Solved When did the Windows Firewall start blocking incoming pings?

I have noticed that lately, for about the last 6–8 weeks, Windows has been acting strangely.

I would install the Microsoft-provided (Settings → System → Optional features → View or edit optional features) OpenSSH server. I would set up config files and authorized keys in %ProgramData%\ssh and make sure that the OpenSSH server service starts automatically and is started. For a little bit I could connect to it from my Mac with ssh. I would install UltraVNC, set an 8-character password, and would be able to connect to that, as well. I would tweak the advanced Windows Firewall settings for incoming connection requests, so that connections to Port 5900 (the port VNC servers listen on) are blocked. This prevents the weak password from getting exploited, but tunneling the connection through an SSH connection prevents the VNC traffic from being eavesdropped on. The UltraVNC server sees the incoming VNC connection coming out of the ssh tunnel as originating from localhost, which is why the WindowsFirewall doesn’t touch it. This would work, but not for long. Literally minutes later, my ssh and VNC connections would get refused.

As of today I think I know why. A recent Windows update appears to block all incoming connections, including pings. This is the case, even when the network type is set to Private. I have to put in an explicit rule for allowing ping’s ICMP connections through.

Would something similar have taken effect for all other connections, including my ssh and VNC connection attempts? I am confused. I still find the public/private dichotomy somewhat confusing, but have gotten pretty well used to it.

When did the Windows Firewall start blocking incoming pings? Windows XP Service Pack 2.

View attachment 148122

Yeah, it's ridiculous. All other operating systems and devices (besides ones running Windows) ubiquitously respond to pings.

Techie007 said:

All other operating systems and devices (besides ones running Windows) ubiquitously respond to pings.

Click to expand...

Not true as in most routers firewall the default setting is to block it.
So even if Windows did not block ICMP the router already has.

I actually like that fact windows doesn't respond to pings, now that I'm retired and no longer have to tear my hair out trying to keep people's networks running.... Just because someone comes knocking (so to speak) doesn't mean you have to let them in, or even answer the door.

DJNelson said:

I actually like that fact windows doesn't respond to pings, now that I'm retired and no longer have to tear my hair out trying to keep people's networks running.... Just because someone comes knocking (so to speak) doesn't mean you have to let them in, or even answer the door.

Click to expand...

Me running ping broadcast and arp request flood on our office network:

KevTech said:

Not true as in most routers firewall the default setting is to block it.
So even if Windows did not block ICMP the router already has.

View attachment 153556

Click to expand...

That's the router's personal firewall setting for its public (WAN) port, and it is disabled for security—that one makes sense. This has nothing to do with the router "blocking ICMP"—it wouldn't know where to route incoming ICMP packets from WAN to specific devices on the LAN regardless (unless you enabled DMZ to a specific device on your LAN). But the router still responds to pings at its private (LAN) IP, as do all non-Windows devices on the LAN. In fact, I betcha it lacks a setting to even turn that behavior off. ICMP pings are a great tool for checking the quality of local connectivity between devices and the router (or each other) on the LAN, and between clients/servers/hops on the Internet. If you're not running a public server at your public IP, it doesn't make sense to have your router respond to pings on the WAN, hence the setting you pictured. But my original statement stands that Windows not responding to ICMP ping is a huge anomaly among devices.