After reading the many threads concerning problems with using Gnutella programs (including various versions of LimeWire ) under Windows XP, I realized that I wasn't the only one suffering from crippled downloaads and uploads due to the built-in Windows XP personal firewall. As I failed to find any simple explanation of what to do about it, I wrote out the procedure for "fixing" the firewall for Gnutella and posted it here: http://home.cfl.rr.com/jabirket/dsb/firewall.html
Criticism is welcome. Copy freely.

Interesting read.... thanks for sharing this will us. This should be a must read for anyone with a software firewall.

Your procedure seems to be valid to me. Would be nice to see a propeller-head (which I am not) comment here to validate your explanation, or add to it.

I applied your procedure and it works as stated. For my XP, I initially had simply disabled the MS default Firewall to get LW to work, which worked. But I like your method much better. I also got OverNet (new incarnation of Edonkey2000) to work using a similar procedure.

Question: In the very last paragraph you said we should see a 'distinct improvement'.... Why would we see an improvement? Isn't all this really just about minimizing our internet exposure?

Thanks again. Great document.

John

The improvement I mention is relative to using a servient behind an active XP (or other) firewall in its default configuration. You are corrrect that the advantage of using a Gnutella-friendly firewall over running naked (with no firewall) is security.

Assuming my understanding of the Gnutella protocol is correct (I'm a software engineer, but don't work in this field), it works like this:

From behind a firewall...

You can initiate outgoing connections to participate in the network, but can't accept incoming connections from others wishing to join the net. It is also impossible for you to accept Leaf connections as an UltraPeer.

You can initiate outgoing connections to download files from some sources, but will not succeed in downloading files from servients that are also behind a firewall. This is because neither servient is able to accept a connection from the other for the direct transfer of the file. (Files are not sent through the Gnutella net.)

You can satisfy some upload requests, but only from servients who send "push" requests (via the Gnutella net) and who are not themselves behind a firewall. Again, if both machines have firewalls, you can't connect to transfer files.

Having incoming connections to port 6346 blocked by a firewall is a little like living in an apartment with a broken doorbell.

Imagine that you are a Gnutella program living in apartment 6346 of a PC out there in cyberspace. You can open your door and pass data through the door (in or out) anytime you like - as long as its your idea to open the door. But when the HTTP delivery guy rings your doorbell to deliver that new file you requested, you don't hear the doorbell ring, so he gives up and goes away.

Opening port 6346 on the firewall fixes the doorbell.