Solved Seeking a certain firewall

[DavidUK]

I want a firewall for Win 7 starter to perform very specific program control. This is why:

When away from home, I connect my phone to provide minimal 3g internet access for my netbook. When I did so last time, within 10mins I had used 200MB even though I have all auto-updates (that I am aware of) turned off.

I am not interested in chasing the source of data usage. Instead, I want to ditch Zonealarm free and replace it with a firewall to strictly control inbound and outbound program access to the internet when using 3g data. I want a firewall that will ask about every connection, every time. I don't want one that will provide 'intelligent' permissions (e.g. Zonealarm), or one that remembers if permission has been previously granted (e.g. Zonealarm).

Any recommendations? Your experience is valued.

P.S. I am not interested in replies such as 'Get MSE - it's really good'. I'm looking for an experienced technical reply.

 

[Gary]

I use Avast Internet Security and it's firewall can be controlled down to the program level. It is not free but it works.

avast! Internet Security | Antivirus & Anti-spyware with Firewall & Antispam

 

[DavidUK]

Thanks Gary
What about window services, can you configure them or are they approved automatically?

 

[Gary]

Thanks Gary
What about window services, can you configure them or are they approved automatically?

I am not too sure about that. I have never tried to. I just disable the service if I don't need it. You can check HERE

Someone should be able to answer that.

 

[georgehagi]

i can say use comodo it is the best firewall in my opinion controls all over connections

 

[Jacee]

Online Armor's new personal firewall provides awesome protection from inbound threats and complete control of data leaving your computer for the internet

This is a free firewall Free Online Armor Firewall Software - Overview

 

[Sentinel72]

I would highly recommend comodo firewall as this is what i use.I use the custom ruleset and it will alert to every outbound connection that i configure it to.The settings are more extensive than online armor in my opinion.

 

[carwiz]

I am not interested in chasing the source of data usage. Instead, I want to ditch Zonealarm free and replace it with a firewall to strictly control inbound and outbound program access to the internet when using 3g data.

That's not possible since all net traffic/applications will use whatever web connection is available unless the connection is defined as a separate network on your PC. The last thing I would want to do is add more overhead (software) to an already taxed processor. Windows 7 Firewall does everything the add-on software does and it's seamless to Windows. "Chasing the source" of net traffic is exactly what you want to do.

Most OEM Windows installations contain many "utilities" that are just additional layers of software that Windows already performs. Many of these applications will also "phone home" to check for updates just as Windows does at every startup. You might consider changing Windows' update option to manual as well as un-installing burdensome OEM software. Your Netbook will run faster and smoother without needless overhead when you're on the road (3G).

 

[Alejandro85]

I think Windows built-in firewall is an option for such level of control. Look for the "Firewall with advanced security" option to open the control panel. There you can enable outgoing filtering (disabled by default) and setup incoming and outgoing rules, by port, protocol, program and hosts.

The trick to do what you want is the "network profile" filtering. It allows to filter a rule based on the public/home/work network type. So if you make your home network card to be "home", and the 3g phone network card to be "public network", when you make a rule to use only a private network, it will be blocked from the phone, but allowed though home network.

The main drawback is that it does not shows notifications for blocked connections (much less every time, which seems quite annoying). If you want those, maybe Comodo firewall is a better option, but no idea if it supports the home/public filtering.

 

[DavidUK]

That's not possible since all net traffic/applications will use whatever web connection is available unless the connection is defined as a separate network on your PC.

Sorry, my comment was misleading. I don't mean that I need to be able to switch between 'wifi' and '3g' modes, I just mean I want to be able to manually deny traffic - which I will then do when on 3g.

Many of these applications will also "phone home" to check for updates just as Windows does at every startup. You might consider changing Windows' update option to manual as well as un-installing burdensome OEM software. Your Netbook will run faster and smoother without needless overhead when you're on the road (3G).

Yes, every update function I can find is set to manual.

I think Windows built-in firewall is an option for such level of control. Look for the "Firewall with advanced security" option to open the control panel. There you can enable outgoing filtering (disabled by default) and setup incoming and outgoing rules, by port, protocol, program and hosts.

Doh! I did not know windows FW could filter outbound! What an idiot - I'll definitely look at that.

The trick to do what you want is the "network profile" filtering. It allows to filter a rule based on the public/home/work network type. So if you make your home network card to be "home", and the 3g phone network card to be "public network", when you make a rule to use only a private network, it will be blocked from the phone, but allowed though home network.
The main drawback is that it does not shows notifications for blocked connections (much less every time, which seems quite annoying). If you want those, maybe Comodo firewall is a better option, but no idea if it supports the home/public filtering.

Clever - I'll try that too.


Many thanks guys - some really useful advice! I'll play with windows FW, comodo, online-armor and see what works best.

 

[DavidUK]

Update:
Brilliant! @Alejandro85 you set me off on the correct track - although I confess some of the technicalities are beyond me. Documented here for future readers....

To summarise the problem:
Win7 on a netbook. Sometimes connected to a mobile phone when travelling for brief internet use. On one occasion however, large amounts of 3g data were rapidly consumed, even though all automatic updating is disabled.

Solutions suggested and tested:
Initially, I was searching for a firewall that would allow each program to be blocked each time (i.e. answers were not remembered) so that I could block any data traffic I did not require during 3g use. Online-armor looked promising and did just that, but there were so many unidentifiable services and connections popping-up requesting permission, it was impossible to keep up with the requests. I started to realise then that I may not be able to do what I wanted. Comodo was recommended, but (I am embarrassed to say) I could not find the settings for individual program control in the free version - online instructions showed a different version, I think. Also, some of the comodo pages are too big to display on my small screen (OK, Apply and Cancel buttons are not visible - this means I have to tab through the buttons and guess which one is 'OK'. This is a common problem with the small netbook, and really bad programming).

Solution:
Windows firewall. I did not know that it could be configured to control outbound requests also. I followed these instructions for a basic setup, but the gist of it is as follows -

1) Start > Control Panel > Administrative tools > Windows Firewall with advanced security (make a shortcut on the desktop for easy access).

2) Backup. Over on the right, use 'export policy' to create a backup of the firewall settings you currently have (no need to explain why!).

3) Highlight 'windows firewall with advanced...' on the left. Click 'Windows firewall properties' at the bottom of the 'overview' box.

4) Do some research. There are tabs for Domain, private and public. From what I could gather, when you connect your pc to a network, the networking centre asks is it 'home', 'work' or 'public'. My home wifi is 'home', which is regarded by the firewall as 'private'. When I connect via 3g, the connection is 'public', which the firewall regards as 'public'. You can see now that it is possible for me to have automatically switching levels of firewall control, depending on which connection I am using.

5) Click on 'Private Profile' tab. You'll see that outbound connections are allowed by default. Now click on 'Public Profile' tab and set outbound connnections to block. Click on OK. (Note that you can block them in any profile you like - so when you are testing, you might want to play with the 'Private Profile' if that's the one you are connected to.) From now on, NO APPLICATIONS CAN CONNECT TO THE INTERNET.

6) When on 3g, I just want to use chrome to access the Waze map editor (not really feasible to use a mobile phone browser). So I made a rule to allow chrome. Over on the left, click 'outbound rules'.

7) Then on the right, click 'new rule'.

8) Select 'program' > next > enter the path to the chrome executable (took some finding - tip = from the start menu, right-click on the chrome icon and select properties and copy the 'target' field as the path - this doesn't work for all paths, but allows you to find the thing so you can browse to it within the rule wizard) > next.

9) 'Allow the connection' > next

10) Choose which profile to apply this to. I kept all three ticked, as I am only enabling blocking in one profile, so if I choose to block in another profile, I know the rule will still be valid. > next.

11) Name and describe > finish. The rule appears at the top of the list.

I thought there might be issues with some background services being blocked and the internet connection failing (as I found when I tried to block everything within online-armor, but all was fine. Now I can only connect with Chrome - windows update is blocked, so is MSE update and any other application I have tried - so simple.

Disadvantages:

• Blocking is silent. One advantage of a pop-up alert is that malware can reveal itself when it asks for permission to connect.
• Outbound connections are allowed by default in the unrestricted profiles, so one might like to block and create rules for every action (lots of work).
• It's quite a technical setup. I'm sure there are a ton of issues that I am unaware of.

 

[DavidUK]

Further update:
The free version of this would also do the trick if the 'once only' blocking is used. I've just installed it on an XP machine and have been very impressed with it's function.