here we go, what firewall software do you think is best?

[tigerwolf]

I figured I'd throw out a couple of easily accessible and fairly easy to setup up software firewalls and see which ones ya all like. And by easily accessible I mean easy to buy or download. LOL

I believe that when you are connected to the net, you need a good firewall as well as a good port scanner, but a firewall is a must anymore.
Especially if you use broadband (aka cable, dsl, satellite, etc), but even if you don't its still wise to use one. Especially if you do chatting via any of the instant messengers, irc, etc. Your ip address is being given out quite a bit while surfing which just opens a doorway for hackers. Actually I'm more concerned about the wannabe hackers then the true hackers. Most true hackers wouldn't even bother with messing with someone unless you pissed them off. Which of course is yet another good reason, in case you piss one off. LOL. Plus you get attacks from more then just hackers nowadays and you also get to find out what programs are doing what on your pc. I mean who wants hidden software sending out info about you. Anyway, most of the software on the poll is either easily purchased or free and most are simple to setup.

so here we go.

[tigerwolf]

okay so there is the norton personal firewall as well as internet security. I thought they did away with the personal firewall and just incorporated it all into internet security, but I was wrong. So norton's firewall is either the internet security or personal firewall. LOL.

[wellmashed]

Allright allright allright........I just slapped myself across the face.
I just clicked the wrong one.
I voted Norton and then realized that Norton is my anti virus ......DUH.

I use Black Ice Defender for my firewall.

In defence for my total stupidity though I did use Norton for a while and found it to do it's job but I prefer Black Ice.

[bilbogod]

Well I've heard about three different occasions when my friends Norton firewall was bypassed by people. It noted the invasion AFTER unusual activity onn the computer. Never had any probs with Zone Alarm so far.
Heres a link to a fun test that everyone can try in order to test their computers security:-

https://grc.com/x/ne.dll?bh0bkyd2

Also try reading some of the info on www.grc.com Its quite an informative little site

[tigerwolf]

another good scanning test site is:

http://scan.sygatetech.com/

[tigerwolf]

oh bilbogod, thanks for the site, I love this on the one test of my pc.

"All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet"

my favourite line here is very uncommon for windows networking-based pcs.


LOL.

[Mirror_Image]

I'm wed to Zone Alarm Pro!

[wellmashed]

This is what I got....



We have determined that your IP address is XXX.XXX.XX.XXX
This is the public IP address that is visible to the internet.
Note: this may not be your IP address if you are connecting through a router, proxy or firewall.

Trying to gather information from your web browser...

Operating System = Windows ME
Browser = Microsoft Internet Explorer 5.5

Trying to find out your computer name...

Computer = WELLMASHED
Domain = **** YOU

Trying to find out what services you are running...

Unable to detect any running services!

[wellmashed]

OK.
Just done another one and this made me change some settings so the one for net bios is as of after this post now closed lol.

Your system ports are now being scanned and the results will be returned shortly...
Results from stealth scan at TCP/IP address: XXX.XXX.XX.XXX

Ideally your status should be "Blocked." This indicates that your ports are not only
closed, but they are completely hidden (stealthed) to attackers.

Service Ports Status Additional Information
FTP DATA 20 BLOCKED Used by FTP for data transmission in Passive mode.
FTP 21 BLOCKED File Transfer Protocol is used to transfer files between computers. A misconfigured FTP server can allow an attacker to transfer files, trojan horses, and virus programs at will.
SSH 22 BLOCKED Secure Shell, a encrypted type of telnet. If misconfigured it can allow for brute-force attacks on your administration account.
TELNET 23 BLOCKED Telnet is used to remotely create a shell (dos prompt), this can allow an attacker to control your system as if he was sitting in front of it.
SMTP 25 BLOCKED SMTP is used to send email acrost the internet. This allows an attacker to verify user accounts on your system, send anonymous (spam) email, or even access files on your hard drive.
DNS 53 BLOCKED Domain Name Services are used to resolve host names to IP addresses.
DDC 59 BLOCKED Used mainly by file transfer and chat programs.
FINGER 79 BLOCKED Finger offers information about who is currently logged in to your computer.
WEB 80 CLOSED HTTP web services publish web pages. A misconfigured web server can not only offer an attacker needed information about his target, but it can allow for various security breaches.
POP3 110 BLOCKED Post Office Protocol is used to receive email. It can be used by attackers to create fake email addresses, execute programs, and even intercept your private email.
IDENT 113 CLOSED Ident is often used for IRC (chat), but also provides information about your system and who is using it.
NetBIOS 139 OPEN NetBios is used to share files through your Network Neighborhood. If you are connected to the internet with this open, you could be sharing your whole hard drive with the world! This is a very dangerous port to have open.
HTTPS 443 BLOCKED Secure Web Servers are often used by banks and online vendors.
Server Message Block 445 BLOCKED In Windows 2000, Microsoft added the possibility to run SMB directly over TCP/IP, without the extra layer of NBT.
SOCKS PROXY 1080 BLOCKED Socks Proxy is an internet proxy service, many IRC servers will not allow you to log in if you are running an unsecured socks proxy.
SOURCE PORT 1495 BLOCKED This is the port you are using to communicate to our Web Server. A firewall that uses Stateful Packet Inspection will show a 'BLOCKED' result for this port.
WEB PROXY 8080 BLOCKED HTTP Web Proxy allows other people to bounce their web browser off of your computer to fake their real IP address to web servers.

[d4n13l]

oh bilbogod, thanks for the site, I love this on the one test of my pc.

"All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet"

my favourite line here is very uncommon for windows networking-based pcs.

LOL.

That is exactly the message that I always get. That is, if I allow my real IP to be known to the site 8). Gotta love those anon proxies.
The most important thing to do to any Win9x system is unbind the network stuff that you dont use: Most people only need TCP/IP to be bound to their dial up adapter. I love the default network settings of win9x; everything turned on. Hence the reason why most win9x systems stick out like a sore thumb to port scanners. They sing like canaries when probed.

[dumwaldo]

I use Black Ice Defender for my firewall.

you couldnt possibly have made a worse choice.

IMO zone alarm is the best for the average user, more experienced users might like tiny better.



http://grc.com/lt/leaktest.htm
and be sure to check...
http://grc.com/lt/scoreboard.htm

[d4n13l]

Amen to that.
Zone and Tiny are both great firewalls.
8)

But everybody remember, if you are going to use a firewall, read up on how to use them effectively. It isnt good enough just to run a firewall, you have to know how to use it. A firewall is only as good as it is set up to be, the user is the most important part of good security.

[bilbogod]

So let me get this straight..... Next time someone probes my port and gains unlawful entry, this should be classed as "Cyber-Rape". I wonder what kind of sentence my lawyers could drum up from this

[wellmashed]

OK OK OK ...
I done the tests and guess what.....
I failed....

Right....I have no personal info on my pc at any time so whatever anything could send out on me is really irrellevent but lets say it was...

Im gonna choose Zone Alarm then......
Need some pointers here though..

What exactly do I need to allow access to the net ???????????

I'm gonna sound really thick here but I tried Zone Alarm before and it seemed like too much messing so I diddn't bother but maybe it was a bad choice.

Guess I need to learn some more then eh..........

[wellmashed]

By the way...
I know that black ice is not letting anything in so my question is now can I have two programs running at the same time i.e. black ice and zone alarm.

Just until I get Zone Alarm configured right ??????????

[dumwaldo]

i have run ZA and tiny at the same time so i dont think it would be a problem to run 2 firewalls at once.

after you install zone alarm the first time you use an application that uses the internet a pop up window appears from zone alarm asking permission.

there are 2 types of permission.

when ZA asks do you want to allow this program to access the internet, what it is asking is do you want to give this program permission to download and accept information from the internet and allow it permission to send information to the internet when you specifically permit it.

when ZA asks do you want to allow this program to ast as a server, what it is asking is do you want to allow this program to be able to send information without your explicit permission.

you have the option of checking off the box to always allow permission or you can just allow permission for a single session.


now because no program is perfect i want to quickly explain the basic difference between zone alarm and tiny.

ZA allows a specific exe file permissions. so if you have 3 copies of mIRC you need to allow each instance its own permissions just as if it were 3 completely different applications.

Tiny allows you to bind specific ports to programs. so if you have 3 copies of mIRC one set of permissions can cover all instances of mIRC.exe.

peace out,
dumwaldo

[wellmashed]

Dumwaldo thank you for the quick tutorial.
Bilbogod and Tigerwolf for the test sites.

Zone Alarm Pro is now fully functional and stopping all attempts both in and out.

I'm gonna keep Black Ice running as well so if I am sending a file to my mates through MSN then I can just kill ZA temporarily to allow them because Black Ice has all their IP ad's allowed allready,and I can keep ZA stopping everything.

OK.
Now on with the poll.....

[wellmashed]

Just a quick one while we are on about Zone Alarm.

Is there any way of allowing certain IP addresses access like you can in Black Ice.I can't find an option for it anywhere.

[dumwaldo]

no there is not. zone alarm allows specific exe files permissions and it is up to the application to become IP specific.

you might want to look into tiny firewall. tiny is a rule based firewall and far more configurable than zone alarm but nowhere neer as user friendly as zone alarm. you sound like you have the knowledge to operate it so i would suggest trying it, i think you will find it is more what you are looking for.

peace out,
dumwaldo

[wellmashed]

Right...This is more like it...

Highly configurable as you say and also highly user unfriendly...LOL

Yes it does do what I want but when I had finished after about 2 hours of playing with it it still failed one test.....

http://security1.norton.com/ssc/home.asp?j=1&langid=us&venid=symnis&plfid=20&pkj=SGMKSKVYRMHCGVRVRMN

So I went and got Norton (again) and installed it (again).
This is a different version than the last one I had and does pretty much everything that tiny does and some different things as well. (or maybe just in different ways)

Gonna play with this for a while and i'll get back to you with the results tommorrow.

[Allan55]

There is a pretty good firewall built-into Win98-2 (I haven't looked at Win98 or ME). Go to

Control Panel\Network\TCP/IP -> Your NIC\Properties\Bindings

and turn off all bindings. You'll get a squack about "no bindings".. Just say NO.

www.grc.com can onlsy see your MAC address after this.

For small simple networks, Load NETBEUI on all machines and do the above step on every one of them. Since NETBEUI isn't routable it provides local networking.

After that I install a hardware router/hub, usually LinkSys for SOHO. It isn't that much more than a software firewall and it is one less thing to install and maintain on every comuter.