Using the Firewall to Stop all Network Communications

[mlajoie]

 A request was made of me to see if we could use the firewall to stop a machine from communicating to the network.  

My initial thought  was to take all of our subnets and set them as "not trusted".

My second thought was to use domain blocking and block anything to our domain name.

My third thought was to both of the above.

Is there a better way or another way I haven't thought of?

I know that once this is applied, we have to physically go to the machine to get it remediated but that is of less concern

[mmuthuga]

You can try below two steps to block most of the communication for the machine.

A block all firewall rule placed at top most position in firewall rule set. Select direction as  either, "Any protocol" for network protocol, "All protocols" for transport protocol, do not specify any network and executable in the rule to create the block all rule.

Select "Disable McAfee core networking rules" option.

[mlajoie]

Duh. The block all rule -- should've thought of that. That part is working splendidly.

Unfortunately, checking the box had no effect on some of the mcafee networking rules. It is still communicating with ePO. I'm OK with that but I'm afraid my customer wants a total blackout on communications - when the need arises.

Anything else you can think of?

[ktankink · Accepted solution]

---

@mlajoie wrote:
I'm OK with that but I'm afraid my customer wants a total blackout on communications - when the need arises.

---

Hi @mlajoie, this is not possible in ENS Firewall.  Even if you have a BLOCK ALL rule in your ruleset (which is not needed since the ENS Firewall includes a hard-coded, default BLOCK ALL TRAFFIC rule at the bottom of the ruleset) and enable the "Disable McAfee Core Networking" option, there will still be a few Firewall rules that are not disabled and will allow traffic.

Ref KB91206, Section "After I enable the "Disable McAfee core networking rules" feature, why are all the firewall rules inside the McAfee core networking group not disabled?" and "Which McAfee core networking firewall rules are not disabled when I enable the "Disable McAfee core networking rules" feature?").