Taming the elusive svchost.exe in WindowsXP
Allowing full access rights to svchost.exe can be dangerous, as pretty much any application can use it to contact the outside world. However, it seems that some access is needed for proper functionality of networking and Windows update. This thread is intended to explore what is and is not necessary to be contacted.
I have created the following firewall rules for svchost.exe.
Router/Gateway Connection
------------------------- Allow connection to the local IP address of you router/gateway. Usually default 192.168.0.1
Internet Time Server
------------------------- Allow the Windows clock to update the current time. I use the time.nist.gov server, 192.43.244.18
DNS Lookups
------------------------- The DNS servers of your ISP may need contacting for resolution. Include the primary and secondary DNS servers.
Windows Update
------------------------- Windows update is what really makes the svchost.exe a difficult beast to master. I have somewhat narrowed the IP ranges that Windows Update requires, but still this is a gaping whole. Main problem is Windows Update keeps changing what IPs it uses.
64.4.*.* 65.59.*.* 67.72.*.* 207.46.*.*UPNP
------------------------- Universal Plug and Pray. If you use it, looks like 239.255.255.250 and
255.255.255.255 will need to hear from your machine.Thoughts?
read more and respond »Posted 5 years ago by Joe in Networking Firewalls
