working on Windows Server 2008/2012

The option is activated, but WFN always minimizes to the taskbar on Server.

Crash with "Outbound" set to "Block and prompt" on Windows Server 2008/2016

I'd like to block outgoing traffic and only allow few components/programs. Whenever I activate "Block and prompt" for outgoing traffic, WFN crashes repeatedly.

Here are event logs for .NET Runtime:

Application: Notifier.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.UnauthorizedAccessException
   at System.IO.__Error.WinIOError(Int32, System.String)
   at System.IO.FileStream.Init(System.String, System.IO.FileMode, System.IO.FileAccess, Int32, Boolean, System.IO.FileShare, Int32, System.IO.FileOptions, SECURITY_ATTRIBUTES, System.String, Boolean, Boolean, Boolean)
   at System.IO.FileStream..ctor(System.String, System.IO.FileMode, System.IO.FileAccess, System.IO.FileShare)
   at Wokhan.WindowsFirewallNotifier.Common.Helpers.LogHelper..cctor()

Exception Info: System.TypeInitializationException
   at Wokhan.WindowsFirewallNotifier.Common.Helpers.LogHelper.Debug(System.String)
   at Wokhan.WindowsFirewallNotifier.Notifier.Program.Main(System.String[])

and the accompanying Application Error:

Faulting application name: Notifier.exe, version: 2.0.0.0, time stamp: 0x59317d16
Faulting module name: KERNELBASE.dll, version: 10.0.14393.1770, time stamp: 0x59bf2bcf
Exception code: 0xe0434352
Fault offset: 0x000daa12
Faulting process id: 0xd5c
Faulting application start time: 0x01d34f0adc2aa405
Faulting application path: C:\Portable Program Files\WFN\Notifier.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: 7eff7d23-4fa5-4142-a7bf-15a1e2f21b84
Faulting package full name: 
Faulting package-relative application ID:

Feature: Include a bundle of "known safe" outbound rules

My primary use-case for WFN is to install it on sandboxed clones of a Windows 10 VM, where I can play with interesting new software. Obviously, this means using block-and-prompt outbound.

Every fresh install has a few dozen false negatives from traffic from system files, Office, and a couple of other things that we generally accept and trust.

I would really like it if the default install included a single-click to install a set of "allow" rules for those common acceptable connections, at least on their known ports.

Endless notifications using VPN

I have been using this software for few months. I think it's best lightweight replacement for default WF interface and it does everything what I need. However, I encountered several issues while using it and here is one of them.
The problem is I am getting spammed by endless number of popups while browsing internet through TunnelBear VPN.

I tried to click that switch next to "target port" but it doesn't help and it leads to lots of similar entries in firewall rules (which is difficult to remove one by one by the way):

I guess program ignores "local ports: *" rule cause all these rules differ only by local ports. So is this a limitation of WF or just WFN bug?

Alert dialog wont allow ping local gateway

Alert dialog box will not allow outgoing ICMP v4 ping (from 'System' port 8 to 192.168.1.1)

"The corresponding rule has not been created"

Add a "I trust this program" option to disable all specific rule properties at once

When I set to prompt for outgoing connection I get multiple prompts per program, Could you make it so there is an option to allow all request forever from a certain program?

Stopped working in Win10 x64 v1809 b17763.134

It seems WFN can't create an entry in windows scheduler or enabling the firewall log. Manipulating the WF however is still working. But the log is always empty - or WFN can't reach it - and I can't find it in the scheduler so basically it's not working anymore. WFN log is full of error.
The WF was bugged the last mayor udate it's blocked everything, but MS hotfixed it. It seems they change so many other things too.
There is a way to add manually to the windows scheduler and enable WF logging? I give it a try to test that way.
Wokhan.WindowsFirewallNotifier.Common.log

WFN Notifier.exe Death Battles slow Windows

This program is great! However, unlike the other Windows Firewall Control'er (binisoft) out there, this one uses Windows Task Scheduler to spawn new processes for every connection that doesn't match a known firewall rule. This means certain programs that really hammer to establish a connection can cause WFN to spawn dozens and hundreds of Notifier.exe processes. I can visually tell when this is happening, because my mouse will continually flicker to hourglass in any program I happen to be using.

Would it be possible to continue using the Task Scheduler, but instead have it trigger an event to a singular always-running user process or system service rather than spawning new processes for each event? DDE or other system messaging the permanent process can hook? The rapid fire opening of new Notifier.exe processes 20 times per second is quite daunting to deal with.

This seems to like to happen when attempting to create a temporary rule, which may be a separate bug. I believe it last happened to me with Google Updater.

Edit: At times, it also seems to just spawn a new Notifier.exe once per second for a program that already has a firewall rule. I'm not sure why.

EditEdit: Changing my Mouse Properties > Pointers > Working in Background cursor to the regular pointer helps assuage some frustrations.

WFN hangs on large logs

Thanks for developing this really cool piece of software. You've engineered a much-needed tool that sits at the intersection of (a) security events on Windows Server, (b) network monitoring, and (c) local and easy to use.

Trying out latest WFN on a Windows Server 2012 machine.

When trying to look at the security log (which has about 50,000 entries), WFN hangs indefinitely and never completes the view. I can look at the same log in Event Viewer and other utilities with no problem, so it's not a machine issue. What am I doing wrong, or can you improve on the log parsing performance?

In security log, do not redraw window contents unnecessarily

WFN is constantly re-drawing the security log window contents when no new activity has occurred. So if you click on a log entry because you need to highlight it while troubleshooting firewall issues, the entry will be de-selected by the time you return from looking at another window.

Rules for windows apps not working again

A while ago I've had some issues with the skype app in windows 10 while using the latest alpha WFN version. After adding proper support for windows apps the issue was fixed in beta1 but now it's back doing exactly the same thing: I get notifications from skypehost.exe at every boot, whenever I launch the app and sometimes even without any interaction. The generated rules just get duplicated and are not actually applied... I also got notifications when I launched the xbox app again, which means the whole fix done in beta1 is no longer working.
Now running beta2 but I also tested with beta1 with the same results.
This is not related to the latest W10 cumulative update, beta version or any new app I installed, I believe it's likely a quite recent background update related to windows apps...

Security Log events are time-delayed

I am seeing constant activity in the security log that is several minutes old, from applications which have been closed. This makes it difficult to trap and troubleshoot other traffic blocking issues I want to address.

Suggestions:

1. Implement an option to right click in the list & filter out specific applications

2. Include filter check boxes for "show system processes" & "show user processes"

3. Add a button to purge the security log

4. Always display blocked traffic in real time. Permit the user to freeze the log and scroll back, instead of waiting for log to catch up with last event. (See Microsoft "Process Monitor" and "Disk Monitor" (or the revoked "FileMon") from Sysinternals Suite for practical examples of filtering high-traffic logs.

https://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

Rules generated by WFN for specific services do not work

Windows 10 v1803 17134.112

Rules generated by prompts when services hosted by svchost.exe try make outbound connections don't work.

It seems that by specifying a specific service the rules no longer match anything.
Changing the firewall rules back to 'any service' allows the rules to match; but obviously this is now way too broad a rule, and will apply to any service hosted by svchost.exe

The same is true for services hosted by lsass.exe

I believe this also applies to the default rules created on WFN installation.

As a side note/question:
I found these rules buried in the code for InstallHelper. What is the purpose of having default rules in code here?

DNS Server Role (dns.exe) and Combining Rules - Windows Server 2016

This is a great program and helps me secure my network by addressing some shortcomings of Windows Firewall (not logging/notifying outbound connections) but there are some issues.

Summary

1. It seems because the DNS role has around 6330 connections, it causes the GUI to hang.
2. Combining rules makes WFN think WF blocked an outbound connection, like instead of having separate rules for allowing HTTP/HTTPS for a program, you'd put them in one. When they are separate WFN doesn't say anything (expected) but if they are not separate; WFN will say WF blocked it when it was not blocked.

Possible Resolution

• For the first one, I think it shouldn't even be included since it's not applicable since it doesn't really make sense for a server to block its own DNS
• I'm not really sure about the second one

WFN cant remember system/svchost

Versions

WFN:     2.0.6636.29380
Win10
Version: 1803
Build:   17134.407

WFN keeps opening notifications for system/svchost (only appears to be happening when my VPN is enabled).

Native Windows notifications

Like this

Not sure how "advanced rule setting" would be implemented tho...

WFN.exe won't start.

I get an error box saying 'The type initializer for 'Wokhan.WindowsFirewallNotifier.Common.Helpers.LogHelper' threw an exception.' Closing it gives me a 'has stopped working' box.

It had been working fine until I ran DisableWFN.cmd to deal with another issue I was having, and I tried to start it again afterwords.

[feature request] option to start (minimized) with OS boot

It would be good if there was an option that WFN would start/autorun (minimized to the tray) upon OS boot (login)

WFN Firewall Rule Removal Resets Sorting

Nothing critical just a suggestion:

When I sort the list of rules, (e.g. by its path), and then delete a rule, the list reloads with sorting reset instead of keeping it.

[Alert dialog | Advanced Rule Settings] implement LAN toggle for target destination

While using a VPN I have seen alerts in 'PrivateFirewall' for outgoing netBIOS traffic on port 137 to public IP addresses. At the same time, I have seen WFN alert on traffic to local addresses as shown in the picture below. But the alert dialog only allows you to create rules which target port, protocol or single IP address -- it appears that you cannot create rules for a zone (such as LAN or WAN). Since the home network is trusted, I want to allow outbound SMB/netBIOS traffic to anything on the LAN -- I do not want to explicitly authorize every IP in the LAN. Will enabling the "Profile: Private" toggle accomplish this?

im sorry to ask this but how to uninstall...

hello,

ok im not trolling... i tryed the program yesterday, and i have many many notifications to allow without knowing what are they: for example: bonjour, system etc... and even if i allow them they come back later with an other notification. so maybe my actions are not validated.

anyway, how can i uninstall it since there is no installation process, so i wonder how to do?
should i just clic "disable" in the firewall settings?

thx

notifier.exe crashing

crashes every time without running as admin manually.
anytime a connection invokes, it crashes with System.UnauthorizedAccess

started happening after updating, not exactly sure which version from, believe it was the last one on codeplex before the migration announcement, updated to latest beta 1 and 2, tried to revert and still the same.

I want binary.

Hi,I'm using WFN and thanks for develop.
Today I want to update WFN and see codeplex.
There is "move to github".(also codeplex shutdown)
In github-WFN I can't find out binary.
Perhaps compiling from source require Visual Studio.
It is high wall for me. (only user)
I heard this feature https://help.github.com/articles/about-releases/
It sounds good.isn't it?

What happens if I close WFN, will it keep blocking?

I find it very strange compared to tinywall, where the blocking by .exe is pretty simple by simply finding the path and setting to block. WFN instead must wait for a request, and consumes more RAM.

Installer and Portable mode

This issue is to discuss the need for an installer for releases, and the addition of a "portable mode" to complement this.

Installer

@AtlasHackert:

Preferably an .msi, so that WFN can be pushed onto machines in a domain. However, I have no experience with this, and it seems quite complicated; that's why I haven't tried it yet.

Domain/IT friendliness sounds like a goal here. Visual Studio 2017 currently has an extension for creating installer projects, which I think is what we're looking for. Here is apparently a modern article from Microsoft on deploying applications. Our options appear to be:

1. Publish a Windows app
2. Deploy with ClickOnce (may be useful for domains/orgs)
3. Create an MSI-based WiX installer (probably what we're looking for)

Portable mode

While on the subject of installing, users may desire to continue using WFN as it currently operates; in a self-contained, portable mode. It should keep (most) of its file operations restricted to its own running directory at the time. In normal (non-portable) mode, WFN is installed to the Program Files directory, and under Windows rules no further writing will occur within that directory. Since WFN supports Vista or higher, it may be worthwhile to reference this Microsoft Developer blog post for guidance on which files should go where.

Alert Notification Popup Should Resolve IP Address To Hostname (DNS Record)

Hi, I'd like to propose a minor enhancement to the alert notification popup. In the "ADVANCED RULE SETTINGS" section of the popup, it'd be nice if the "TARGET" IP address resolved to a hostname as well. This would save the effort of having to look up the destination IP via traceroute or a reverse IP lookup on the web. Thanks.

Cannot delete multiple rules in one action

Right now it seems you can only delete one rule at a time. Want to select multiple rules and batch delete.

ALLOW TEMPORARILY Button Causes Notifier Alert To Pop Up Again

As stated in the title, clicking the ALLOW TEMPORARILY option for a program causes an IDENTICAL pop-up to be generated again. Clicking the ALLOW TEMPORARILY button a second time causes the alerts to stop. In the System Tray, two shield icons then appear for the rule.

However, if the SKIP option is chosen the second time the alert appears, only one temporary rule (shield icon) is created in the System Tray. The program that was allowed is able to access the internet properly.

In other words, each temporary allow alert shows up twice, though only ONE is required for the requesting program to work correctly.

Mode where outgoing connections are allowed permanently on a binary basis

Right now, when I enable blocking and prompting for outgoing connections, I get a notification for every single connection something makes which makes it absolutely unusable (think torrent clients).
I am wondering if it is possible to only ask once for a binary and than allow all outgoing connections (which is what I would presume most people would want).
I notice that there are advanced options when allowing something, if that is where to do this, I am wondering how I can set the defaults so I dont have to micro-manage so much.
Thanks!

Feature Request: Automatic "Block Silently" with temporary "Block & Prompt"

This feature request is in extension to my earlier Issue about Notifier.exe Death Battles (I don't know how to link to it, but here's the url: #28 )

When WFN 'Firewall Settings' is in "Block & Prompt" mode, the Windows Task Scheduler will launch Notifier.exe for each connection attempt, to determine whether a user prompt is necessary. When the setting is in "Block Silently" mode, then WFN's Notifier is not launched and no CPU resources are utilized.

I find that 99% of the time, I am quite contented to leave WFN in this latter mode, to silently block all connection attempts that are not already approved. It's only when I install a new piece of software that I will proactively switch WFN to "Block & Prompt" briefly so that I can receive notification of the requested connection(s). Once I have sorted out which connections are needed to make the software work, I switch WFN back to "Block Silently" for the next long while.

The problem here is that I have to manually tick six radio buttons from "Block Silently" to "Block & Prompt", then tick the six radio buttons to set it back to "Block Silently" again. I would like to request two things:

1: Make these six clicks simplified to a 1 click minimalist solution. I believe most people maintain only a single set of firewall rules, applicable across whichever profile(s) they incidentally use. So, apply rules to all 3 profiles in unity by default, for least amount of confusion. And also monitor requests for both Inbound and Outbound connections in tandem, with the same one click.

2: Make this a temporary / momentary feature that is quickly accessible from a right-click systray icon menu, rather than GUI navigation. Enabling "Block & Prompt" for only as long as necessary until it times out and switches back to "Block Silently."

Connections from WSL are not detected

When connecting to an SSH session from the Windows Subsystem for Linux, I get the error ssh: connect to host aaa.bbb.ccc.ddd port xx: Permission denied with no notification to let me know there has been a request and no entry in the security log.

This may be a result of how WSL is implemented, since it's part of the kernel, but you'd think if it can be blocked by the Windows Firewall it'd show up as something.

"FIREWALL SETTINGS" Screen Does Not Update Even After Clicking "RELOAD" In Certain Situations

I stumbled across a minor (perhaps even trivial) issue in the interface. It's probably too unimportant to address considering the limited time that the developers have and the priority given to other much-needed features, but I thought I'd post it here anyway. Here are the steps to reproduce the problem:

1. Open the FIREWALL SETTINGS screen in WFN. Assume that the notifier has been activated earlier by choosing the BLOCK AND PROMPT option for outbound connections.

2. Open the Windows Firewall control panel applet and click on ADVANCED SETTINGS. In the new window that opens, click ACTION > PROPERTIES. Set the OUTBOUND CONNECTIONS of all three profiles (Domain, Private, and Public) to ALLOW (DEFAULT). Now click OK.

3. Immediately open the properties window you just closed by clicking ACTION > PROPERTIES. This time though, go to the PRIVATE PROFILE tab and set its OUTBOUND CONNECTIONS to BLOCK. Do not change the settings of the other tabs. Click OK.

4. Switch back to the FIREWALL SETTINGS screen in WFN. Click RELOAD at the top. The radio buttons in the OUTBOUND remain unchanged, instead of being updated to the new settings that were specified in the properties page of Step 3. They continue to remain unchanged even after restarting WFN.

Incidentally, If you had switched back to WFN's FIREWALL SETTINGS screen immediately after STEP 3 and clicked the RELOAD button, the settings would automatically have been updated to reflect the changes made through the Control Panel.

In short, changing the settings via Control Panel twice consecutively seems to break WFN's ability to update its own settings page, even after restarting the program.

WFNV20BETA3 is automatically creating rules.

When I set up "Block and prompt", WFNV20BETA3 is automatically creating outgoing rules.
1 Custom Rule - Serviço de transferência inteligente de tela de fundo(auto) [R:80,443]
2 Custom Rule - Serviços de criptografia(auto) [R:80]
3 Custom Rule - Windows Applications (auto)
4 Custom Rule - Windows Update (auto) [R:80,443]

Temporary Rule stays onscreen until it is dismissed

Temporary Rule stays onscreen until it is dismissed using the Tray-Icon,
because of that other firewall notifications do not pop up.

Example: Some Setup:
setup.exe - wants to access network => temporary rule
loads another setup (e.g. some framework) - wants to access network => no notification as other notification still on top