Escan/english/firewall

From eScan Wiki

(Difference between revisions)

Current revision

· eScan · MailScan · Technologies

· Technical Info · Security Awareness · User Guides

eScan Version 10 Online Help

Firewall

1 eScan Version 10 Online Help
2 Description
3 Status in main Protection Center Window
4 Configuration section
5 Reports section
6 Enforcement of Firewall Rules
7 Glossary
8 Main Feature Index

Description

Firewall monitors all incoming and outgoing network activities in your system and also protects from all network based attacks.

Firewall is a comprehensive feature that is designed to prevent unauthorized access to a computer or network that is connected to the Internet. It enforces a boundary between two or more networks by implementing default or user-defined access-control policies (rules) between two or more networks. The user can set rules to control incoming network access to their system as well as outgoing traffic from their system. Rules are user defined / created or selected either to allow or block any outgoing or incoming traffic. The Firewall checks the rules and analyzes the network packets (small chunks of data) and filter. If they fulfill the criteria defined in the Rules, they are allowed to pass through or else discard them.

Within the software, are provided set of predefined rules that can be added to the firewall by selecting those that are appropriate to one’s security needs. Users can define their own ‘rules’, and when they don’t feel the need for any of the rules they have ‘added’, they can remove them.

Vulnerable Scenarios - A user is vulnerable to hacker attack when their system connects to a public network

- When you log in to chat, you connect to Internet Relay Chat (IRC) servers on the Internet and join others in the numerous ‘channels’ on the IRC network.

- When you use Telnet to connect to a server on the Internet and execute commands ‘on’ the server from your computer.

- When you use FTP to transfer files from a remote server to your computer. FTP is the File Transfer Protocol for exchanging files over the Internet, and works in the same way that HTTP and SMTP do in transferring Web pages from servers to user’s browser and transferring e-mail across the WWW respectively.

- When you use NetBIOS (Network Basic Input/Output System) to communicate with another user on the LAN; the LAN could in turn be connected to the Internet. NetBIOS insulates the applications that users use to communicate with one another, from understanding the underlying network details.

- When you are a part of a Virtual Private Networks (VPN). These private network connections communicate ‘securely’ over a public network, such as the Internet.

- When you browse the Web.

- When you send/receive e-mail.

Status in main Protection Center Window

The green colored Tick (√) mark indicates the Firewall is active and running.

The red colored Cross mark (X) indicates the Firewall is inactive and stopped.

Configuration section

Status:

Firewall Status – This will display whether the Firewall is Running or Disabled.

Action – This will display the Firewall Mode.

Buttons

Allow All – Clicking on this button will disable the eScan Firewall i.e. all the incoming and outgoing network traffic will not be monitored / filtered.

Limited Filter – Clicking on this button will enable eScan Firewall in limited mode which will monitor all incoming traffic only and will be allowed / blocked as per the conditions or rules defined in the Firewall.

Interactive - Clicking on this button will enable eScan Firewall to monitor all the incoming and outgoing network traffic and will be allowed / blocked as per the conditions or rules defined in the Firewall.

Block All button – Clicking on this button will enable eScan Firewall to block all the incoming and outgoing network traffic.

Settings – To configure the Firewall, click on the Settings button.

A. Zone Rule - This is a set of network access rules to make the decision of allowing / blocking of the access to the system. This will contain the source IP address or source Host name or IP range either to be allowed or blocked.

Buttons (to configure a Zone Rule)

Add Host Name – This option enables you to add a "host" in the Zone Rule. When clicked on this button, enter the HOST name of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
Add IP – This option enables you to add an IP address of a system to be added in the Zone rule. When clicked on this button, enter the IP address of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
Add IP Range – This option enables you to add an IP range to be added in the Zone rule. When clicked on this button, add the IP Range (i.e. a range of IP that the Zone rule should be applied), select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
Modify – To modify / change any listed Zone Rule(s), click on the Modify button.
Remove - To delete any listed Zone Rule(s), click on the remove button.

B. Expert Rule – This rule is recommended for experienced users with expertise in Firewall security and networking protocols. Expert rule is based on the following below attributes:

Source IP Address / Host Name
Source Port Number
Destination IP Address / Host Name
Destination Port Number

Buttons (to configure an Expert Rule)

Add – Click on the Add button to create a new Expert Rule. In the Add Firewall Rule Window:

i. General tab – In this section, specify the Rule settings

Rule Name – Provide a name to the Rule,
Rule Action – Action to be taken, whether to Permit Packet or Deny Packet,
Protocol – Select the network protocol (eg.TCP, UDP, ARP etc…) on which the Rule will be applied
Apply rule on Interface – Select the Network Interfac on which the Rule will be applied.

ii. Source tab – In this section, specify / select the location from where the outgoing netowork traffic originates.

Source IP Address –

My Computer – The rule will be applied for the outgoing traffic originating from your computer.

Host Name – The rule will be applied for the outgoing traffic originating from the computer as per the host name specified.

Single IP Address – The rule will be applied for the outgoing traffic originating from the computer as per the IP address specified.

Whole IP Range – To enable the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the outgoing traffic from the computer(s) which is within the defined ip range.

Any IP Address – When this option is selected, the rule will be applied for the traffic originating from ANY IP Addresses.

Source Port –

Any – When this option is selected, the rule will be applied for the outgoing traffic originating from ANY port(s).

Single Port – When this option is selected, the rule will be applied for the outgoing traffic originating from the specified / defined port.

Port Range – To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the outgoing traffic originating from the port which is within the defined range of ports.

Port List – A list of port can be specified / added. The rule will be applied for the outgoing traffic originating from the ports as per specified in the list.

NOTE: The rule will be applied when the selected Source IP Address and Source Port matches together.

iii. Destination tab – In this section, specify / select the location of the computer where the incoming network traffic is destined.

Destination IP Address –

My Computer – The rule will be applied for the incoming traffic to your computer.

Host Name – The rule will be applied for the incoming traffic to the computer as per the host name specified.

Single IP Address – The rule will be applied for the incoming traffic to the computer as per the IP address specified.

Whole IP Range – To apply the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the incoming traffic to the computer(s) which is within the defined IP range.

Any IP Address – When this option is selected, the rule will be applied for the incoming traffic to ANY IP Addresses.

Destination Port –

Any – When this option is selected, the rule will be applied for the incoming traffic to ANY port.

Single Port – When this option is selected, the rule will be applied for the incoming traffic to the specified / defined port.

Port Range – To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the incoming traffic to the port which is within the defined range of ports.

Port List – A list of port can be specified / added. The rule will be applied for incoming traffic originating from the ports as per specified in the list.

NOTE: The rule will be applied when the selected Destination IP Address and Destination Port matches together.

iv. Advanced tab – This tab contains advance setting for Expert Rule.

Enable Advanced ICMP Processing - This is activated when the ICMP protocol is selected in the General tab.
The packet must be from/to a trusted MAC address – When this option is selected, the rule will only be applied on the MAC address defined / listed in the Trusted MAC Address tab.
Log information when this rule applies – This will enable to log information of the Rule when it is implied.

Modify – This button will enable to change or modify any Expert Rule.

Remove – This button will delete a rule from the Expert Rule.

Default Rules – This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.

Up and Down Arrows – The UP and DOWN arrow button will enable to move the rules up or down as required and will take precedence over the rule listed below it.

Other options on Right Click on any rule

Enable Rule / Disable Rule –When clicked on this option this will either enable or disable the selected rules. The option toggles between Enable and Disable rule.

C. Application Rule – This rule is based on the Programs / Application(s) that is permitted / denied to access the Internet or any Network services. For e.g. Internet Explorer.

Buttons (to configure an Application Rule).

Add – To add a new Application rule click on the Add button and browse and locate the executable file and select the action to be taken i.e. either Permit or Deny.
Remove – This button will delete a rule from the Application Rule.
Default Rules - This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.

To change / modify actions on a particular Application rule, you can right click on the applications.

Other options on Right Click on any rule

Ask –When the selected application is executed, eScan Firewall will prompt whether to allow this application to be permited / denined. (Rule Color code – Gray).

Permit - When the selected application is executed, eScan Firewall will allow this application to run. (Rule Color code – Green).

Deny - When the selected application is executed, eScan Firewall will stop this application from running. (Rule Color code – Red).

Process Properties – This will display the properties of the selected process / executable file.

Process Details – This will provide the online detail of the selected process / executable file.

D. Trojan Rule – This rule is based on predefined rules set by MicroWorld on the basis of our database and research of various Trojans that exploits the Network Services like accessing a system in the network. This rule is similar to settings in the Expert Rule.

NOTE: This feature was available only prior to eScan version 10.0.968.374 and have been removed after this version.

E. Trusted MAC Address – This section contains the information of the MAC address of the system. A MAC address (Media Access Control address) is a hardware address that uniquely identifies each node of a network. The Trusted MAC address list will be checked alongwith the Expert Rule only when "The packet must be from/to a trusted MAC address" option is checked and the action will be as per specified in the rule. (refer to the Advance Tab of the Expert Rule).

Buttons (to configure the Trusted MAC Address)

Add – To add a MAC address click on this button. Enter the MAC address to be added in the list for eg. 00-13-8F-27-00-47
Edit – To modify / change the MAC Address click on this button.
Remove – To delete the MAC Address click on this button.
Clear All – To delete all the listed MAC Address click on this button.

F. Local IP List – This section contains a list of Local IP addresses.

Buttons (to configure the Local IP List)

Add – To add a Local IP address click on this button.
Remove – To remove a Local IP address click on this button.
Clear All – To clear all the Local IP address in the list click on this button.
Default List – To load the default list of IP address click on this button.

Other Buttons

Clear Alert Cache - This option will clear / delete all the information stored by the Firewall cache

Show Application Alert – Selecting this option will display an eScan FireWall Alert displaying the blocking of any application as defined in the Application Rule.

Reports section

Statistics

Inbound Traffic Allowed – Displays the number of allowed incoming traffic.
Outbound Traffic Allowed - Displays the number of allowed outgoing traffic.
Inbound Traffic Blocked - Displays the number of blocked incoming traffic.
Outbound Traffic Blocked - Displays the number of blocked outgoing traffic.

a. View Current Network Activity – This will display all the network activities including Active connections and Established Connections. This will contain the information of the process, protocol, local address and the remote address and the status of each network connection.

b. View Summary – Clicking on this option can create a Summary / Detailed report.

A Summary report will consist of information of the rules that has been invoked and applied by the Firewall. Rules like Application Rule, Expert Rule, Zone Rule, Trojan Rule. A Detailed report will consists of information of the rules including the Network Activity. The report also consists of Graphical reports.

c. View Report – Clicking on this option will display the Incoming and Outgoing traffic which is Allowed or Blocked.

Enforcement of Firewall Rules

Any Network packets that are received / sent on or from a Network Interface, eScan Firewall will first check the rules in the following order:

1^st^ – Trojan Rules

NOTE: This feature was available only prior to eScan version 10.0.968.374 and have been removed after this version.

2^nd^ – Zone Rules

3^rd^ – Expert Rules

4^th^ – Application Rules

Glossary

Main Feature Index

Retrieved from "https://wiki.escanav.com/wiki/index.php/Escan/english/firewall"

Welcome to eScan Wikipedia

From eScan Wiki

Current revision

eScan Version 10 Online Help

Contents

Description

Status in main Protection Center Window

Configuration section

Reports section

Enforcement of Firewall Rules

Glossary

Main Feature Index

Main Page

Latest Developments

Product Information

Knowledge Base

For Windows Downloads

For Linux Downloads

For MAC Downloads

General

Support

Views

-'''Firewall'''
+{| class="wikitable" border="0"
+|-
+{| id="mp-topbanner" style="width:100%; background:#fcfcfc; margin-top:1.2em; border:1px solid #ccc;"
+| style="width:10%; color:#000;" |
+{| style="width:100px; border:none; background:none;"
+| [[Image:escan-g.jpg]]
+|}
+|style="text-align:left;"|'''·''' [[Escan/english/FAQ-eScan|<font size=1.5 color="blue"
+align="left">eScan</font>]]&nbsp;&nbsp;'''·''' [[Escan/english/MailScan-AFT|<font size=1.5
+color="blue">MailScan</font>]]&nbsp;&nbsp;'''·''' [[Escan/english/Technologies|<font size=1.5
+color="blue">Technologies</font>]]
+|style="text-align:right;"|&nbsp;&nbsp;'''·''' [[Technical Info|<font size=1.5 color="blue">Technical
+Info</font>]]&nbsp;&nbsp;'''·''' [[Escan/english/Security_Awareness|<font size=1.5 color="blue">Security
+Awareness</font>]]&nbsp;&nbsp;'''·''' [[User_Guides|<font size=1.5 color="blue">User Guides</font>]]
+|}
+{| class="wikitable" border="0"
+|}
+<h2  id="mp-tfp-h2" style="margin:0; background:#C7E587; font-size:120%; font-weight:bold; border:10 solid #afa3bf; text-align:left; color:#000; padding:0.2em 0.4em">eScan Version 10 Online Help</h2>
+{| class="wikitable" border="0"
+|}
+<font size=4>'''Firewall'''</font>
+__TOC__
 =='''Description'''==
 Firewall monitors all incoming and outgoing network activities in your system and also protects from all network based attacks.
-'''Firewall''' is a comprehensive feature that is designed to prevent unauthorized access to a computer or network that is connected to the Internet. It enforces a boundary between two or more networks by implementing default or user-defined access-control policies (rules) between two or more networks.
+<B>'''Firewall'''</B> is a comprehensive feature that is designed to prevent unauthorized access to a computer or network that is connected to the Internet. It enforces a boundary between two or more networks by implementing default or user-defined access-control policies (rules) between two or more networks.
 The user can set rules to control incoming network access to their system as well as outgoing traffic from their system. Rules are user defined / created or selected either to allow or block any outgoing or incoming traffic. The Firewall checks the rules and analyzes the network packets (small chunks of data) and filter. If they fulfill the criteria defined in the Rules, they are allowed to pass through or else discard them.
 A user is vulnerable to hacker attack when their system connects to a public network
-- When you log in to chat, you connect to Internet Relay Chat (IRC) servers on the Internet and join others in the numerous ‘channels’ on the IRC network.
+:- When you log in to chat, you connect to Internet Relay Chat (IRC) servers on the Internet and join others in the numerous ‘channels’ on the IRC network.
-- When you use Telnet to connect to a server on the Internet and execute commands ‘on’ the server from your computer.
+:- When you use Telnet to connect to a server on the Internet and execute commands ‘on’ the server from your computer.
-- When you use FTP to transfer files from a remote server to your computer. FTP is the File Transfer Protocol for exchanging files over the Internet, and works in the same way that HTTP and SMTP do in transferring Web pages from servers to user’s browser and transferring e-mail across the WWW respectively.
+:- When you use FTP to transfer files from a remote server to your computer. FTP is the File Transfer Protocol for exchanging files over the Internet, and works in the same way that HTTP and SMTP do in transferring Web pages from servers to user’s browser and transferring e-mail across the WWW respectively.
-- When you use NetBIOS (Network Basic Input/Output System) to communicate with another user on the LAN; the LAN could in turn be connected to the Internet. NetBIOS insulates the applications that users use to communicate with one another, from understanding the underlying network details.
+:- When you use NetBIOS (Network Basic Input/Output System) to communicate with another user on the LAN; the LAN could in turn be connected to the Internet. NetBIOS insulates the applications that users use to communicate with one another, from understanding the underlying network details.
-- When you are a part of a Virtual Private Networks (VPN). These private network connections communicate ‘securely’ over a public network, such as the Internet.
+:- When you are a part of a Virtual Private Networks (VPN). These private network connections communicate ‘securely’ over a public network, such as the Internet.
-- When you browse the Web.
+:- When you browse the Web.
-- When you send/receive e-mail.
+:- When you send/receive e-mail.
-'''Status displayed in the main Protection Window''':-
+=='''Status in main Protection Center Window'''==
-The green colored Tick mark indicates the Firewall is active and running.
+The <B><font color="Green"> '''green''' </font></B> colored Tick <U><B><font color="Green">(√)</font></B></U> mark indicates the Firewall is active and running.
-The red colored Cross mark indicates the Firewall is inactive and stopped.
+The <B><font color="Red"> '''red''' </font></B> colored Cross mark <U><B><font color="Red">(X)</font></B></U> indicates the Firewall is inactive and stopped.
 =='''Configuration section'''==
-''Status: ''
+:''Status: ''
-* Firewall Status – This will display whether the Firewall is Running or Disabled.
+:* Firewall Status – This will display whether the Firewall is Running or Disabled.
-* Action – This will display the Firewall Mode.
+:* Action – This will display the Firewall Mode.
-'''Buttons'''
+:'''Buttons'''
-''Allow All'' – Clicking on this button will disable the eScan Firewall i.e. all the incoming and outgoing network traffic will not be monitored / filtered.
+:''Allow All'' – Clicking on this button will disable the eScan Firewall i.e. all the incoming and outgoing network traffic will not be monitored / filtered.
-''Limited Filter'' – Clicking on this button will enable eScan Firewall in limited mode which will monitor all incoming traffic only and will be allowed / blocked as per the conditions or rules defined in the Firewall.
+:''Limited Filter'' – Clicking on this button will enable eScan Firewall in limited mode which will monitor all incoming traffic only and will be allowed / blocked as per the conditions or rules defined in the Firewall.
-''Interactive'' - Clicking on this button will enable eScan Firewall to monitor all the incoming and outgoing network traffic and will be allowed / blocked as per the conditions or rules defined in the Firewall.
+:''Interactive'' - Clicking on this button will enable eScan Firewall to monitor all the incoming and outgoing network traffic and will be allowed / blocked as per the conditions or rules defined in the Firewall.
-'''Block All button''' – Clicking on this button will enable eScan Firewall to block all the incoming and outgoing network traffic.
+:'''Block All button''' – Clicking on this button will enable eScan Firewall to block all the incoming and outgoing network traffic.
-''Settings'' – To configure the Firewall, click on the Settings button.
+:''Settings'' – To configure the Firewall, click on the Settings button.
-'''A. Zone Rule - '''This is a set of network access rules to make the decision of allowing / blocking of the  access to the system. This will contain the source IP address or source Host name or IP range either to be allowed or blocked.
+:'''A. Zone Rule - '''This is a set of network access rules to make the decision of allowing / blocking of the  access to the system. This will contain the source IP address or source Host name or IP range either to be allowed or blocked.
-''Buttons (to configure a Zone Rule)''
+::''Buttons (to configure a Zone Rule)''
-## Add Host Name – This option enables you to add a "host" in the Zone Rule. When clicked on this button, enter the HOST name of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
+::# Add Host Name – This option enables you to add a "host" in the Zone Rule. When clicked on this button, enter the HOST name of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
-## Add IP – This option enables you to add an IP address of a system to be added in the Zone rule. When clicked on this button, enter the IP address of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
+::# Add IP – This option enables you to add an IP address of a system to be added in the Zone rule. When clicked on this button, enter the IP address of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
-## Add IP Range – This option enables you to add an IP range to be added in the Zone rule. When clicked on this button, add the IP Range (i.e. a range of IP that the Zone rule  should be applied), select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
+::# Add IP Range – This option enables you to add an IP range to be added in the Zone rule. When clicked on this button, add the IP Range (i.e. a range of IP that the Zone rule  should be applied), select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
-## Modify – To modify / change any listed Zone Rule(s), click on the Modify button.
+::# Modify – To modify / change any listed Zone Rule(s), click on the Modify button.
-## Remove - To delete any listed Zone Rule(s), click on the remove button.
+::# Remove - To delete any listed Zone Rule(s), click on the remove button.
-'''B. Expert Rule – '''This rule is recommended for experienced users with expertise in Firewall security and networking protocols. Expert rule is based on the following below attributes:
+:'''B. Expert Rule – '''This rule is recommended for experienced users with expertise in Firewall security and networking protocols. Expert rule is based on the following below attributes:
-* Source IP Address / Host Name
+::* Source IP Address / Host Name
-* Source Port Number
+::* Source Port Number
-* Destination IP Address / Host Name
+::* Destination IP Address / Host Name
-* Destination Port Number
+::* Destination Port Number
-''Buttons (to configure an Expert Rule)''
+::''Buttons (to configure an Expert Rule)''
-'''Add''' – Click on the Add button to create a new Expert Rule. In the Add Firewall Rule Window.
+::'''Add''' – Click on the Add button to create a new Expert Rule. In the Add Firewall Rule Window:
-i. General tab – In this section, specify the Rule settings
+:::i. General tab – In this section, specify the Rule settings
-** Rule Name – Provide a name to the Rule,
+::::* Rule Name – Provide a name to the Rule,
-** Rule Action – Action to be taken, whether to Permit Packet or Deny Packet,
+::::* Rule Action – Action to be taken, whether to Permit Packet or Deny Packet,
-** Protocol – Select the network protocol (eg.TCP, UDP, ARP etc…) on which the Rule will be applied
+::::* Protocol – Select the network protocol (eg.TCP, UDP, ARP etc…) on which the Rule will be applied
-** Apply rule on Interface – Select the Network Interfac on which the Rule will be applied.
+::::* Apply rule on Interface – Select the Network Interfac on which the Rule will be applied.
-ii. Source tab – In this section, specify / select the location from where the outgoing netowork traffic originates.
+:::ii. Source tab – In this section, specify / select the location from where the outgoing netowork traffic originates.
-** Source IP Address –
+::::* Source IP Address –
-My Computer – The rule will be applied for the outgoing traffic originating from your computer.
+:::::My Computer – The rule will be applied for the outgoing traffic originating from your computer.
-Host Name – The rule will be applied for the outgoing traffic originating from the computer as per the host name specified.
+:::::Host Name – The rule will be applied for the outgoing traffic originating from the computer as per the host name specified.
-Single IP Address – The rule will be applied for the outgoing traffic originating from the computer as per the IP address specified.
+:::::Single IP Address – The rule will be applied for the outgoing traffic originating from the computer as per the IP address specified.
-Whole IP Range – To enable the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the outgoing traffic from the computer(s) which is within  the defined ip range.
+:::::Whole IP Range – To enable the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the outgoing traffic from the computer(s) which is within  the defined ip range.
-Any IP Address – When this option is selected, the rule will be applied for the traffic originating from ANY IP Addresses.
+:::::Any IP Address – When this option is selected, the rule will be applied for the traffic originating from ANY IP Addresses.
-** Source Port –
+::::* Source Port –
-Any – When this option is selected, the rule will be applied for the outgoing traffic originating from ANY port(s).
+:::::Any – When this option is selected, the rule will be applied for the outgoing traffic originating from ANY port(s).
-Single Port – When this option is selected, the rule will be applied for  the outgoing traffic originating from the specified / defined port.
+:::::Single Port – When this option is selected, the rule will be applied for  the outgoing traffic originating from the specified / defined port.
-Port Range – To enable the rule on a group of  ports in series, you can specify a range of ports. The rule will be applied for the outgoing traffic originating from the port which is within the defined range of ports.
+:::::Port Range – To enable the rule on a group of  ports in series, you can specify a range of ports. The rule will be applied for the outgoing traffic originating from the port which is within the defined range of ports.
-Port List – A list of port can be specified / added. The rule will be applied for the outgoing traffic originating from the ports as per specified in the list.
+:::::Port List – A list of port can be specified / added. The rule will be applied for the outgoing traffic originating from the ports as per specified in the list.
-'''NOTE: '''The rule will be applied when the selected Source IP Address and Source Port matches together.
+:::::<U>'''NOTE:'''</U> The rule will be applied when the selected Source IP Address and Source Port matches together.
-iii. Destination tab – In this section, specify / select the location of the computer where the incoming network traffic is destined.
+:::iii. Destination tab – In this section, specify / select the location of the computer where the incoming network traffic is destined.
-** Destination IP Address –
+::::* Destination IP Address –
-My Computer – The rule will be applied for the incoming traffic to your computer.
+:::::My Computer – The rule will be applied for the incoming traffic to your computer.
-Host Name – The rule will be applied for the incoming traffic to the computer as per the host name specified.
+:::::Host Name – The rule will be applied for the incoming traffic to the computer as per the host name specified.
-Single IP Address – The rule will be applied for the incoming traffic to the computer as per the IP address specified.
+:::::Single IP Address – The rule will be applied for the incoming traffic to the computer as per the IP address specified.
-Whole IP Range – To apply the rule on a group of computers in series, you can specify a range of  IP address. The rule will be applied for the incoming traffic to the computer(s) which is within the defined IP range.
+:::::Whole IP Range – To apply the rule on a group of computers in series, you can specify a range of  IP address. The rule will be applied for the incoming traffic to the computer(s) which is within the defined IP range.
-Any IP Address – When this option is selected, the rule will be applied for the incoming traffic to ANY IP Addresses.
+:::::Any IP Address – When this option is selected, the rule will be applied for the incoming traffic to ANY IP Addresses.
-** Destination Port –
+::::* Destination Port –
-Any – When this option is selected, the rule will be applied for the incoming traffic to ANY port.
+:::::Any – When this option is selected, the rule will be applied for the incoming traffic to ANY port.
-Single Port – When this option is selected, the rule will be applied for the incoming traffic to the specified / defined port.
+:::::Single Port – When this option is selected, the rule will be applied for the incoming traffic to the specified / defined port.
-Port Range – To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the incoming traffic to the port which is within the defined range of ports.
+:::::Port Range – To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the incoming traffic to the port which is within the defined range of ports.
-Port List – A list of port can be specified / added. The rule will be applied for incoming traffic originating from the ports as per specified in the list.
+:::::Port List – A list of port can be specified / added. The rule will be applied for incoming traffic originating from the ports as per specified in the list.
-'''NOTE: '''The rule will be applied when the selected Destination IP Address and Destination Port matches together.
+:::::<U>'''NOTE:'''</U> The rule will be applied when the selected Destination IP Address and Destination Port matches together.
-iv. Advanced tab – This tab contains advance setting for Expert Rule.
+:::iv. Advanced tab – This tab contains advance setting for Expert Rule.
-* Enable Advanced ICMP Processing - This is activated when the ICMP protocol is selected in the General tab.
+::::* Enable Advanced ICMP Processing - This is activated when the ICMP protocol is selected in the General tab.
-* The packet must be from/to a trusted MAC address – When this option is selected, the rule will only be applied on the MAC address defined / listed in the Trusted MAC Address tab.
+::::* The packet must be from/to a trusted MAC address – When this option is selected, the rule will only be applied on the MAC address defined / listed in the Trusted MAC Address tab.
-* Log information when this rule applies – This will enable to log information of the Rule when it is implied.
+::::* Log information when this rule applies – This will enable to log information of the Rule when it is implied.
-'''Modify''' – This button will enable to change or modify any Expert Rule.
+::::'''Modify''' – This button will enable to change or modify any Expert Rule.
-'''Remove''' – This button will delete a rule from the Expert Rule.
+::::'''Remove''' – This button will delete a rule from the Expert Rule.
-'''Default Rules''' – This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.
+::::'''Default Rules''' – This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.
-'''Up and Down Arrows''' – The UP and DOWN arrow button will enable to move the rules up or down as required and will take precedence over the rule listed below it.
+::::'''Up and Down Arrows''' – The UP and DOWN arrow button will enable to move the rules up or down as required and will take precedence over the rule listed below it.
-''Other options on Right Click on any rule''
+::::''Other options on Right Click on any rule''
-'''Enable Rule / Disable Rule '''–When clicked on this option this will either enable or disable the selected rules. The option toggles between Enable and Disable rule.
+::::'''Enable Rule / Disable Rule '''–When clicked on this option this will either enable or disable the selected rules. The option toggles between Enable and Disable rule.
-'''C. Application Rule – '''This rule is based on the Programs / Application(s) that is permitted / denied to access the Internet or any Network services. For e.g. Internet Explorer.
+:'''C. Application Rule – '''This rule is based on the Programs / Application(s) that is permitted / denied to access the Internet or any Network services. For e.g. Internet Explorer.
-''Buttons (to configure an Application Rule)''.
+::''Buttons (to configure an Application Rule)''.
-# Add – To add a new Application rule click on the Add button and browse and locate the executable file and select the action to be taken i.e. either Permit or Deny.
+::# Add – To add a new Application rule click on the Add button and browse and locate the executable file and select the action to be taken i.e. either Permit or Deny.
-# Remove – This button will delete a rule from the Application Rule.
+::# Remove – This button will delete a rule from the Application Rule.
-# Default Rules - This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.
+::# Default Rules - This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.
-To change / modify actions on a particular Application rule, you can right click on the applications.
+::To change / modify actions on a particular Application rule, you can right click on the applications.
-''Other options on Right Click on any rule''
+::''Other options on Right Click on any rule''
-Ask –When the selected application is executed, eScan Firewall will prompt whether to allow this application to be permited / denined. (Rule Color code – Gray).
+:::Ask –When the selected application is executed, eScan Firewall will prompt whether to allow this application to be permited / denined. (Rule Color code – Gray).
-Permit - When the selected application is executed, eScan Firewall will allow this application to run. (Rule Color code – Green).
+:::Permit - When the selected application is executed, eScan Firewall will allow this application to run. (Rule Color code – Green).
-Deny - When the selected application is executed, eScan Firewall will stop this application from running. (Rule Color code – Red).
+:::Deny - When the selected application is executed, eScan Firewall will stop this application from running. (Rule Color code – Red).
-Process Properties – This will display the properties of the selected process / executable file.
+:::Process Properties – This will display the properties of the selected process / executable file.
-Process Details – This will provide the online detail of the selected process / executable file.
+:::Process Details – This will provide the online detail of the selected process / executable file.
-'''D. Trojan Rule – '''This rule is based on predefined rules set by MicroWorld on the basis of our database and research of various Trojans that exploits the Network Services like accessing a system in the network. This rule is similar to settings in the Expert Rule.
+:'''D. Trojan Rule – '''This rule is based on predefined rules set by MicroWorld on the basis of our database and research of various Trojans that exploits the Network Services like accessing a system in the network. This rule is similar to settings in the Expert Rule.
+:<U>'''NOTE: This feature was available only prior to eScan version 10.0.968.374 and have been removed after this version.'''</U>
+:'''E. Trusted MAC Address – '''This section contains the information of the MAC address of the system. A MAC address (Media Access Control address) is a hardware address that uniquely identifies each node of a network. The Trusted MAC address list will be checked alongwith the Expert Rule only when "The packet must be from/to a trusted MAC address" option is checked and the action will be as per specified in the rule. (refer to the Advance Tab of the Expert Rule).
+::''Buttons (to configure the Trusted MAC Address)''
+:::# Add – To add a MAC address click on this button. Enter the MAC address to be added in the list for eg. 00-13-8F-27-00-47
+:::# Edit – To modify / change the MAC Address click on this button.
+:::# Remove – To delete the MAC Address click on this button.
+:::# Clear All – To delete all the listed MAC Address click on this button.
-'''E. Trusted MAC Address – '''This section contains the information of the MAC address of the system. A MAC address (Media Access Control address) is a hardware address that uniquely identifies each node of a network. The Trusted MAC address list will be checked alongwith the Expert Rule only when "The packet must be from/to a trusted MAC address" option is checked and the action will be as per specified in the rule. (refer to the Advance Tab of the Expert Rule).
-''Buttons (to configure the Trusted MAC Address)''
-# Add – To add a MAC address click on this button. Enter the MAC address to be added in the list for eg. 00-13-8F-27-00-47
-# Edit – To modify / change the MAC Address click on this button.
-# Remove – To delete the MAC Address click on this button.
-# Clear All – To delete all the listed MAC Address click on this button.
+:'''F. Local IP List – '''This section contains a list of Local IP addresses.
-'''F. Local IP List – '''This section contains a list of Local IP addresses.
+::''Buttons (to configure the Local IP List)''
-''Buttons (to configure the Local IP List)''
+:::# Add – To add a Local IP address click on this button.
+:::# Remove – To remove a Local IP address click on this button.
+:::# Clear All – To clear all the Local IP address in the list click on this button.
+:::# Default List – To load the default list of IP address click on this button.
-# Add – To add a Local IP address click on this button.
-# Remove – To remove a Local IP address click on this button.
-# Clear All – To clear all the Local IP address in the list click on this button.
-# Default List – To load the default list of IP address click on this button.
+::''Other Buttons''
-''Other Buttons''
+:::'''Clear Alert Cache''' - This option will clear / delete all the information stored by the Firewall cache
+:::'''Show Application Alert''' – Selecting this option will display an eScan FireWall Alert displaying the blocking of any application as defined in the Application Rule.
-'''Clear Alert Cache''' - This option will clear / delete all the information stored by the Firewall cache
-'''Show Application Alert''' – Selecting this option will display an eScan FireWall Alert displaying the blocking of any application as defined in the Application Rule.
 =='''Reports section'''==
-''Statistics''
+:''Statistics''
-* Inbound Traffic Allowed – Displays the number of allowed incoming traffic.
+::* Inbound Traffic Allowed – Displays the number of allowed incoming traffic.
-* Outbound Traffic Allowed - Displays the number of allowed outgoing traffic.
+::* Outbound Traffic Allowed - Displays the number of allowed outgoing traffic.
-* Inbound Traffic Blocked - Displays the number of blocked incoming traffic.
+::* Inbound Traffic Blocked - Displays the number of blocked incoming traffic.
-* Outbound Traffic Blocked - Displays the number of blocked outgoing traffic.
+::* Outbound Traffic Blocked - Displays the number of blocked outgoing traffic.
-'''a. View Current Network Activity''' – This will display all the network activities including Active connections and Established Connections. This will contain the information of the process, protocol, local address and the remote address and the status of each network connection.
+::'''a. View Current Network Activity''' – This will display all the network activities including Active connections and Established Connections. This will contain the information of the process, protocol, local address and the remote address and the status of each network connection.
-'''b. View Summary '''– Clicking on this option can create a Summary / Detailed report.
+::'''b. View Summary '''– Clicking on this option can create a Summary / Detailed report.
 A Summary report will consist of information of the rules that has been invoked and applied by the Firewall. Rules like Application Rule, Expert Rule, Zone Rule, Trojan Rule.
 A Detailed report will consists of information of the rules including the Network Activity.
 The report also consists of Graphical reports.
-'''c. View Report '''– Clicking on this option will display the Incoming and Outgoing traffic which is Allowed or Blocked.
+::'''c. View Report '''– Clicking on this option will display the Incoming and Outgoing traffic which is Allowed or Blocked.
 Any Network packets that are received / sent on or from a Network Interface, eScan Firewall will first check the rules in the following order:
-^st^ – Trojan Rules
+::1^st^ – Trojan Rules
+::<U>'''NOTE: This feature was available only prior to eScan version 10.0.968.374 and have been removed after this version.'''</U>
+::2^nd^ – Zone Rules
+::3^rd^ – Expert Rules
+::4^th^ – Application Rules
+==<I>'''[http://download1.mwti.net/wiki/index.php/Glossary Glossary]'''</I>==
+==<I>'''[http://download1.mwti.net/wiki/index.php/EScan_ver.10 Main Feature Index]'''</I>==
-^nd^ – Zone Rules
-^rd^ – Expert Rules
-^th^ – Application Rules
+<br/>
-*'''[http://download1.mwti.net/wiki/index.php/EScan_ver.10 Main Feature Index]'''
+<!--
-=='''[http://download1.mwti.net/wiki/index.php/Glossary Glossary]'''==
+{| id="mp-bottombanner" style="width:100%; background:#fcfcfc; margin-top:1em; border:0px solid #ccc;"
+| style="width:56%; color:#000;" |
+{|align="center" width="150px" |
+|[[Image:product_logo.JPG|centre]]
+|}
+-->