AtGuard
JonT
Having followed the threads regarding firewalls I have now installed
AtGuard. Once installed I went to grc.com as suggested in one of the recent
posts to try it out. After some adjustments I passed their test scans. I
have noticed that my firewall "blocked" count keeps increasing even though
there is apparently no activity from my side of the firewall. I have
monitored the AtGuard log file to try and fine out what is being blocked,
but it does not give me much information. Can AtGaurd tell me which ports
are being scanned or what is being blocked from the Internet side of my
firewall. If Atguard can't tell me what can?
Since installing AtGuard a few days ago I can't believe how many
ads,refers,cookies and firewall blocks I have had. This could drive me
paranoid " Who said that" :).
John Chapple
<Jo...@gavtpat.demon.co.uk> writes
>Hi
>
>Having followed the threads regarding firewalls I have now installed
>AtGuard. Once installed I went to grc.com as suggested in one of the recent
>posts to try it out. After some adjustments I passed their test scans.
grc.com just gives a basic scan of a few ports. In particular netbios
should show as blocked at least. All others stealth.
>I
>have noticed that my firewall "blocked" count keeps increasing even though
>there is apparently no activity from my side of the firewall. I have
>monitored the AtGuard log file to try and fine out what is being blocked,
>but it does not give me much information. Can AtGaurd tell me which ports
>are being scanned or what is being blocked from the Internet side of my
>firewall. If Atguard can't tell me what can?
(Not an expert)
[Presumably you've 'enabled rules assistant' interactive learning mode?
This builds rules on the fly for connections to unknown or non permitted
ports so you can block traffic from that ip address or port?]
The important point is *each* rule has an option to write an entry in
the event log (& show notification in the dashboard). This gives you a
pop up message of the port & the address its coming from. You need to
decide which rules you want to mark in this way, mainly its incoming
ports, but some outgoing ports might be worth monitoring in case you've
been compromised.
>
>Since installing AtGuard a few days ago I can't believe how many
>ads,refers,cookies and firewall blocks I have had. This could drive me
>paranoid " Who said that" :).
Personally I just block ads. I've turned on cookies, referrals etc (for
another thread), but you seem to spend loads of time allowing Atguard to
write rules, I'm probably living dangerously. I don't browse (AFAICT)
some of the more popular 'advanced' sites, mainly techy ones.
--
John Chapple