Software firewall woes

[sswingle]

Ok, so I am trying to setup a software firewall, and I cant get anything to work right.

First, I loaded the free Zone Alarm. It worked well at first, but I noticed that if I leave the computer for a while and come back, my computer suddenly can't resolve DNS. The firewall is still letting traffic through because my P2P program which relies on IP addresses only is running along just fine, and I can ping IP addresses, just not host names. Shutting down zone alarm would clear everything up just fine, as would restarting the computer with zone alarm still running. Everything would be good until I leave the computer for a few hours again and come back.

So, I dumped zone alarm, because I have heard other reports that it'll screw over your registry, and went looking at the free software thread. Next up, Sygate Personal Firewall.

Install Sygate and restart. I have no IP address. 169. Can't renew IP, cannot communicate with the DHCP server. I tell sygate to allow all traffic, still no IP. I shut down sygate. Still, no IP. I restarted again just to make sure, but still not getting an IP address. I uninstalled Sygate, restart, and I have an IP again.

Finally, I try Kerio. It loads up, I like the interface. Allow my applications that want online. P2P program is working fine. Load up firefox. Cannot connect. Argh. Turns out Kerio is doing the same thing Zone Alarm was. Cannot resolve any DNS. Tell it to allow all traffic. Nothing. Shut it down, everything works fine.

So I uninstalled Kerio.

Can someone tell me WTF is going on here? I have used software firewalls in the past, Zone Alarm and Norton (never with this current windows install) and have never had problems. I refuse to load Norton back on my system to even try it.

Any ideas would be appreciated.

Cliffs, because I know this is long.

Tried 3 software firewalls
Zone Alarm - cannot resolve DNS
Sygate - cannot contact DHCP server
Kerio - cannot resolve DNS

Oh, and in both of the DNS situations, I was able to ping my dns servers (4.2.2.1). Normally they are set on the router, but I tried setting them in this systems network properties as well and neither way worked.

 

[KoolDrew]

Use the SP2 firewall. Outbound filtering at host-level doesn't help security anyway.

 

[BlueWeasel]

What version of Kerio did you try?

 

[EagleKeeper]

ZoneAlarm (Free) for me has no problems.

I started getting connection/DNS problems when going through my wireless router.
I would have to power off the router in the AM or after periods of inactivity.

Removed the router from the circuit and problems went away.

The router (804-G) has a nasty tendency to overheat, which I think is the problem.

I will eventually just replace the router when I need my wireless back.

 

[TGS]

Even though people swear that outbound controls are useless, when you get an application that makes unnecessary outbound calls or access attempts it's nice to know and be able to stop them. That being the case if you are unaware the application does that in the first place.

I've found a great deal of programs make external access attempts for no reason other than it's programmed to do so. Opposed to running a port logger seperately, or even a sniffer to find all the extraneous traffic.

 

[dunkster]

Trial the Micro Trend IS2006 Suite (software firewall + PC-cillin AV).

Big improvement over IS2005: Tight control over attempted outbound communication by apps. Any outbound attempt is intercepted with a prompt to either prevent or create an exception for that app. Exception list is easily opened for editing. Behavior similar to OPP in learning mode.

Strong anti-phishing controls. Spam-prevention same as IS2005.

Memory burden for IS2006 processes is still fairly high, but overall protection is good.

Hope this helps!

 

[sswingle]

Originally posted by: BlueWeasel
What version of Kerio did you try?

4.2.2

 

[sswingle]

Originally posted by: KoolDrew
Use the SP2 firewall. Outbound filtering at host-level doesn't help security anyway.

Outbound is the one and only reason I want to install one. My router takes care of the inbound.

 

[KoolDrew]

Even though people swear that outbound controls are useless, when you get an application that makes unnecessary outbound calls or access attempts it's nice to know and be able to stop them. That being the case if you are unaware the application does that in the first place.

I've found a great deal of programs make external access attempts for no reason other than it's programmed to do so. Opposed to running a port logger seperately, or even a sniffer to find all the extraneous traffic.

If you are really worried about such activity you would be better off with a firewall at the border of your network.

Outbound is the one and only reason I want to install one. My router takes care of the inbound.

Why? Once your system is compromised, it is compromised. An outbound filtering firewall gives you nothing except a false sense of security.

Also, if your machine is the only Windows one in your network I wouldn't even bother with a software firewall; the router is all the protection you need. If you have more then one, use the SP2 firewall to protect against threats within your network.

 

[*kjm]

Yep they do.

 

[UsandThem]

Originally posted by: dunkster
Trial the Micro Trend IS2006 Suite (software firewall + PC-cillin AV).

Big improvement over IS2005: Tight control over attempted outbound communication by apps. Any outbound attempt is intercepted with a prompt to either prevent or create an exception for that app. Exception list is easily opened for editing. Behavior similar to OPP in learning mode.

Strong anti-phishing controls. Spam-prevention same as IS2005.

Memory burden for IS2006 processes is still fairly high, but overall protection is good.

Hope this helps!

:thumbsup:

I used 2005 for a year, and purchased 2006 a few weeks ago, and I have been very happy with both.

 

[Minerva]

You can do inspection both ways at the router but few (if any) SOHO ones do this (read: effectively!)

 

[sswingle]

Originally posted by: KoolDrew

Even though people swear that outbound controls are useless, when you get an application that makes unnecessary outbound calls or access attempts it's nice to know and be able to stop them. That being the case if you are unaware the application does that in the first place.

I've found a great deal of programs make external access attempts for no reason other than it's programmed to do so. Opposed to running a port logger seperately, or even a sniffer to find all the extraneous traffic.

If you are really worried about such activity you would be better off with a firewall at the border of your network.

Outbound is the one and only reason I want to install one. My router takes care of the inbound.

Why? Once your system is compromised, it is compromised. An outbound filtering firewall gives you nothing except a false sense of security.

Also, if your machine is the only Windows one in your network I wouldn't even bother with a software firewall; the router is all the protection you need. If you have more then one, use the SP2 firewall to protect against threats within your network.

I want to block legitimate programs from connecting. Not really a security thing, I just want to be able to say, program A is blocked, while program B still has access.

 

[futuristicmonkey]

Originally posted by: ScottSwingleComputers

Originally posted by: BlueWeasel
What version of Kerio did you try?

4.2.2

2.1.5 /end of thread

 

[kurt454]

I used to advocate Kerio 2.1.5 also, but it seems it has an exploitable flaw in it. I guess all software firewalls are barely better than nothing.

 

[Unkno]

Originally posted by: TGS
Even though people swear that outbound controls are useless, when you get an application that makes unnecessary outbound calls or access attempts it's nice to know and be able to stop them. That being the case if you are unaware the application does that in the first place.

I've found a great deal of programs make external access attempts for no reason other than it's programmed to do so. Opposed to running a port logger seperately, or even a sniffer to find all the extraneous traffic.

yea, this also means that if you get some new virus/spyware from some exploit in a software or OS, your computer will never detect it's outbound connections....until you scan with an updated virus/spyware scanner

 

[nweaver]

If you have a virus, it can bypass the S/W firewall before sending stuff out.

 

[gizbug]

Outpost firewall . Next question?

 

[HN]

Time to throw in iSafer -http://winsockfirewall.sourceforge.net/