OK........I decided to take shellys and other advice to get a firewall other than XP's...

I bought this

http://www.agnitum.com/products/outpost/

After installing and re-booting i discovered i could not get the Internet, email, or any other Internet programs.....

I immediately uninstalled outpost pro and re-booted and now have my Internet back...

This also happened with the free version a few days ago , then i got gun shy on firewalls and was asking about routers, since then i relented and want a firewall because of the advice i got with my guys here.

Prior to in-stalling Out post i have also in-stalled

Trend Anti Virus and Spyware Pro

Super Anti Spyware Pro........

Spyware Blaster.........

Trojan remover paid version

Why is my Internet getting disabled when ever i try to install out post fire wall ??

should i disable all other programs with security??

The only program i know that's actually running with out enabling
is trend, maybe super anti spyware,spyware blaster i guess? and fast scan Trojan Remover


Help!!

priscilla


i-MAC newbie out of training

Having never used Out Post, I can't help much, but I suspect some other runing program is conflicting. You did shut down other real time security programs when you installed it I hope. Firewalls hook into Windows at a pretty deep level, so conflicts while installing can easily pop up.

Shelly

priscilla


i-MAC newbie out of training

Visit the Basement

I'll third that.

I'd like to hear from anyone who uses a third party firewall that has caught any malicious software trying to get out.

Behind every good computer... is a jumble of wires 'n stuff.

I have policies for Home owners insurance. Automobile insurance. Motorcycle insurance. Life insurance. Mal-practice insurance.

I've never used any of them. Following your logic, I should get rid of them because I've never used them.

No thanks. Just like a 2-way firewall, I'll keep the insurance policies because someday I may need the protection.

Jim.

Jim, you should keep your insurance policies. If something bad happens, they provide financial compensation. However your analogy is flawed. A better analogy for an outbound firewall would be an alarm like you would have on your home or business. Unfortunately an outbound firewall only sounds the alarm when the intruder tries to leave or remove your valuables from the premises. If some malware gets on your computer, and it's only purpose is to destroy or vandalize, the outbound firewall won't give you any notice.

I realize that an outbound firewall also blocks the unauthorized outbound traffic, but as CompPete pointed out, most users don't know how to tell the good guys from the bad guys.

BTW, you will never need your life insurance policy, your heirs might.

Behind every good computer... is a jumble of wires 'n stuff.

What gave you the impression that my life insurance policy was on my life?


As far as my insurance policies and 2 way firewall are concerned, I'm keeping them all, but then that won't surprise anyone.

Jim.

--------------------------------------
BANK OF AMERICA.COM ONLINE BANKING SUCKS IN THE HUGEST WAY IMAGINABLE

Newegg.com's new image gallery layout sucks in the hugest way imaginable too !
And now they're using JavaScript to "turn" pages to boot ! SUCKS

There may be a conflict with some other security program you have installed, but more than likely its a simple configuration of Outpost. As I mentioned in my other reply to you in your other thread when you asked about Outpost Firewall Pro I told you that not only was the company reliable but that they also have a most excellent Support Board. Why not take advantage of their help? If you bought just the Firewall and not the Suite, then it's the first forum. The people there will bend over backward to get you up and running quickly.

Jeff
simul iustus et peccator

priscilla


i-MAC newbie out of training

Well, that's all well and good. But what you did was write to the COMPANY support directly. My suggestion in the reply above was to ask for help on the SUPPORT BOARD where you will doubtless get immediate assistance.

How do I know this with such certainty? Because I used to work for Agnitum and was a very active member of that Board. So, I know those who run the Board and are involved in offering tech support.

Jeff
simul iustus et peccator

QUOTE:
Well, that's all well and good. But what you did was write to the COMPANY support directly. My suggestion in the reply above was to ask for help on the SUPPORT BOARD where you will doubtless get immediate assistance.

How do I know this with such certainty? Because I used to work for Agnitum and was a very active member of that Board. So, I know those who run the Board and are involved in offering tech support.

Jeff
simul iustus et peccator

priscilla


i-MAC newbie out of training

I have had Outpost since it was first released, support is excellent- as is the product.

As Pilgrim said go into the forum.

http://www.outpostfirewall.com/forum/

---------------------------------------------------------------------------------
Enjoy life while you can, don't try when you can't 'cos you won't, then it will be too late.

Ianw

priscilla


i-MAC newbie out of training

Not familiar with all versions of Trend, or even if there are other versions, but my daughter has a firewall in Trend, according to what she tells me.

Bill K.

priscilla


i-MAC newbie out of training

OK.I Uninstalled all my running security as outpost advised before installing....
then ran the program, downloaded it, installed it, rebooted, and still no internet

removed outpost again and got my Internet back again

i have a refund coming from out post

back at the starting gate i am....

priscilla


i-MAC newbie out of training

Thanks.......i may do just that.....

priscilla


i-MAC newbie out of training

I would not take it. NAT is not foolproof protection and is not a true firewall. NAT protection works by requiring that a computer on your local network (LAN has to initiate a connection from outside your local network to the internet(WAN). People somtimes do stupid things and go to sites without regard for their safety, or even knowing what they are doing. No NAT can protect you from yourself. and everyone can benefit from additional layers of protection.

This means that a malicious website can not access your computer without your knowledge. If however you deliberately connect to a malicious site, the NAT will not protect you, since you initiated the connection.

NAT was developed by Cisco Systems to compensate for the fact that IPV4 The protocol that we use today on the WEB does not provide enough unique IP addresses to handle the number of computers that can potentially connect to the internet. NAT groups multiple computers behind one IP address to temporarily reduce the need for more addresses in a world approaching a population of 10 billion.

IPV6 a new protocol will replace IPV4 which can only provide 2^32 IP address or only 4,294,967,296 addresses. IPV6 will be capable of providing 2^128 addresses which is equivalent to about 1,500 addresses for every square foot of the earth's surface, or looking at it another way, 2^52 IP addresses for every known star in the visible universe!

Obviously with IPV6 we will never run out of address space, and NAT will no loner be needed.

Please excuse the long and technical post. But some people here are living in a fools Paradise, thinking they have protection they really do not. I thought some accurate information was needed.

Shelly

Your technical post about NAT is essentially correct, but you are not addressing the issue at all. Also, what you're talking about is not really a "firewall" anyways, but an application filter.

A software firewall is not going to protect you from a "malicious web site" either. (I hope you're not thinking of that McAfee Site Advisor baloney or similar mechanisms that some of these security suites have because that is so ineffective it's worthy of ridicule. New systems are hijacked every minute and new domains are created to host these exploits in other cases where people are deliberately hosting malicious sites) You also initiated the connection, don't forget.

Moreover, most any good router employs more than just "NAT" these days, it does stateful packet inspection (SPI) which prevents spoofing. (This was the weakness of NAT... it could be fooled into thinking a remote computer was on the local network, at least for one way communications like SYN to provoke acknowledgement, or UDP. True IP spoofing is quite difficult, especially using non internet routable addresses)

If you really want to get technical, many routers have the capability to block outgoing ports as well. You can deny all, and only allow connections to certain remote ports. This is way beyond the expertise of most users though and they don't actually make full use of their router's firewalling capabilities. (This is a "true firewall"). Many routers also allow you to configure this by application, and configure the ports accordingly when a known application (its protocols) are specified as allowed. This too is unnecessary. NAT with SPI protects incoming and that's what counts the most.

The kind of outbound protection that those application filtering firewalls provide is more trouble than its worth. In most cases people either deny things they shouldn't and their activities come to a grinding halt (sometimes permanently if they don't know how to undo what they've done) or allow things they shouldn't and negate the protection anyways.

Even apart from your informed choices, that crap sometimes interferes with internal communication between apps and subsystems too. It's not entirely predictable... it doesn't take much to trip up other software or driver communication.

In most calls I get to the tune of "The Internet is broken" it's some security software stuffing things up.

To even have to think about that crap is trouble in the form of wasted time and annoyance. If you have to worry about something getting out, you're already owned and your security software is probably going to get compromised anyway. Besides, no matter what layer in the stack that shitware firewall is operating for both incoming and outgoing data... there's always one lower. At the very least Ring 0, the playground of rootkits which more and more trojans are making use of.

So go ahead and put 10 different locks on your door, it won't prevent someone from sneaking out the basement window, even in the unlikely event they got in.

Grogan

My point was that multiple layers of protection can give a user the opportunity to think about a decision one more time. There is no protection from ignorance, and we see users make uninformed decisions all the time. It was not to delve into technical complexity that would cause the readers eyes to glaze over.

Yes, I know about SPI, and I think you are the only person here I ever saw mention it, and know what it does. My purpose was to end the myth that $40 router is all the protection anyone needs. Real hardware firewalls are a lot more costly than that, and exist in the world of IT professionals.

There are good and bad software firewalls, and a bunch in between. Personally I use the one in the ESET software suite, It never interrupts me, but it is also not the most effective firewall.

What I am tired of is reading hundreds of posts about the protection of NAT being all anyone needs from users who have absolutely no idea of what NAT is or does, and could not effectively configure a router if their lives depended upon it.

This leads to complacency by those who need all the protection they can get. As you know anything that can attack ring 0 is more sophisticated than the OS being attacked, and as long as the bad guys can leapfrog the protection designed to stop them the battle will continue

Shelly

Shelly, you were the first person to mention NAT in this thread. I know what NAT and SPI are, and I have recommended and discussed routers with SPI in other threads. This debate is like Democrats vs. Republicans, neither side will concede to the other's views.

Behind every good computer... is a jumble of wires 'n stuff.

Sorry, but anytime anyone describes a router as afirewall, they are talking about NAT, whether they know it or not.

Shelly

Have you looked at the specs for any consumer grade routers lately? NAT only routers are a thing of the past. I don't think you will find any new routers that don't have SPI.

The real argument in this thread is over outbound firewalls. I think everyone agrees that some form of inbound firewall should be used, whether it's a router (depending on your definition or mine), the software firewall built into Windows XP and beyond, or a third party firewall that usually also includes an outbound firewall.

I'm curious, do you use a consumer grade router? Do you have any network printers or storage devices that would be vulnerable if someone hacked your network?

Behind every good computer... is a jumble of wires 'n stuff.

The XP firewall is only for incoming. Vista was the first Windows version with a two way firewall.

Shelly

That's what I said, inbound.

Behind every good computer... is a jumble of wires 'n stuff.

Shelly

You must have missed the commas.

A portion of my post #28 edited to clarify my statements...

The real argument in this thread is over outbound firewalls. I think everyone agrees that some form of inbound firewall should be used, whether it's:
- a router (depending on your definition or mine)
- the software firewall built into Windows XP and beyond
- or a third party firewall that usually also includes an outbound firewall.

I hope you now understand what I was trying to say.

Behind every good computer... is a jumble of wires 'n stuff.

Grogan

priscilla


i-MAC newbie out of training

Yes, the firewall in Windows XP SP3 is of course the same.

Grogan

priscilla


i-MAC newbie out of training

A firewall is a packet filter (using various methods to allow or deny packets).

Any time someone describes a router in here, they are talking about a consumer grade NAT gateway device. You can't even call it a router, because that's only one function of it.

It's a gateway, dhcp server, internet client, router, switch, firewall and (usually) wireless access point combined in one device.

I have a "firewall" device that also serves as a NAT gateway if you want to mince terms. It's all the above (except for wireless), but it's sold as a firewall rather than a broadband router. Yes, it was hundreds of dollars but at the time it was worth it, because it's an extremely reliable device. I'm still using it 6 years later... It's the centurion posted at the gate that feeds all other network hardware in the house.

I can also flash the firmware of many consumer grade routers and turn them into whatever I want. I can also take an old PC and turn it into a more sophisticated firewall than any black box.

Grogan

Yes, I'm talking about using a Linux kernel to implement kernel level firewall rules, essentially creating your own hardware firewall. It's multi homed and sits in between your network and the Internet. It's not that different from a black box type hardware firewall, except that you have a lot more control over what it does.

IPCop is a Linux distribution you install that takes exclusive control of the PC and it implements this, and provides a web based configuration interface for those who can't do it themselves. You can't use the machine for anything else, and you may be limited to the functionality they provide in the web interface.

If you know what you want to do, you just have to put the commands in a script. I have an old Pentium 3 box that's normally my fileserver, but if my DSL link goes down I have it set up so I just have to uncomment a few lines and reboot the thing (not necessary, but it's the easiest way to have the scripts run) and it's a dialup server for the network, with firewall rules protecting network services on the box. The ports are closed to the PPP interface, but available on the local network. It uses connection tracking and NAT to supply internet to all the computers behind it. Slow, but reliable dialup... good old fashioned ISA modem in the box. Yes, I can still use the box as my fileserver while I'm doing this. Nothing is exposed to the Internet.

Grogan

Hmm yes I got into ipcop a few years ago when my wife was running her business, and we needed separation home / office. it sort of fell by the wayside, but im thinking of resurecting it. I like the fact that you get updates regularly. It also has a facility to run wireless as well on a separate network, with that network unable to get to the normal home network. good for visitors with laptops. minimal risk.
Im currently on an old nokia m1122. May be time to have an upgrade?
Ant

(hardware, my word) "Firewall Replacement"
http://www.dslreports.com/forum/r22732330-Firewall-Replacement

--------------------------------------
BANK OF AMERICA.COM ONLINE BANKING SUCKS IN THE HUGEST WAY IMAGINABLE

Newegg.com's new image gallery layout sucks in the hugest way imaginable too !
And now they're using JavaScript to "turn" pages to boot ! SUCKS

Not really, no. Ring 0 is just kernel mode in Windows (and Unix). It's more a matter of execution privileges than being more sophisticated. Anything running in kernel mode (get a kernel mode driver loaded) can step on anything else. Some microkernel OSes separate out kernel mode drivers from core kernel code (into a "ring 1") but ours don't until we get into user mode drivers. Newer CPUs have even lower levels of execution modes for hypervisors and low level management code ("ring -1" they are calling it lol) but I was only talking about good old fashioned kernel mode privileges.

As for the Eset Smart Security software firewall, that's a sensible one... not one of those complex, annoying and interfering application filters. I don't hate that one.

Grogan

(I don't know if it's true, but ...)

"Virus Could Cripple Intel Processors Worldwide!"
http://www.programmerfish.com/virus-could-cripple-intel-processors-worldwide/

--------------------------------------
BANK OF AMERICA.COM ONLINE BANKING SUCKS IN THE HUGEST WAY IMAGINABLE

Newegg.com's new image gallery layout sucks in the hugest way imaginable too !
And now they're using JavaScript to "turn" pages to boot ! SUCKS

I think this is an interesting and useful conversation - there's no right answer. My back-story is that after a decade of dialup, I finally got some kind of broadband (wireless broadband on my desktop.) Also, after years of Outpost, about 2 years ago I went looking to change, mostly because I don't like suite software.

So, first I tried three different software firewalls, settled on one but in the 2 years since, never got happy. Never understood how to set it up, didn't get the interface and the nags never stopped. Big change from my old Outpost, which had its quirks, but was pretty transparent.

Then I finally got broadband, with router, and had to have this very conversation with myself. Decided on keeping the software firewall, but went looking to change again. Found OP free and I'm very happy with it (in the old days, when OP was strictly a FW the free version was a joke, but now that it's a suite, the free is just fine if all you want is the FW.)

But a day doesn't go by that I don't wonder if I'm wasting my time. To get rid of the nags I've got "Host control" disabled but for one element - component control - that means no so-called "anti-leak" control. So, being behind a (SPI) router I'm immune to anything getting in that I didn't invite. But if I accidentally invite something in, I've got the primary defense against it getting out turned mostly off. And the only reason I can give for having it (swfw) at all is, well, it just makes me feel better. Sigh ...

Just to think.i started this tread.....
its so involved, i feel sooooooo techie.....

priscilla


i-MAC newbie out of training

after it was installed is there not an option on the task bar right click to enter auto learn mode.? that might then get you up and running on net etc. I ask as i have the free version and it has that option
Ant

priscilla


i-MAC newbie out of training

"Firewalls"
http://kb.mozillazine.org/Firewalls

"Error loading websites"
http://kb.mozillazine.org/Error_loading_websites

--------------------------------------
BANK OF AMERICA.COM ONLINE BANKING SUCKS IN THE HUGEST WAY IMAGINABLE

Newegg.com's new image gallery layout sucks in the hugest way imaginable too !
And now they're using JavaScript to "turn" pages to boot ! SUCKS

priscilla


i-MAC newbie out of training