Firewall question...

[masterB]

That's the way to go these days. I prefer a combo Av + Firewall rather than have 2 separate programs. Never had problems with Internet Security Suite and I tested a few.
For this reason only Kaspersky scored good on both sides. IMO.

Cheers.

 

[Subsonic]

That was it.

Just checked in to a different hotel and connected and now I get this:

 

[Barman58]

This would suggest to me that there are gaps in your firewall which are now being filled by the hotel router's firewall.

I would not be overly worried but would suggest that you look into your software firewall when you can fully control the router component.

It's often just a case of getting the firewall manual out and use the tests, with the firewall in the router switched off, to set the firewall to provide the protection you need.

Then whenever you visit a hotel you can be sure you are suitably protected

You could also disable the firewall in windows and try the test - if you are protected by your home router there is no need to have the firewall operate on your home network, which will improve your performance slightly

 

[Subsonic]

Thanks Barman,

What's interesting is I tried Windows7 Firewall control, Private firewall, and Agnitum Outpost while at the last hotel with no difference. Would show the router ip address (not my computer's) with port 23 and port 80 open. Now at different hotel and shows "true stealth" on all ports. I think the problem may be that the port scanners that are online can only test the hotel router and they don't make it all the way to my computer. Hopefully that's the case.

 

[Barman58]

You could well be correct as the only issue I've ever had with my setup is the "ping" port on the router being open which I knew about (and it's closed on the actual PC ).

I would suggest you do the tests when you have control for your own peace of mind, and of course with Windows 7 you have the advantage of the multiple network zones to allow you to fully control things - just set everything you don't need, sharing wise, to off when your on a public network

 

[Jacee]

Using Avira Premium Security Suite

 

[Barman58]

Hi Jacee,

Don't you just love it when a plan come together

Mind you I would have been very shocked if your sytem came back with anything less

 

[Jacee]

Me too Barman!! :shock:

 

[Creer]

Thanks Barman,

What's interesting is I tried Windows7 Firewall control, Private firewall, and Agnitum Outpost while at the last hotel with no difference. Would show the router ip address (not my computer's) with port 23 and port 80 open. Now at different hotel and shows "true stealth" on all ports. I think the problem may be that the port scanners that are online can only test the hotel router and they don't make it all the way to my computer. Hopefully that's the case.

Well, you shouldn't be worry about hiding IP.
Eg. if your IP address is dynamic, it is not much use to hackers. Most of their attacks are random, they pick a range of addresses and run an automated attack on each in turn. This means they will sooner or later attack your address even when is hidden.
So hiding the IP is not protection, it can be traceable. Of course if you are using a router/HW FW - this is a far more effective firewalling system than anything what is on a machine. If you keep Windows firewall active as well there is very little chance of anyone getting in. The only other consideration is that wireless is a little more exposed. If you are really worried never use it. But encrypted wireless connections will always beat these kind of attacks as they only get garbage replies.

Another thing is how do you scan your ports - better solution than scanning via websites is to install net tools for example Nmap Nmap - Free Security Scanner For Network Exploration & Security Audits.
It's more reliable tool.
About closed and stealth ports - there is no really difference between them Wilders Security Forums - View Single Post - [Rant] GRC's Shields Up! and "true stealth" - firewall test or harmful FUD?

HTH,
Creer

 

[Subsonic]

I think I'm alright afterall....

Using Avira Premium Security Suite

When I was showing Port 23 and Port 80 open at the last hotel I was staying at, I was also passing the "leak test" as above. That should prove to me that my computer's firewall was preventing connection to my port 80 even thought the hotels router showed it open on the GRC "shields up" common port scan. I think that's right?

 

[gamepro127]

ESET Smart Security V4 test results!
http://img41.imageshack.us/img41/3439/failmqd.png

 

[Creer]

ESET Smart Security V4 test results!
http://img41.imageshack.us/img41/3439/failmqd.png

And why it is failed? Cause some ports are 'only' closed and should be stealth?

 

[Subsonic]

Another thing is how do you scan your ports - better solution than scanning via websites is to install net tools for example Nmap Nmap - Free Security Scanner For Network Exploration & Security Audits.
It's more reliable tool.
About closed and stealth ports - there is no really difference between them Wilders Security Forums - View Single Post - [Rant] GRC's Shields Up! and "true stealth" - firewall test or harmful FUD?

HTH,
Creer

Hey Creer! Thanks much for this. I really am starting to feel secure now. I think the online scanners don't give the whole story (or at least you have to interpret them correctly!) Anyway, I downloaded and ran the Nmap-Zenmap program and I need to read up more on what its telling me but I think this is a good report. Here is what it said:

 

[gamepro127]

And why it is failed? Cause some ports are 'only' closed and should be stealth?

The TruStealth thingy

 

[Tews]

And why it is failed? Cause some ports are 'only' closed and should be stealth?

Is your machine any less secure with a closed port (access not possible) than with one that is stealthed (access not possible), I suggest not.

 

[Barman58]

The only possible advantage of a totally "stealthed" system is any potential hacker will not know the machine is there whilst a closed port at least confirms that there is a system at the particular address probed

 

[Tews]

But never the less your system is totally secure... They can beat their head against the wall till the cows come home, but they're still not getting in and at the end of the day, thats what its all about...

 

[Creer]

Hey Creer! Thanks much for this. I really am starting to feel secure now. I think the online scanners don't give the whole story (or at least you have to interpret them correctly!) Anyway, I downloaded and ran the Nmap-Zenmap program and I need to read up more on what its telling me but I think this is a good report. Here is what it said:

Hi Subsonic,

You are welcome.
Just remember you have to enter your current IP in Target field in Zanmap.
I've seen from your screen that probably you didn't do it.

Is your machine any less secure with a closed port (access not possible) than with one that is stealthed (access not possible), I suggest not.

Yes I realize that very well but most users looking only if they FW stealth all ports if not then they not satisfy... it's weired I know....

The only possible advantage of a totally "stealthed" system is any potential hacker will not know the machine is there whilst a closed port at least confirms that there is a system at the particular address probed

Not exactly...

People think that not responding to ping makes them invisible and the "hacker" will think there's no computer connected.

- If there was no computer with given address connected, they would get ICMP Destination Unreachable (ICMP Type 3) with one of the codes (such as 0 - net unreachable, 1 - host unreachable... etc).

- Whey they simply drop those packets (full stealth), they get a request time-out instead, so the router is clearly suggesting that there actually is a computer out there with such address, but it's dropping the ICMP packets...

People have to realize that there is no such thing as "invisible" on the Internet and differences between stealth and closed ports rely only on marketing approach FW vendors.

 

[Subsonic]

Hi Subsonic,

You are welcome.
Just remember you have to enter your current IP in Target field in Zanmap.
I've seen from your screen that probably you didn't do it.

I realized that after I looked at Zanmap a bit more. I've done a rescan with my IP in the target field. I get these results. I see "0 ports scanned" in the output. Does this mean that it couldn't scan them due to my firewall or does it not scan them because it can't scan on itself?

 

[Creer]

Subsonic you entered your router IP, I talked about you IP from ISP, you can check it eg here: Check and Map your Current IP address.