I've been a longtime user of Norton Internet Security (2014 and earlier) and just upgraded to Norton Security 2015 (version 22.1.0.9 on the "About" tab). While looking over the firewall traffic rules (which seem to have changed somewhat compared to NIS 2014), I noticed a few rules labelled as related to Windows Media Player and Microsoft Remote Assistance that seem quite odd.
Specifically, they seem to be defined to allow inbound connections from any computer on any network, to any TCP or UDP port. And, they don't appear to be overridden by other rules further up in the priority list. This is quite puzzling, because (to me) it seems reasonable to have rules that allow any network but specific ports only, or all ports but specific networks only, but not any network and any port. (Because this basically defeats the entire purpose of having a firewall in the first place!)
The rules are:
- Default Allow Microsoft Remote Assistance (Private Networks) -- Allow, Direction: Inbound, Computer: Any, Communications: Any, Protocol: TCP
- Default Allow Windows Media Player Sharing (Private Networks) -- Allow, Direction: Inbound, Computer: Any, Communications: Any, Protocol: TCP and UDP
- Default Allow Windows Media Player (Private Networks) -- Allow, Direction: Inbound, Computer: Any, Communications: Any, Protocol: UDP
The characteristics I've highlighted are what's concerning me. (I verified by browsing the rule details that these rules are indeed set to allow incoming connections from any computer, on any port.) All these rules are check-boxed as "active" and are read-only, meaning they can't be edited.
I haven't tried probing through the firewall to verify that these rules are actually allowing traffic, but in any case, just seeing them in the firewall rules list causes me to wonder what's going on.
I attached a screen capture showing the firewall traffic rules tab, scrolled to a couple of the rules in question. (This is under Settings->Firewall.)
Am I just reading the wrong somehow? I've configured firewalls for many years (including on NIS 2014 and earlier) and the way this is being shown in NS 2015 is making no sense to me.