Firewall blocking local ip's and link-local addresses

[exmfe]

Hi,

I am hoping someone here can help me as official support channels haven't been of any help so far.

I am using MTP on 3 PC's (Vista, W7, XP - all 32 bit and all fully updated) which are connected along with other devices on a wired and wireless LAN via a router.

I have noticed that there are addresses in the local network range and link-local addresses which are regularly and frequently (approx every 15 mins) showing up in the incoming event firewall log.

The most frequent addresses and events  are 191.168.0.1  SSDP 169.254.235.174 SSDP but there are others.

191.168.0.1 is the router.

The full lan address range is already included in the "My Network Connections" range (192.168.0.0 - 192.168.0.255)

I can see the router and the other PC's in explorer and in the device list in Home Network screen of MTP.

I have checked the logs in the Program Data folder and I can see several local addresses which are apparently being blocked e.g.

02/26/2012 11:23:15 AM$ -- (Information)$ [ mpfsvc.dll]$ >>> Packet blocked: 192.168.0.196(445)-192.168.0.170(7946) TCP process(0):[] reason:MPFP_RULE_MADE_DECISION_BY_UNSOLICITED_DATA:MFEID_BLOCK_UNKNOWN_APP_RULE | MFEID_POLICY_APPLICATION | MFEID_BLOCK_UNKNOWN_APP_RULE | MFEID_POLICY_IDS | {145CE739-CB40-494A-A12A-B71B88CADAB5} | {0D34D750-EB5E-4B0C-A1AC-0761D6F4DFB7} | {CD42F984-081E-40C2-92AD-C4A8307B13FB}

Any idea why these local addresses are being blocked?

Also, I am not able to connect to a local video webserver on one of these PC's even if I explicitly specify the port (8570) in "Firewall Ports and System Services". The device (an iPad) in the LAN which attempts to connect (+port) can be seen in the incoming event log.

Any idea what's going on?

Thanks.

[exmfe]

Here are more suspicious items in the log (my highlights)...

02/26/2012 02:58:42 PM$ -- (Information)$ [     mpfsvc.dll]$ >>> Packet blocked: 192.168.0.1(1900)-239.255.255.250(1900) UDP process(1520):[C:\WINDOWS\SYSTEM32\SVCHOST.EXE] reason:MPFP_RULE_MADE_DECISION_BY_PORT_RULE:System Ports Rule: Universal Plug and Play (UPNP) Port 5000,1900,2869 (tcp=5000,2869, udp=1900, enabled=1, standard=1) | App Rule: C:\WINDOWS\SYSTEM32\SVCHOST.EXE ([FULL]) | System Ports Rule: Universal Plug and Play (UPNP) Port 5000,1900,2869 (tcp=5000,2869, udp=1900, enabled=1, standard=1) | MFEID_POLICY_IDS | {145CE739-CB40-494A-A12A-B71B88CADAB5} | {0D34D750-EB5E-4B0C-A1AC-0761D6F4DFB7} | {4AD91FA5-FB02-41AF-BFF3-04E372ED4954}
02/26/2012 03:08:26 PM$ -- (Information)$ [   McSvHost.exe]$ Problem reported to MSC: 0
02/26/2012 03:13:28 PM$ -- (Information)$ [     mpfsvc.dll]$ >>> Packet blocked: 169.254.135.174(1900)-239.255.255.250(1900) UDP process(1520):[C:\WINDOWS\SYSTEM32\SVCHOST.EXE] reason:MPFP_RULE_MADE_DECISION_BY_PORT_RULE:System Ports Rule: Universal Plug and Play (UPNP) Port 5000,1900,2869 (tcp=5000,2869, udp=1900, enabled=1, standard=1) | App Rule: C:\WINDOWS\SYSTEM32\SVCHOST.EXE ([FULL]) | System Ports Rule: Universal Plug and Play (UPNP) Port 5000,1900,2869 (tcp=5000,2869, udp=1900, enabled=1, standard=1) | MFEID_POLICY_IDS | {145CE739-CB40-494A-A12A-B71B88CADAB5} | {0D34D750-EB5E-4B0C-A1AC-0761D6F4DFB7} | {4AD91FA5-FB02-41AF-BFF3-04E372ED4954}

[exbrit]

OK, your Inbound Events log is merely there for your information as all of them are blocked, so there's no need to worry about them.  We all have hundreds of entries in there.  As far as why a local IP in your own network (your router perhaps?) is blocked, perhaps it isn't entered properly in your firewall permssions.

Open SecurityCenter then click Web and Email Protection, then Firewall, then My Network Connections.  In there should be the IP range of your router (or modem if connected directly).  Add it if it isn't. An example is shown:

Message was edited by: Ex_Brit on 26/02/12 9:48:45 EST AM

[exmfe]

Hi Ex-Brit,

Thanks for the response. I do know the purpose of the inbound event log; The addresses I am flagging are LAN addresses and should not be blocked. As per my first post the lan address range is already specified in My Network Connections so this doesn't explain why these addresses are being blocked.

[exbrit]

Maybe they are trying to access ports that are restricted normally.   That could happen if spyware was onboard or if some software works in an unconventional manner, but that may not be the case.   Your best bet for a good answer on this would be to open a case with Technical Support linked under Useful Links at the top of the page.  It's a free phone call or you can use online chat.

[exmfe]

Hi Ex-Brit,

As you can see in the logs the ports are standard system ports which are predefined and enabled in  "Firewall Ports and System Services" e.g 1900.

I have tried tech support twice so far (chat and telephone) but unfortunately it was a frustrating waste of time.  I will try again with email support this time.

Is there any way I can request Tier 2 support via email?

Thanks for your help.

[exmfe]

Ok I have requested Tier 2 support in my tech support email.

Let's see what happens.

I'll report back in case the info might helps others.

Thanks again.

[exbrit]

I will also flag this thread internally in the hope a firewall expert can help.

[Dinz]

Hi there,

I see that you have contacted our Tier 2 support personnel’s on this issue , let me make sure that this is elevated to the correct team. In the meantime, could you please let me know;

If these instances are reported recently after a McAfee update or well before ?

Do have any devices connected to your network that accesses internet like a secondary PC, laptop etc ,. . .

Regards,

[exmfe]

Hi Dinesh,

I really don't know when these issues first started - I only recently checked the incoming event logs and noticed the lan addresses.

According to the About screen the versions are:

MSC - 11.0.654

MVS - 15.0.294 28/2/2012

Dat version 6633 27/22012

MPF - 12.0.345 21/11/2011

MPC - 13.0.319 22/12/2011 (not enabled)

I have automatic updates on.

I don't have any other modules enabled.

As per my original post there are several other devices on the lan including 2 PCs and several Apple iOS devices.

Thanks.