You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
At startup, I'm now seeing a handful of "Blocked Bypass Attempt" warnings (along with Windows notifications for each) from a similar list of applications each time:
These all come in together, and as far as I'm aware none of these applications actually make these requests. (Well, who can say with Edge, but Joplin and OBS certainly look suspicious.)
I've had the block-bypass setting enabled for a while, but this only started maybe a week or two ago?
The network logs for those applications do not show any attempts to make DNS requests, blocked or otherwise (no sign of requests labeled "DNS request", nor requests targeting any well-known or system-configured DNS servers).
What did you expect to happen?:
These warnings not to appear, or if they're legitimate blocks then the requests to appear in the log.
How did you reproduce it?:
Enable Settings > Advanced > Block Bypassing
Reboot
Debug Information:
Version 1.4.5
Portmaster
version 1.4.5
commit tags/v1.4.5-0-g75e5a2671bf6b8103f28f4d377d937b6b9a219b0
built with go1.20 (gc) windows/amd64
using options
by user@docker
on 28.08.2023
Licensed under the AGPLv3 license.
The source code is available here: https://github.com/safing/portmaster
Platform: Microsoft Windows 10 Pro 10.0.19045 Build 19045
System: Microsoft Windows 10 Pro windows (Standalone Workstation) 10.0.19045 Build 19045
Kernel: 10.0.19045 Build 19045 x86_64
No Module ErrorUnexpected Logs
230914 18:38:22.129 nameserver:174 > WARN 073 nameserver: external request from [fe80::1%Wi-Fi]:49507 for settings-win.data.microsoft.com.AAAA, ignoring
230914 18:38:22.209 nameserver:174 > WARN 075 nameserver: external request from [fe80::1%Wi-Fi]:60200 for client.wns.windows.com.A, ignoring
230914 18:38:22.209 nameserver:174 > WARN 077 nameserver: external request from [fe80::1%Wi-Fi]:59727 for client.wns.windows.com.AAAA, ignoring
230914 18:38:24.201 nameserver:174 > WARN 079 nameserver: external request from [fe80::1%Wi-Fi]:57404 for settings-win.data.microsoft.com.A, ignoring
230914 18:38:24.201 nameserver:174 > WARN 081 nameserver: external request from [fe80::1%Wi-Fi]:50306 for settings-win.data.microsoft.com.AAAA, ignoring
230914 18:38:26.286 nameserver:174 > WARN 085 nameserver: external request from [fe80::1%Wi-Fi]:55869 for settings-win.data.microsoft.com.A, ignoring
230914 18:38:26.287 nameserver:174 > WARN 087 nameserver: external request from [fe80::1%Wi-Fi]:61802 for settings-win.data.microsoft.com.AAAA, ignoring
230914 18:38:28.363 nameserver:174 > WARN 089 nameserver: external request from [fe80::1%Wi-Fi]:65005 for settings-win.data.microsoft.com.A, ignoring
230914 18:38:28.363 nameserver:174 > WARN 091 nameserver: external request from [fe80::1%Wi-Fi]:53367 for settings-win.data.microsoft.com.AAAA, ignoring
230914 18:38:29.262 CURRENT TIME
Network: 5/5 [~0] Connections
ProfileName: Joplin
Profile: 08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
Source: local
ProcessName: Joplin.exe
BinaryPath: C:\Program Files\Joplin\Joplin.exe
CmdLine: "C:\Program Files\Joplin\Joplin.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\User\AppData\Roaming\Joplin" --mojo-platform-channel-handle=2040 --field-trial-handle=1672,i,17495583646412402520,3067525392680003551,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
PID: 6840
accepted 127.0.0.1:61570 TCP> 127.0.0.1:3000 18:36:12- P#6840 [M] allowed by rule: IP matches 127.0.0.1 - by filter/endpoints @ core:profiles/local/08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
accepted 127.0.0.1:61571 TCP> 127.0.0.1:3000 18:36:13- P#6840 [M] allowed by rule: IP matches 127.0.0.1 - by filter/endpoints @ core:profiles/local/08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
ProfileName: Joplin
Profile: 08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
Source: local
ProcessName: Joplin.exe
BinaryPath: C:\Program Files\Joplin\Joplin.exe
CmdLine: "C:\Program Files\Joplin\Joplin.exe" --type=renderer --user-data-dir="C:\Users\User\AppData\Roaming\Joplin" --app-path="C:\Program Files\Joplin\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=758842520592 --mojo-platform-channel-handle=2284 --field-trial-handle=1672,i,17495583646412402520,3067525392680003551,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
PID: 14368
accepted 127.0.0.1:61557 TCP> 127.0.0.1:41184 18:36:08-18:36:14 P#14368 [M] allowed by rule: IP matches 127.0.0.1 - by filter/endpoints @ core:profiles/local/08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
ProfileName: Joplin
Profile: 08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
Source: local
ProcessName: Joplin.exe
BinaryPath: C:\Program Files\Joplin\Joplin.exe
CmdLine: "C:\Program Files\Joplin\Joplin.exe" --type=renderer --user-data-dir="C:\Users\User\AppData\Roaming\Joplin" --app-path="C:\Program Files\Joplin\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=758852097124 --mojo-platform-channel-handle=2924 --field-trial-handle=1672,i,17495583646412402520,3067525392680003551,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
PID: 23620
accepted 127.0.0.1:3000 TCP> 127.0.0.1:61570 18:36:12- P#23620 [M] allowed by rule: IP matches 127.0.0.1 - by filter/endpoints @ core:profiles/local/08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
accepted 127.0.0.1:3000 TCP> 127.0.0.1:61571 18:36:13- P#23620 [M] allowed by rule: IP matches 127.0.0.1 - by filter/endpoints @ core:profiles/local/08b87d24-09ef-44d1-8de3-4b0f0c4c13fe
Status: Trusted
ActiveSecurityLevel: Trusted
SelectedSecurityLevel: Off
ThreatMitigationLevel: Trusted
CaptivePortal:
OnlineStatus: Online
DatagramV4Callout Callout This callout is used to handle datagram data for IPv4. {a6be3096-66bf-4959-8629-1c3a4c40c31e} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V4
DatagramV4Filter Filter The filter is used for handling datagram data for IPv4. {5a802178-a983-4187-b760-1cc4bd843a61} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V4 {a87fb472-fc68-4805-8559-c6ae774773e0}
DatagramV6Callout Callout This callout is used to handle datagram data for IPv6. {d55cb395-29a1-4716-8cb1-65c888995f54} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V6
DatagramV6Filter Filter The filter is used for handling datagram data for IPv6. {5bea22f3-2dc8-4cf2-977c-33f70b7b7716} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V6 {a87fb472-fc68-4805-8559-c6ae774773e0}
Edge traversal Teredo Authorization Sublayer SubLayer Edge traversal Teredo Authorization Sublayer {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}
IPxlat Forward IPv4 filter Callout Filters forwarded IPv4 packets into synthetic IPv6 packets {b255c296-7e0c-4115-95f3-b7f24a8a1162} [no provider key] FWPM_LAYER_IPFORWARD_V4
IPxlat Forward IPv4 sub layer SubLayer Sub layer for filtering forwarded IPv4 packets into synthetic IPv6 packets {4351e497-5d8b-46bc-86d9-abccdb868d6d}
IPxlat Inbound IPv6 filter Callout Filters incoming IPv6 packets into synthetic IPv4 packets {93bb703d-0502-42e2-8e30-a14576e5085d} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V6
IPxlat Inbound IPv6 sub layer SubLayer Sub layer for filtering incoming IPv6 packets into synthetic IPv4 packets {dfb035ca-c2a7-4684-97b6-4dbc57c63590}
IPxlat Outbound IPv4 filter Callout Filters outgoing IPv4 packets into synthetic IPv6 packets {66d52657-1979-4e58-b3f7-4756434c4880} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V4
IPxlat Outbound IPv4 sub layer SubLayer Sub layer for filtering outgoing IPv4 packets into synthetic IPv6 packets {d3e70856-fc90-4c0a-b9b2-a6f73e20b5cc}
PortmasterALEInboundV4Callout Callout This callout is used by the Portmaster to monitor outbound IPv4 traffic before the connection is established. {e36216c5-7b33-40ee-b054-fb1bc7decc19} [no provider key] FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4
PortmasterALEInboundV4Filter Filter This filter is used by the Portmaster to monitor inbound IPv4 traffic before the connection is established. {439861f5-416e-45e4-afa2-970305407319} [no provider key] FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterALEInboundV6Callout Callout This callout is used by the Portmaster to monitor outbound IPv6 traffic before the connection is established. {77ea9927-66e7-4cf8-9ea2-941edf2fae63} [no provider key] FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6
PortmasterALEInboundV6Filter Filter This filter is used by the Portmaster to monitor inbound IPv6 traffic before the connection is established. {ba3e9fcc-0f1c-4a45-9a03-7326e30e7db7} [no provider key] FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterALEOutboundV4Callout Callout This callout is used by the Portmaster to montiror outbound IPv4 traffic before the connection is established. {029819fe-97d9-4e5f-a0fb-78ef5cef8ac4} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V4
PortmasterALEOutboundV4Filter Filter This filter is used by the Portmaster to monitor outbound IPv4 traffic before the connection is established. {02968fed-c7f5-4a70-b30f-2273f49d485d} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V4 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterALEOutboundV6Callout Callout This callout is used by the Portmaster to monitor outbound IPv6 traffic before the connection is established. {d6b0213a-337a-4cc6-84c0-cc60731b9e2a} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V6
PortmasterALEOutboundV6Filter Filter This filter is used by the Portmaster to monitor outbound IPv6 traffic before the connection is established. {8058c8ea-584e-43f0-85aa-8316a6fda4bc} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V6 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterInboundV4Callout Callout This callout is used by the Portmaster to intercept inbound IPv4 traffic. {05c55149-4732-4857-8d10-f178f3a06f8c} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V4
PortmasterInboundV4Filter Filter This filter is used by the Portmaster to intercept inbound IPv4 traffic. {6bd90df7-63c1-41fa-911c-d23104f9c94c} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V4 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterInboundV6Callout Callout This callout is used by the Portmaster to intercept inbound IPv6 traffic. {ceff1df7-2baa-44c5-a6e5-73a95849bcff} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V6
PortmasterInboundV6Filter Filter This filter is used by the Portmaster to intercept inbound IPv6 traffic. {daf31d79-a6d6-440a-a0f9-5ddd9e42c12f} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V6 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterOutboundV4Callout Callout This callout is used by the Portmaster to intercept outbound IPv4 traffic. {41162b9e-8473-4b88-a5eb-04cf1d276b06} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V4
PortmasterOutboundV4Filter Filter This filter is used by the Portmaster to intercept outbound IPv4 traffic. {b8612e5b-0077-4724-ac97-b9c20e7f4117} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V4 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterOutboundV6Callout Callout This callout is used by the Portmaster to intercept outbound IPv6 traffic. {32bad112-6af4-4109-809b-c07570ba01b4} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V6
PortmasterOutboundV6Filter Filter This filter is used by the Portmaster to intercept outbound IPv6 traffic. {bfc38a7a-c7c2-409b-a53f-2ee3e701a8be} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V6 {a87fb472-fc68-4805-8559-c6ae774773e0}
PortmasterSublayer SubLayer The Portmaster sublayer holds all it's filters. {a87fb472-fc68-4805-8559-c6ae774773e0}
StreamV4Callout Callout This callout is used to handle stream data for IPv4. {525dac52-65de-4a6f-b546-2b1f3bc226db} [no provider key] FWPM_LAYER_STREAM_V4
StreamV4Filter Filter The filter is used for handling stream data for IPv4. {d1a31410-0742-44f4-a19b-5e96905b3eb8} [no provider key] FWPM_LAYER_STREAM_V4 {a87fb472-fc68-4805-8559-c6ae774773e0}
StreamV6Callout Callout This callout is used to handle stream data for IPv6. {4321ddf9-57b2-4391-8fc5-c5b46c655587} [no provider key] FWPM_LAYER_STREAM_V6
StreamV6Filter Filter The filter is used for handling stream data for IPv6. {3289a8c2-2da4-455e-864e-88a5c333caa6} [no provider key] FWPM_LAYER_STREAM_V6 {a87fb472-fc68-4805-8559-c6ae774773e0}
Teredo socket option opt out block filter Filter [no description] {0faa8fbb-a2cb-4bf7-b82f-1ead6f5663d6} {f0c035f4-8397-4fe4-ba4b-07db8507bcc0} FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}
Haven't noticed this happening in a while, but hard to tell as this didn't seem to happen on every boot. Looks like there've been several automatic updates since the report though, so I'll close for now until they reappear.
Pre-Submit Checklist:
What happened:
At startup, I'm now seeing a handful of "Blocked Bypass Attempt" warnings (along with Windows notifications for each) from a similar list of applications each time:
These all come in together, and as far as I'm aware none of these applications actually make these requests. (Well, who can say with Edge, but Joplin and OBS certainly look suspicious.)
I've had the block-bypass setting enabled for a while, but this only started maybe a week or two ago?
The network logs for those applications do not show any attempts to make DNS requests, blocked or otherwise (no sign of requests labeled "DNS request", nor requests targeting any well-known or system-configured DNS servers).
What did you expect to happen?:
These warnings not to appear, or if they're legitimate blocks then the requests to appear in the log.
How did you reproduce it?:
Debug Information:
Version 1.4.5
Platform: Microsoft Windows 10 Pro 10.0.19045 Build 19045
No Module Error
Unexpected Logs
Network: 5/5 [~0] Connections
Status: Trusted
Resolvers: 4/4
Config: 6
Updates: stable (12/30)
Compatibility: WFP State (33)
Goroutine Stack
The text was updated successfully, but these errors were encountered: