Firewall with Avast

[FreewheelinFrank]

The two attacks may well have been blocked by Kerio’s intrusion detection feature. Have you clicked the ‘Find out more’ link? What did it say?

Edit: You haven’t included the bottom of your screen, but you appear to be looking at the intrusions log.

http://donaldbroatch.users.btopenworld.com/kerio_intrusions.jpg

From the Kerio website:

Intrusion detection
Potential intruders use various techniques to find out whether a targeted computer is vulnerable to attack. These techniques vary from simple port scanning to more elaborate exploits. Kerio Personal Firewall has a built-in intrusion detection system that identifies and blocks most known attacks.

The intrusion detection feature seems to be above and beyond the firewall feature, so a firewall will not block these probing techniques.

[system]

@FreewheelinFrank post:18

I’ve never tried Sygate, but the reviews I’ve seen don’t describe it as user friendly: in fact they say ‘suitable for anyone who knows their way round an advanced firewall…too complicated for anyone who just wants to protect their computer and get on with their lives…competent software for experts on a budget.’ Computer Shopper. And ‘Our only concern is the interface, which won’t suit novices.’ Personal Computer World.

With reviews like that, I recommend ZA with its faults before Sygate, but recommend Sygate to experts like yourself.

FreewheelinFrank,
Sygate was the first firewall I ever used. I even installed it to other “newbies”. None of them told me they found it difficult to use. Sygate has only one screen, while ZA has four (if I remember correctly). I switched to ZA when Sygate had some problems with avast’s webshield (before making a short stop to use McAfee Firewall).
Bottom line: if anybody bothers to read the Help File (like I did), Sygate is very easy. It could become more difficult if you want to “tweak” it more - then you have to be an expert.

[FreewheelinFrank]

Spyros,

I’m only reporting the reviews I read of Sygate while looking for a free firewall: they certainly put me off trying it!

I certainly bow to your opinion if you have actually tried it, because I haven’t!

The only thing that worries me about the free version of Sygate is that it doesn’t have the intrusion detection feature of the pay version: the free version of Kerio does, and it seems to block a lot of bad stuff (see Cloussou’s posting previously.)

respect.

[system]

@FreewheelinFrank post:23

The only thing that worries me about the free version of Sygate is that it doesn’t have the intrusion detection feature of the pay version:

Yes, I agree with you…
But still, Kerio seems difficult for me at least, because of the rules. Rule-based firewalls seem more difficult to new users who just want it to work “right out of the box”. And if they are not configured right, they might cause more trouble than good…
Anyway, I don’t know much about firewalls, I believe Arup is the expert in this forum :

[FreewheelinFrank]

These are my Kerio rules:

http://donaldbroatch.users.btopenworld.com/kerio_rules.jpg

!

You can create advanced rules in Kerio 4, but it doesn’t require you to.

I believe Kerio 2 might have been different, but Kerio 4 doesn’t require you to create any rules (appart from which applications you want to allow to use the internet, if you choose to control outbound traffic) so you don’t need a degree in network computing to use it!

[system]

@FreewheelinFrank post:25

I believe Kerio 2 might have been different, but Kerio 4 doesn’t require you to create any rules

Hmm, interesting… I have only used the 2.15 version, which was rule-based. I will keep my eye on the new version then and try it out. Thanks FreewheelinFrank.

[system]

Thanks for the feedback Frank and yes it was the intrusions log I was referring to and BTW the find out more link was a dead end link . Be aware im not complaining as these attacks would be happening irrespective of what brand of firewall I run and its nice to know the IDS serves a purpose.
To shed a little more light on the difficulty / complexity of creating rules with Kpf i can advise that until i set Generic Host process and any other process toASK then i didnt need to create any rules.(see pic) With this setting in place a program would bring an alert and request to allow once or set a rule for a program requiring access. This made it really simple.

[FreewheelinFrank]

Setting up internet access rules is a bit more tricky than ZA.

When I tried ZA it asked me which applications I wanted to allow to access the internet, and the information the pop-ups gave made it easy to understand whether to do so or not.

I took ZA to Shield Up! after installation and it passed first time.

When I tried Kerio, it started asking me whether I wanted to allow connections from the internet to certain applications. The applications looked legit so I clicked yes. When it took Kerio to Shield Up!, it failed. I had to go back and change all the internet in rules to ask. I tried Shield Up again and denied any request to connect from the internet. This time Kerio passed.

After that I had one request to allow a connection to MSN when downloading a file, which I allowed, plus some mysterious requests for connection which I denied. Like yourself, I now have internet in set to deny for everything that has no need to accept connections, and I’ve had no more mysterious connection requests.

For a complete computer novice, I think Kerio would be the wrong choice, except in simple mode (which has no connection pop-ups,) because it’s too easy to make mistakes like this.

Of course these internet application rules are really simple compared to advanced packet filter rules. My posting of the empty rule box shows you don’t need to create any firewall rules, as opposed to connection rules.