Firewalls and resources?

  • Thread starter Thread starter Tim
  • Start date Start date
Tim said:
What's a good firewall with low RAM consumption?

Tim
Click to expand...
I find that Kerio has been good

--

Tue, 8(VIII)/1(I)/06(MMVI)

/'^'\ /'^'\
( o o ) ( o o )
---oOOO--(_)--OOOo------oOOO--(_)--OOOo---

! Useless Invention: Reduced calorie !
! water. !
 
I found Kerio 2.1.5 so bad as to be hardly worth having. IIRC it kept
asking whether I wanted block/permit various IPs, but it wouldnt tell
me what they were in plain english, and it wasnt possible to find out
without saying yes go ahead so I can go see. Maybe theres a trick I
didnt know about, but I ditched it.
Click to expand...
When Kerio blocks a connection it'll throw up an alert ( assuming you
have them switched on - or not switched off for that particular IP
address ) like so:

TCP Connection to 207.68.173.76:80 was blocked by rule 'Microsoft 2'

In the window below the summary you'll find the relevant
details..thus:

07/Aug/2006 14:14:16 Microsoft 2 blocked; Out TCP;
localhost:1990->207.68.173.76:80; Owner:
C:\PROXOMITRON\PROXOMITRON.EXE

That tells me that a certain app ( Proxomitron - through which my
browser runs ) tried to initiate a TCP connection to 207.68
etc...which, from the rule, I know to be Microsoft.
If I didn't know what the IP referred to I'd do a whois on it - either
via Netlab or Sam Spade.

Granted, it's not terribly clear what's going on - but all you need to
suss out is that 207.68.173.76 represents a destination ( for which
you can do a lookup) and the :80 represents the port at which the
communication is directed. The fact that Kerio lists the connection as
having been 'blocked out TCP' means my computer was trying to send
something to that address via the TCP protocol - and thus I can now
decide whether or not to allow or deny it.

By far the easiest way to run Kerio is to use one of the
pre-configured rule list, such as those by Sponge
http://www.geocities.com/yosponge/fw/ks/keriosponge.html

Regards,
 
Steve said:
When Kerio blocks a connection it'll throw up an alert ( assuming you
have them switched on - or not switched off for that particular IP
address ) like so:

TCP Connection to 207.68.173.76:80 was blocked by rule 'Microsoft 2'

In the window below the summary you'll find the relevant
details..thus:

07/Aug/2006 14:14:16 Microsoft 2 blocked; Out TCP;
localhost:1990->207.68.173.76:80; Owner:
C:\PROXOMITRON\PROXOMITRON.EXE

That tells me that a certain app ( Proxomitron - through which my
browser runs ) tried to initiate a TCP connection to 207.68
etc...which, from the rule, I know to be Microsoft.
If I didn't know what the IP referred to I'd do a whois on it - either
via Netlab or Sam Spade.

Granted, it's not terribly clear what's going on - but all you need to
suss out is that 207.68.173.76 represents a destination ( for which
you can do a lookup)
Click to expand...

the problem is you cant look it up while its sitting there waiting for
an answer to whether to permit it, or I didnt know how to.
and the :80 represents the port at which the
communication is directed. The fact that Kerio lists the connection as
having been 'blocked out TCP' means my computer was trying to send
something to that address via the TCP protocol - and thus I can now
decide whether or not to allow or deny it.

By far the easiest way to run Kerio is to use one of the
pre-configured rule list, such as those by Sponge
http://www.geocities.com/yosponge/fw/ks/keriosponge.html

Regards,
Click to expand...

NT
 
Steve H wrote:


the problem is you cant look it up while its sitting there waiting for
an answer to whether to permit it, or I didnt know how to.
Click to expand...

I've often thought an integrated whois function would be a real boon.
I used to use an 'Autoit' script to cut and paste the reported IP addy
into Netlab..but I get so few alerts these days that I can't remember
the last time I had to use it.

Regards,
 
I've often thought an integrated whois function would be a real boon.
I used to use an 'Autoit' script to cut and paste the reported IP addy
into Netlab..but I get so few alerts these days that I can't remember
the last time I had to use it.

Regards,
Click to expand...

thanks for the tips. I think I'd still rather use Zoneoctopus though

NT
 
Back
Top