Router Rules.

[Swistheater]

Okay i have a specific port, tcp Protocol , that isn't required to be open, but it keeps opening for a specific device on my network that is connected via Ethernet cable . Is there away I can create a Firewall rule that would keep that port from opening to that specific device on the router? if so what would that rule look like.

 

[Swistheater]

 

[ColinTaylor]

Best to disable the service rather than block it on the router.

https://www.groovypost.com/howto/groovytip/what-is-wmpnetwk-exe-virusand-is-it-running/

 

[Swistheater]

i actually use the service but not in a way it should be making outbound ports like this. one option i have tried was changing upnp connections to start at 10246, but that causes issues with other devices that i use that use a lower port.

 

[ColinTaylor]

Can you temporarily stop that service to confirm that that is the source of the issue, and it's not some virus masquerading as it?

You could turn off UPnP entirely, but that would effect everything on your network. Alternatively you could use the Network Services Filter to block outgoing traffic from that device.

 

[martinr]

The port isn’t open WAN-side is it?

wmpnetwk.exe is Windows Media Player network sharing service, according to Google. Have you considered disabling the service?

“The process wmpnetwk.exe is a non-threatening service created by Microsoft to enable media sharing in Windows Media Player or Media Center. If you do not use Windows Media Sharing you should disable this service since it runs 24/7 and uses a decent amount of system resources. As a result, disabling this service should improve your system performance.”

 

[Swistheater]

Can you temporarily stop that service to confirm that that is the source of the issue, and it's not some virus masquerading as it?

You could turn off UPnP entirely, but that would effect everything on your network. Alternatively you could use the Network Services Filter to block outgoing traffic from that device.

I have turned the service off and the upnp port goes away and i have scanned my services to make sure none have been hijacked as well. I have tried adjusting the upnp port number to 1 number past that and it disables this service from making connection.

 

[Swistheater]

all my devices have this featured turned on that run windows, but this is the only computer that actually establishes that type of connection.

 

[martinr]

So it is an outbound port. Here’s how to disable the service as Colin suggested:

https://www.groovypost.com/howto/groovytip/what-is-wmpnetwk-exe-virusand-is-it-running/

Perhaps that will help you see if it’s a genuine wmpnetwrk.exe. On the face of it it shouldn’t need to communicate beyond the LAN?

 

[Swistheater]

i don't believe it is out bound because i turned on network service filter and it still appears as a connection on the list.

 

[ColinTaylor]

OK I think I've found it..... This post gave us the clue that it's caused by "Allow Internet access to home media".

So that needs to be turned off? Here's the relevant options:

 

[Swistheater]

that did the trick