Firewall Configuration

[shadowmonkx]

Hiya,

I'm currently using Network-1's CyberwallPLUS-WS to protect my computer... but one problem: it's COMPLEX (boy, I sure am stating the obvious)!!

There are a few things I can't figure out:

1.) If I have the firewall set to the default (allow only outgoing connections), and it's a "stateful packet inspection" firewall, then it *shouldn't* be having any problems with any programs. But, it DOES. Even tho I'm not HAVING any problems, per-se, the event log keeps piling up with "Rules Said Fail It" for a LOT of HTTP connections, etc. What's going on?

((Please see http://home.rochester.rr.com/shadowmonkx/firewall.bmp for more information.))

2.) If you had any idea how to do so, could you tell me how to make the
firewall as secure as possible, by making sure the settings are correct?

There's a LOT of crap I don't understand -- nodes, rules, protocols... and the manual is bloody 406 pages!!! I have it in .pdf format, and plan to read it (or buy the hardcopy if I can, so I don't fry my frickin' eyeballs
out!) -- but what about safeguarding my computer meanwhile?? *eek*

You can get a two-day trial version of the firewall here: http://www.network-1.com/_download/index.htm

I would ASSUME (fairly logically) that putting the firewall on NO connections alllowed, and then going from there, would be the best thing to do... but I'm also lost there.

I know that this is asking quite a bit...

When adding/deleting configurations (including mine) the two tabs you have to worry about are "Main" and "Rules".

Thanks and t'care,

-shadowmonkx

This might prove helpful: I asked a few questions of a Network-1 professional, and this is what was said:

Q> If I follow the CyberwallPLUS instructions to enable NAT, will that work on the WS version with Windows 2000 Pro?

A>CWP-WS does NOT do NAT. Windows 2K Internet connection sharing does...read about that set-up.

Define the non-routable addresses as Untrusted nodes and allow them access to the Local Machine.

Q> Is there any way to make CyberwallPLUS allow NO connections, but allow me to configure it for connections as I attempt to make them (eg a pop-up window asking for configuration to allow the connection, much like an application-gateway firewall such as Norton's)?

A> Sure...go to the Rules Tab and delete all the rules...No Connections will be allowed.

Add in ARP and the applications ports you want to open....be careful HTTP doesn't use port 80 going out.

CWP-WS is a stateful packet inspection firewall...Not an application proxy/gateway...no Pop ups.

[dale]

Firewalls is my "major" so to speak having worked for Raptor Systems for several years. Most firewalls are horrible at making it easy to configure rules for your policy. I haven't specifically looked at the one you are using since there are so many. However, in general, most firewalls should be configured such:

1) The rules are generally order dependent. Meaning the firewall software will look at a packet that is going out or coming in and based on the src, dst, protocol and maybe time of day and user, decide if the packet is allowed to get out or in. The rules are read from top to bottom and which ever rule FIRST matches the parameters is used to deny or allow the packet. Meaning if you had:

allow 128.1.1.0 to anywhere for HTTP
deny 128.1.1.1 to anywhere for HTTP

Then the deny rule is never seen and thus the system known as 128.1.1.1 will never be allowed to use HTTP.

So, the best way to start is create your allow rules for all the protcols that you want your system to create connections for. Meaning, you want to create HTTP, FTP, DNS, SMTP, POP3 and maybe RealAudio rules for connecting from your system to anywhere on the Internet.

2) Second you want to create any rules that allow other systems to connect to your system. Meaning, if you happen to have a personal web server running or an FTP server where you want friends to connect to your system. This is usually not a requirement so most people don't run servers on their personal Windows system. The only exception is if you are planning to do print or filesharing. In this case, I would recommend using NetBeui to do it on a local Lan and be done with it. If you have a need for someone to fileshare to your system using NetBios over TCP over the Internet, then write a rule specifically for that and ensure you have a password on your fileshare. As a clarification, you DO NOT need to create rules allow packets from the Internet to your system when your system has created the connection. Most firewalls are savvy enough to know that if you have a rule to allow a TCP connection out, that it should obviously let the return packets back in for that connection. There is a slight hole with this logic for UDP since this packets are easily forged, but its a small hole in my opinion.

3) Lastly, make sure you have a "catch-all" rule that denies everything, something like:

deny all

This will result in a "deny all except that which is explicitly allowed" policy, usually a good policy to have.

For NAT, Windows98 just can't do it using packet filtering. If you need NAT on Windows98 (for the purpose of routing packets from an internal network), then you will need to either install a Proxy server like Wingate, or go to Windows2000 or install a Linux server.

This is very high level, but might help you get started.

regards,
dale