Printable View
Hi Experts,,,
Can you please provide me some short tutorials about configuring different FIREWALLS. If U can help me in providing some short notes on configuring and implementing firewalls. I will be extremely thankful to you all...
I CAN'T READ THOSE BIG MANUALS ........
*******HELP REQUIRED***************
healtheworld--As far as I am concerned, there is no short answer to your question. You have not told us what operating system or browser you use. Plus there are just too many firewalls out there in several versions. And there are hardware and software firewalls for different purposes.
Narrow your question down and maybe someone will help.
However, even then, I personally think you will learn more by first reading a manual or two and then asking questions based on what you do not understand.
You can also do a search on www.google.com
If you are interested in ZoneAlarm Pro, for example, here one tutorial
http://www.solutionsreview.com/ZoneA...ro_Setup_1.htm
And most suppliers of firewalls have their own sites with recommendations for set up, etc.
Question is too broad for a short answer.
So we should read these big manuals for you? Need your dog walked, too?Quote:
I CAN'T READ THOSE BIG MANUALS ........
Sincere Apology ...
That's Not my intention..
Only Looking for some help from Experts
Too much info. to be condensed but you may find these sites useful.
How Firewalls Work
Firewall Forensics
THANKS for providing the info.
i will read it tonight....
a small query...which one is better
a) NORTON Security Center
b)Macfee Firewall
Hi
In answer to your question re: Norton V McAfee ???? I run Norton Internet Security 2003. I have always used Norton thus cannot give a true opinion of McAfee suffice to say that I have used a PC with McAfee and it certainly did not make me want to change my options.
Recently I have researched the various AV's & Firewalls as I am having a new PC built. I was concerned abut the resources ect Norton uses BUT have now made my mind up to continue with NIS.
I had a friend to stay recently & he could not believe just how well my set up ran blocking ads etc & the actual logisitics of my firewall. I did not realise just how many things Norton was doing in the background. If I had changed to some of the other firewalls I would have had to add a lot of separate components to stop ads. amongst other things.
My friend has now bought NIS even though he did not think he would ever use Norton porducts.
It is very much a matter of choice + the set up of your PC. I am not too keen on the way McAfee has most of the tools online etc + have read very mixed reports. That is not to say that I have not read mixed reports about Norton !
I just know that after extensive research I am not happy to install NIS on my new PC.
Hope this helps.
This is not a reply to the question, but a supplementary question since it fits in with the topic.
I'm a new user of Windows XP home. Since I didn't know which firewall to use I've been using Windows Xp's own firewall for about a month.
As a result of the recent MSblaster worm scare I have downloaded the patch and taken a closer look at my firewall settings.
Having double checked that the XP firewall is enabled, by looking at the 'Advanced 'tab of my ISP's Network connections properties, I also looked at what appeared under the 'settings' button . In addition to some things I expected to find, there are many things I did not expect to find in there.
Internet users are given access to services if the check box (or tick box as we call it in the UK) is checked.
I'm particularly concerned to find about 22 tick boxes , (all ticked ) of the type :-
msmsgs 10043 UDP
msmsgs 10298 UDP etc. etc.
What are these ? Is it to do with Microsoft Messenger ? I don't use Microsoft messenger or I didn't think I used Microsoft Messenger. I have Windows Messenger permanently disabled.
Should I be concerned ? should I delete these ? I don't understand .
Please advise me what I should do. Thanks in anticipation.
Hi
I do not use Xp's own firewall but think your problem is to do with the Raw Socket issue as outlined in the following.
Raw Socket
Also check this Site
If you want to make sure messenger is not running download & run
Shoot The Messenger
I am sure others who use XP's Firewall will be able to advise about the exact details.
Thanks Badger for your reply. Theres an awful lot of reading to do there, but all I wanted was a simple answer from XP users as to whether what I've described is normal, safe and whether others see exactly the same things when they look at Xp's firewall settings.
It seems to me that in spite of messenger being disabled in Administrative tools> services and showing 'not signed in' in task manager it is still building up a long list of 'msmsgs' and checking the boxes whether I like it or not.
I need to know if I can, and should stop this.
Thanks :)
MS' firewall is set up to be used almost entirely hands off by computer users who have never used a firewall before and don't necessarily want to configure it. Because of that it is preset with open ports for commonly used MS programs such as MSmessenger. You can close those ports without encountering any problems.
Awsome ,amazing ..
I really appreciate every bit of help from u guys..
Gone thru Howstuffworks ..Great Explanations..
I have printed the Zonealarm tutorial..
Just searching on net . i came across 2 another firewalls .
1. BlackIce
2. Tiny Firewall
I have also read a tutorial regarding NAT
Can u explain me a facr about Port Address Translation..
Can we connect to an internal pc used inside home network from remote control software like pc anywhere or vnc..
Eagerely waiting for a response
Is it true that mcafee security center damages winsock keys if uinstalled ..
And
Norton uses a lot of resources and disrupts the dvd and cdrw drives..
Plz tell me..
Blackice only blocks inbound traffic so it's really not as effective as other firewalls.
Tiny is one of the few I've never used but I've seen many recommendations for it around here and other places. It uses very few resources if that's an issue.
Norton is relativley resource needy but I've never heard that it has any effect on optical drives (and can't see how it would).
Hi
I use Norton and have never heard of trouble with DVD/CD drives:confused:
The only conflict Norton may have with these is GHOST as some drives are not compatible but this has nothing to do with the AV software ( totally unrelated software )
Healtheworld, while checking out firewalls, I suggest looking at Outpost from www.agnitum.com . It's worked great for me and there's a free version. It doesn't use as much resources as others I've tried. It has plug-ins too; pop-up stopper, add blocker and is easy to configure. Check it out.:cool:
Gone thru some chats with some security experts,,,
Some Facts Revealed...Ur opinion Error Required...
Bad Things Abuot Home Firewall's:
****************************
1. They slow your PC.
2. If they're free they're not as good as expensive one's, if they're expensive - I can't afford them
3. Trojans/Worms/Spyware can easylly use my default browser/IM/other communication thing as a communication app, so no chance to block that.
4. They really can't stop a advanced hacker, becouse a wannabe would stop and cry, when he sees that my ports are clossed and that have enabled XP firewall, i'm patched and there's nothing to exploit, but a real hacker would finish it if he wished so.
Good Things About Home Firewall's:
*****************************
1. They Protect You Anyway.
2. They would catch all the simple trojans/spyware/worms.
3. They would block any "i am going to hack u" wannabe.
4. They make you feel a little bit more secure.
So what do you think...? Do you personaly use a firewall, if you do which one ? Did it help you anytime ?
P.S. Once opun a time a had a ZA, and it keepet warning me that my ISP is hacking me...;p and left me a wery bad memory.
Quote
"Personaly, I think too much emphasis is placed on firewalls ...
No firewall even comes close to making your machine secure ... Most of the security holes that a hacker will use are in applications you ALREADY allow access through your wall ... take for example something lame like the rather old 'Godmessage' exploits ... email bugs, MSN and ICQ exploitable overflow conditions ... What will your firewall do about these?
NOTHING, thats what ... simply log the packets for later analysis (If your wall even supports logging - many don't)
Turning to trojans... sure, a process based firewall will detect some of the poor public malware currently being pushed in the media as the biggest threat on the net - but ONLY if they are not modified - for that matter so will your AV solution. But these are just toys.
Other trojans use IPC techniques to get your default browser to do the communication for them ... and guess what, your firewall is probably all set up to allow it.
Although I may sound negative about walls (And don't even get me started on AV) I still suggest you have them because it keeps the less-capable wanabes away from your system for a while ... and lets face it, there are about a 100,000 wanabes to hacker ratio.
But, please, dont for one second think that your choice of firewall/AV solution is going to make a damn bit of difference if anyone with a degree of skill decides to crack your box for fun or profit. Security rhetoric is a multi-billion dollar industry and thats all it is, rhetoric.
Personaly, I've never met a local software firewall that can detect or packet log a VxD Layer-0 trojan ... and many can't even detect semi-available LSP/SPI trojans that wrap the base layer. And I've never met even a big-box or corporate solution that can do anything about socketless trojanware using promiscuous or parasitic quoted techniques.
"
ANOTHER ONE FROM A TOP SECUIRTY EXPERT...
A local firewall (As opposed to gateway or hardware) sits either as low in the TCP/IP protocol stack as possible (and nievely hopes the OS makes apps behave) ... or it sits as low as it can in the OSI model generaly by wrapping the interface functionality.
The first is ridiculous and the second is highly questionable
First ...
The first can be got around by tapping the Layered Service Provider's Transport Provider Interface for example... which is essentialy one half of the protocol stack (The other being the Namespace Provider Interface) .. this is done by simple inclusion of a .DLL exporting an SPI (Service Provider Interface) at both its upper and lower edges and thus sitting in the middle. By aggressively holding the lowest position in the stack by claiming to all above it to be the base layer etc ... this DLL can not only use ports parasiticaly but can generate phantom ports that dont show up on netstat and other socket enumeration ... it can also fake in both directions presenting non-network data to applications as though it were regular traffic - and presenting traffic as though it were formed in an application.
This on its own can present significant problems exploiting inherrent trust in a process-based-firewall environment ... and can even be used to promiscuously listen for quoted commands on ANY port or protocol (And strip such sections before presenting up the stack to the app) ... similarlt messages can be quoted into a legitimate stream and passed OUT through the converse method, at least as trusted as the application who apparently generated the traffic.
The second is FAR nastier ...
Not only will it NOT show up on any local firewall (Process based or not) due to being on the OTHER side of the firewalls hooking and thus already from OUTSIDE of the machine (In a TCP/IP context) ... it also is running INSIDE the machine in a code context ... The best of both worlds !
Not only this ... but external firewalls and gateways can be fooled by the same quote/dequte scheme as before. And traced back to ... the legitimate app.
This makes every port on your system a trojan, and any log that shows a LEGITIMATELY FORMED transaction could be a trojan command that was stripped prior to the firewall seeing the packets.
Not only this ... from the VxD layer we can intercept any API call, any registry call, and any Disk access (Even sector reads/writes) ... and filter them and/or remap them and/or return a lie. We've even beaten IDS into submission with this and managed to propagate holes into several layers of backup.
Anyway ... This means that our VxD based trojan is transparent, socketless, promiscuous and has no window/task/thread ID's ... It also may (depending on coding) be impossible to see in a memory scan, drive scan and its registry storage may be invisible to all ... or even different depending on the process doing the asking.
DaVinci Group wrote The MiniBaug LSP trojan in 1999 and several variations of VxD wrapper based trojans for concept over recent years.
Combine these low level tools with some pretty basic exploits and you have a reason not to trust AV/FW solutions as far as you can comfortably spit a horse.
Linux *spit* *spit* is not above this either ... in fact, it can often be easier to install this type of code into the abstract machine representation in a linux based environment that even the windows systems depending on the specific configuration... certainly, IDS systems like Tripwire have never been much of a problem on either system.
Personaly, I believe the much hyped Magic Lantern software probably uses such techniques with the added advantage of good co-operative relations with the governments bedpartner, microsoft... And, if it doesn't ... well, theres no excuse.
Luckily LSP and VxD development are not so openly documented that the lamer can easily exploit these techniques. And DaVinci are a members only non-publishing organisation ... both with code and exploits, by a strictly enforced disolvement policy. However, anyone with coding experience and a copy of the MSDN DDK (VxD) or the MSDN SDK Subscription (LSP) should find their way given a little determination.
Another excerpt from security expert
******************************
"I've never found an effective AV solution.
Heuristic detection methods on all are comical and the detection of KNOWN virii makes the whole deal a lottery ... before you are protected a number of things happen :
1. A large number of people are infected
2. Someone reports it
3. They take the time to find a signature and include it in the VirDefs
4. You take time to DL the VirDefs
Meanwhile ... yet more people infected.
So, for every definition (And there are absolutely thousands) in your VirDef file a very large number of people have been infected. Altogether the numbers are quite staggering.
Thing is ... security should NOT be a lottery ... Signature based AV is not the best solution... of course, the best solutions SOLVE problems and thats not in the vendors interest either.
Want to do a test?
Take a virus, split it into three sections 'start-50%' '25% to 75%' '50% to 100%' ... run your AV over them ... find the one that flags as a virus and repeat ....
Till you get down to a small file, perhaps only 14 bytes - of which removing just one byte from either end prevents its recognition.
Now, look at it ... If its text, change it in a sane way ... if its instructions, swap two that seem order independent... Now paste that back into the original virus and boom ... theres a new version that will evade your AV and wipe out at least few thousand people before it hits someone savvy enough to catch on and report it to the AV vendors.
And thats without a great deal of skill.
Want less skill? Try exepacking a trojan, and then hexing out the 'Packed using BLAHPACKER' and anything else obvious. Gee, a trojan that doesn't show on AV scans ... when its released it will soon become recognised, but what if its not released, what if it becomes a personal variation for some miscreant? Hes potentialy gonna get YEARS of use !
AV may prevent the apocalypse ... but it certainly doesn't prevent disasters, and it won't keep you safe.
So, what do we learn? That AV requires a virus to have already been widely SUCCESSFULL before the AV has any potency?
Poor state of affairs.
So yes, load up your AV and your firewall - Argue about which is the best till your face goes blue... but for gods sake please dont put any faith in any of them for they are all poor at best.
They protect the whole ... not the individual !
"
Healtheworld...
You seem to have made more of an effort in your web searches than you would have if you'd just read the manuals you refered to in your first post.
You have enough info to make up your own mind. Rather than just posting articles to try and start a debate, the kind of which usually only ends in either an argument or flames, why not just make up your own mind if it isn't already?
Got It Fink....
I m diving in to too much details to early..
BUT THANKS FOR EVERY BIT OF INFO U GUYS HV PROVIDED....