Windows – the risk in turning off Base Filtering System on Windows Server…

filteringservicewindows

Let me qualify that I am a developer so I may be naive. I have a program that requires TCP communication on our local network and the box does not need to be secure. I have had some API vendors in the past recommend that I shut off the BFE Service as it is unnecessary in our aforementioned case. Nevertheless, our admin is concerned with the risks. What are the risks of having it on or off? I need reliable TCP. I do not trust BFE and Windows Firewall.

Best Answer

The risks in turning it off are:

  • Windows Firewall cannot operate
  • Unpredictable behavior and event logging from other components and applications that may assume that Windows Filtering Platform is operating normally.
  • No IPsec

A prime example of "other components and apps" that use/need the WFP in various ways would be antivirus. But I'll hazard a guess that you aren't using AV either. :)

Can you technically run without it? Yes. Can it improve network performance in certain scenarios? Yes. Is it generally recommended to turn it off? No.

You're trading off security and functionality for less processing overhead.

Read more about it here: http://msdn.microsoft.com/en-us/library/windows/desktop/aa363967(v=vs.85).aspx

Edit: Stealing this graphic from MSDN because it's cool:

Windows Filtering Platform

Related Topic