Escan/english/escan11/eScan Management Console/Policies/Features Help/Firewall

From eScan Wiki

(Difference between revisions)

Current revision

· eScan · MailScan · Technologies

· Technical Info · Security Awareness · User Guides

1 Firewall

[edit]

Firewall

Firewall module is designed to monitor all incoming and outgoing network traffic and protect your computer from all types of network based attacks. eScan includes a set of predefined access control rules that you can remove or customize as per your requirements. These rules enforce a boundary between your computer and the network. Therefore, the Firewall feature first checks the rules, analyzes network packets, and filters them on the basis of the specified rules. When you connect to the Internet, you expose your computer to various security threats.

The Firewall feature of eScan protects your data when you:

Connect to Internet Relay Chat (IRC) servers and join other people on the numerous channels on the IRC network.
Use Telnet to connect to a server on the Internet and then execute the commands on the server.
Use FTP to transfer files from a remote server to your computer.
Use Network Basic Input Output System (NetBIOS) to communicate with other users on the LAN connected to the Internet.
Use a computer that is a part of a Virtual Private Network (VPN).
Use a computer to browse the Internet.
Use a computer to send or receive email.

By default, the firewall operates in the Allow All mode. However, you can customize the firewall by using options like Limited Filter for filtering only incoming traffic and Interactive Filter to monitor incoming and outgoing traffic. The eScan Firewall also lets you specify different set of rules for allowing or blocking incoming or outgoing traffic. These rules include Zone Rules, Expert Rules, Trusted Media Access Control (MAC) Address, and Local IP list. This page provides you with options for configuring the module. You can configure the following settings to be deployed to the eScan client systems.

Allow All– Clicking Allow All disables the eScan Firewall i.e. all the incoming and outgoing network traffic will not be monitored/filtered.
Limited Filter– Clicking Limited Filter enables eScan Firewall in limited mode which will monitor all incoming traffic only and will be allowed or blocked as per the conditions or rules defined in the Firewall.
Interactive- Clicking Interactive enables eScan Firewall to monitor all the incoming and outgoing network traffic and will be allowed or blocked as per the conditions or rules defined in the Firewall.

Following tabs are available:

Zone Rule
Expert Rule
Trusted MAC Address
Local IP List
Application Rule

[edit]

Zone Rule

This is a set of network access rules to make the decision of allowing/blocking of the access to the system. This will contain the source IP address or source Host name or IP range either to be allowed or blocked.
Buttons (to configure a zone rule)

Add Host Name – This option lets you add a "host" in the zone rule. After clicking Add Host Name, enter the HOST name of the system, select the zone Trusted/Blocked) and enter a name for the zone rule. Click OK to create the zone rule.

Add IP – This option lets you add an IP address of a system to be added in the zone rule. After clicking Add IP, enter the IP address of the system, select the zone (Trusted/Blocked) and enter a name for the zone rule. Click OK to create the Zone Rule.

Add IP Range – This option lets you add an IP range to be added in the zone rule. After clicking Add IP Range, add the IP Range (i.e. a range of IP that the zone rules should be applied), select the zone (Trusted/Blocked) and enter a name for the zone rule. Click OK to create the zone rule.

Modify – To modify/change any listed zone rule (s), select the zone rule to be modified and then click Modify.

Remove - To remove any listed zone rule (s), select the zone rule and then click Remove.

[edit]

Expert Rule

This tab lets you specify advanced rules and settings for the eScan firewall. You can configure expert rules on the basis of the various rules, protocols, source IP address and port, destination IP address and port, and ICMP types. You can create new expert rules. However, configure these rules only if you are familiar with firewalls and networking protocols.

Source IP Address/Host Name
Source Port Number
Destination IP Address/Host Name
Destination Port Number

Buttons (to configure an Expert Rule)

Add – Click Add to create a new Expert Rule. Add Firewall Rule Window appears, you can configure the following settings via following tabs:

General
Source
Destination
Advanced

Let's see them in detail.

General tab

In this section, specify the Rule settings:
Rule Name – Provide a name to the Rule.
Rule Action – Action to be taken, whether to Permit Packet or Deny Packet.
Protocol –Select the network protocol (e.g. TCP, UDP, ARP) on which the Rule will be applied.
Apply rule on Interface – Select the Network Interface on which the Rule will be applied.

Source tab

In this section, specify/select the location from where the outgoing network traffic originates.
My Computer –The rule will be applied for the outgoing traffic originating from your computer.
Host Name –The rule will be applied for the outgoing traffic originating from the computer as per the host name specified.
Single IP Address – The rule will be applied for the outgoing traffic originating from the computer as per the IP address specified.
Whole IP Range To enable the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the outgoing traffic from the computer(s) which is within the defined IP range.
Any IP Address When this option is selected, the rule will be applied for the traffic originating from ANY IP address.
Any – When this option is selected, the rule gets applied for outgoing traffic originating from any port.
Single Port – When this option is selected, the rule gets applied for the outgoing traffic originating from the specified/defined port.
Port Range – To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the outgoing traffic originating from the port which is within the defined range of ports.
Port List – A list of port can be specified. The rule will be applied for the outgoing traffic originating from the ports as per specified in the list.

NOTE

The rule will be applied when the selected Source IP Address and Source Port matches together.

Destination tab

In this section, specify/select the location of the computer where the incoming network traffic is destined.

Destination IP Address –
My Computer –The rule will be applied for the incoming traffic to your computer.
Host Name – The rule will be applied for the incoming traffic to the computer as per the host name specified.
Single IP Address – The rule will be applied for the incoming traffic to the computer as per the IP address specified.
Whole IP Range – To apply the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the incoming traffic to the computer(s) which is within the defined IP range.
Any IP Address – When this option is selected, the rule will be applied for the incoming traffic to ANY IP Addresses.

Destination Port
Any – After selecting this option, the rule will be applied for the incoming traffic to ANY port.
Single Port – After selecting this option, the rule will be applied for the incoming traffic to the specified/defined port.
Port Range – To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the incoming traffic to the port which is within the defined range of ports.
Port List –A list of port can be specified/added. The rule will be applied for incoming traffic originating from the ports as per specified in the list.

NOTE

The rule will be applied when the selected Destination IP Address and Destination Port matches together.

Advanced tab

This tab contains advance setting for Expert Rule.
Enable Advanced ICMP Processing - This is activated when the ICMP protocol is selected in the General tab.
The packet must be from/to a trusted MAC address – When this option is selected, the rule will only be applied on the MAC address defined/listed in the Trusted MAC Address tab.

Log information when this rule applies – This will enable to log information of the Rule when it is implied.</p>

Modify – Clicking Modify lets you modify any Expert Rule.
Remove – Clicking Remove lets you delete a rule from the Expert Rule.
Shift Up and Shift Down– The UP and DOWN arrow button will enable to move the rules up or down as required and will take precedence over the rule listed below it.
Enable Rule/Disable Rule – These buttons lets you enable or disable a particular selected rule from the list.

[edit]

Trusted MAC Address

This section contains the information of the MAC address of the system. A MAC address is a hardware address that uniquely identifies each node of a network. The Trusted MAC address list will be checked along with the Expert Rule only when "The packet must be from/to a trusted MAC address" option is checked and the action will be as per specified in the rule. (Refer to the Advance Tab of the Expert Rule).
Buttons (to configure the Trusted MAC Address)

Add – To add a MAC address click on this button. Enter the MAC address to be added in the list for e.g. 00-13-8F-27-00-47
Edit – To modify/change the MAC Address, click Edit.
Remove – To delete the MAC Address, click Remove.
Clear All – To delete the entire listed MAC Address, click Clear All.

[edit]

Local IP List

This section contains a list of Local IP addresses.

Add – To add a local IP address, click Add.
Remove – To remove a local IP address, click Remove.
Clear All – To clear all local IP addresses, click Clear All.
Default List – To load the default list of IP addresses, click Default List.

[edit]

Application Rule

In this section you can define the permissions for different application. The application can be set to Ask, Permit or Deny mode.

Defining permission for an application

To define permission for an application,

Click Add.
Add New Application window appears.
Enter the application name with path and select a permission.
Click OK.
The permission for the application will be defined.

Removing permission of an application

Select an application and then click Remove. The application will no longer have the permission.

Other Buttons

Clear All This option will clear/delete all the information stored by the Firewall cache.
Show Application Alert – Selecting this option will display an eScan Firewall Alert displaying the blocking of any application as defined in the Application Rule.
Default Rules - This button will load/reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.

Retrieved from "https://wiki.escanav.com/wiki/index.php/Escan/english/escan11/eScan_Management_Console/Policies/Features_Help/Firewall"

Welcome to eScan Wikipedia

From eScan Wiki

Current revision

Contents

Firewall

Zone Rule

Expert Rule

Trusted MAC Address

Local IP List

Application Rule

Main Page

Latest Developments

Product Information

Knowledge Base

For Windows Downloads

For Linux Downloads

For MAC Downloads

General

Support

Views

 |style="text-align:right;"|&nbsp;&nbsp;'''·''' [[Technical Info|<font size=1.5 color="blue">Technical Info</font>]]&nbsp;&nbsp;'''·''' [[Escan/english/Security_Awareness|<font size=1.5 color="blue">Security Awareness</font>]]&nbsp;&nbsp;'''·''' [[User_Guides|<font size=1.5 color="blue">User Guides</font>]]
 |}
-__TOC__
+<h2 style='color:#556B2F;font-size:24.0pt;font-family:"Open Sans"'>Firewall</h2>
+<p style='font-size:11.0pt;font-family:"Open Sans"'>Firewall module is designed to monitor all incoming and outgoing network traffic and protect your computer from all types of network based attacks. eScan includes a set of predefined access control rules that you can remove or customize as per your requirements. These rules enforce a boundary between your computer and the network. Therefore, the Firewall feature first checks the rules, analyzes network packets, and filters them on the basis of the specified rules. When you connect to the Internet, you expose your computer to various security threats.<br><br>
+The Firewall feature of eScan protects your data when you:</p>
+<ul>
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Connect to Internet Relay Chat (IRC) servers and join other people on the numerous channels on the IRC network.</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'> Use Telnet to connect to a server on the Internet and then execute the commands on the server.</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Use FTP to transfer files from a remote server to your computer. </li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'> Use Network Basic Input Output System (NetBIOS) to communicate with other users on the LAN connected to the Internet. </li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Use a computer that is a part of a Virtual Private Network (VPN). </li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Use a computer to browse the Internet. </li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Use a computer to send or receive email. </li>
+</ul>
 <br>
-==<B><font size=5 color=#24B200>Firewall</font></B>==
+<p style='font-size:11.0pt;font-family:"Open Sans"'>By default, the firewall operates in the <b>Allow All</b> mode. However, you can customize the firewall by using options like <b>Limited Filter</b> for filtering only incoming traffic and <b>Interactive Filter </b>to monitor incoming and outgoing traffic. The eScan Firewall also lets you specify different set of rules for allowing or blocking incoming or outgoing traffic. These rules include Zone Rules, Expert Rules, Trusted Media Access Control (MAC) Address, and Local IP list. This page provides you with options for configuring the module. You can configure the following settings to be deployed to the eScan client systems.<br><br>
-<br><br>
-=='''Description'''==
+<b>Allow All</b>– Clicking <b>Allow All</b> disables the eScan Firewall i.e. all the incoming and outgoing network traffic will not be monitored/filtered.<br>
+<b>Limited Filter</b>– Clicking <b>Limited Filter</b> enables eScan Firewall in limited mode which will monitor all incoming traffic only and will be allowed or blocked as per the conditions or rules defined in the Firewall.<br>
+<b>Interactive</b>- Clicking <b>Interactive </b>enables eScan Firewall to monitor all the incoming and outgoing network traffic and will be allowed or blocked as per the conditions or rules defined in the Firewall.</p>
-Firewall is a security feature of eScan\’s Protection module. It is designed to monitor all incoming and outgoing network traffic and protect your computer from all types of network based attacks. eScan includes a set of predefined access control rules that you can remove or customize as per your requirements. These rules enforce a boundary between your computer and the network. Therefore, the Firewall feature first checks the rules, analyzes network packets, and filters them on the basis of the specified rules.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>Following tabs are available:</p>
-When you connect to the Internet, you expose your computer to various security threats. The Firewall feature of eScan protects your data when you:
+<ul>
-:::* Connect to Internet Relay Chat (IRC) servers and join other people on the numerous channels on the IRC network.
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Zone Rule</li>
-:::* Use Telnet to connect to a server on the Internet and then execute the commands on the server.
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Expert Rule</li>
-:::* Use FTP to transfer files from a remote server to your computer.
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Trusted MAC Address</li>
-:::* Use Network basic input/output system (NetBIOS) to communicate with other users on the LAN that is connected to the Internet.
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Local IP List </li>
-:::* Use a computer that is a part of a Virtual Private Network (VPN).
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Application Rule</li>
-:::* Use a computer to browse the Internet.
+</ul>
-:::* Use a computer to send or receive e mail.
-By default, the firewall operates in the '''Allow All''' mode. However, you can customize the firewall by using options like '''Limited Filter''' for filtering only incoming traffic and '''Interactive Filter '''to turn off and block all. The eScan Firewall also allows you to specify different set of rules for allowing or blocking incoming or outgoing traffic. These rules include Zone Rules, Expert Rules, Trusted Media Access Control (MAC) Address, and Local IP list.
-This page provides you with options for configuring the module. You can configure the following settings to be deployed to the eScan client systems.
-:'''''Allow All'' –''' Clicking on this button will disable the eScan Firewall i.e. all the incoming and outgoing network traffic will not be monitored / filtered.
+<h3 style='color:#008000;font-size:18.0pt;font-family:"Open Sans"'>Zone Rule</h3>
-:'''''Limited Filter'' –''' Clicking on this button will enable eScan Firewall in limited mode which will monitor all incoming traffic only and will be allowed / blocked as per the conditions or rules defined in the Firewall.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>This is a set of network access rules to make the decision of allowing/blocking of the access to the system. This will contain the source IP address or source Host name or IP range either to be allowed or blocked. <br>
+Buttons (to configure a zone rule)<br><br>
-:'''''Interactive'' -''' Clicking on this button will enable eScan Firewall to monitor all the incoming and outgoing network traffic and will be allowed / blocked as per the conditions or rules defined in the Firewall.
+<b>Add Host Name </b>– This option lets you add a &quot;host&quot; in the zone rule. After clicking <b>Add Host Name</b>, enter the HOST name of the system, select the zone Trusted/Blocked) and enter a name for the zone rule. Click <b>OK</b> to create the zone rule.<br><br>
-There are '''four tabs''' – '''Zone Rule''', '''Expert Rule''', '''Trusted MAC Address''', and '''Local IP List''', which are as follows:
+<b>Add IP </b>– This option lets you add an IP address of a system to be added in the zone rule. After clicking <b>Add IP</b>, enter the IP address of the system, select the zone (Trusted/Blocked) and enter a name for the zone rule. Click <b>OK</b> to create the Zone Rule.<br><br>
-:'''A. Zone Rule - '''This is a set of network access rules to make the decision of allowing / blocking of the  access to the system. This will contain the source IP address or source Host name or IP range either to be allowed or blocked.
+<b>Add IP Range </b>– This option lets you add an IP range to be added in the zone rule. After clicking <b>Add IP Range</b>, add the IP Range (i.e. a range of IP that the zone rules should be applied), select the zone (Trusted/Blocked) and enter a name for the zone rule. Click <b>OK</b> to create the zone rule.<br><br>
-::''Buttons (to configure a Zone Rule)''
+<b>Modify –</b> To modify/change any listed zone rule (s), select the zone rule to be modified
+and then click <b>Modify</b>.<br><br>
-::# Add Host Name – This option enables you to add a "host" in the Zone Rule. When clicked on this button, enter the HOST name of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
+<b>Remove -</b> To remove any listed zone rule (s), select the zone rule and then click <b>Remove</b>.</p>
-::# Add IP – This option enables you to add an IP address of a system to be added in the Zone rule. When clicked on this button, enter the IP address of the system, select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
-::# Add IP Range – This option enables you to add an IP range to be added in the Zone rule. When clicked on this button, add the IP Range (i.e. a range of IP that the Zone rule  should be applied), select the Zone (Trusted / Blocked) and enter a name for the Zone Rule. Click on OK button to create the Zone Rule.
-::# Modify – To modify / change any listed Zone Rule(s), click on the Modify button.
-::# Remove - To delete any listed Zone Rule(s), click on the remove button.
+<h3 style='color:#008000;font-size:18.0pt;font-family:"Open Sans"'>Expert Rule</h3>
-:'''B. Expert Rule – '''This rule is recommended for experienced users with expertise in Firewall security and networking protocols. Expert rule is based on the following below attributes:
+<p style='font-size:11.0pt;font-family:"Open Sans"'>This tab lets you specify advanced rules and settings for the eScan firewall. You can configure expert rules on the basis of the various rules, protocols, source IP address and port, destination IP address and port, and ICMP types. You can create new expert rules. However, configure these rules only if you are familiar with firewalls and networking protocols.</p>
-::* Source IP Address / Host Name
+<ul>
-::* Source Port Number
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Source IP Address/Host Name</li>
-::* Destination IP Address / Host Name
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Source Port Number</li>
-::* Destination Port Number
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Destination IP Address/Host Name</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'>Destination Port Number</li>
+</ul>
-::''Buttons (to configure an Expert Rule)''
+<p style='font-size:11.0pt;font-family:"Open Sans"'><b>Buttons (to configure an Expert Rule)</b></p>
-::'''Add''' – Click on the Add button to create a new Expert Rule. In the Add Firewall Rule Window:
+ <p style='font-size:11.0pt;font-family:"Open Sans"'><b>Add</b> – Click <b>Add</b> to create a new Expert Rule. Add Firewall Rule Window appears, you can configure the following settings via following tabs: </p>
+<ul>
+<li style='font-size:11.0pt;font-family:"Open Sans"'> General</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'> Source </li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'> Destination </li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'> Advanced </li>
+</ul>
+<p style='font-size:11.0pt;font-family:"Open Sans"'>Let's see them in detail.</p>
-:::i. General tab – In this section, specify the Rule settings
+<p style='color:#32CD32;font-size:12.0pt;font-family:"Open Sans"'><b>General tab</b></p>
-::::* Rule Name – Provide a name to the Rule,
-::::* Rule Action – Action to be taken, whether to Permit Packet or Deny Packet,
-::::* Protocol – Select the network protocol (eg.TCP, UDP, ARP etc…) on which the Rule will be applied
-::::* Apply rule on Interface – Select the Network Interfac on which the Rule will be applied.
-:::ii. Source tab – In this section, specify / select the location from where the outgoing netowork traffic originates.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>In this section, specify the Rule settings:<br>
-::::* Source IP Address –
+<b>Rule Name –</b> Provide a name to the Rule.<br>
-:::::My Computer – The rule will be applied for the outgoing traffic originating from your computer.
+<b>Rule Action –</b> Action to be taken, whether to Permit Packet or Deny Packet.<br>
+<b>Protocol –</b>Select the network protocol (e.g. TCP, UDP, ARP) on which the Rule will be
+applied.<br>
+<b>Apply rule on Interface –</b> Select the Network Interface on which the Rule will be applied.</p>
-:::::Host Name – The rule will be applied for the outgoing traffic originating from the computer as per the host name specified.
+<p style='color:#32CD32;font-size:12.0pt;font-family:"Open Sans"'><b>Source tab</b></p>
-:::::Single IP Address – The rule will be applied for the outgoing traffic originating from the computer as per the IP address specified.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>In this section, specify/select the location from where the outgoing network traffic originates.<br>
+<b>My Computer –</b>The rule will be applied for the outgoing traffic originating from your
+computer.<br>
+<b>Host Name –</b>The rule will be applied for the outgoing traffic originating from the computer
+as per the host name specified.<br>
+<b>Single IP Address –</b> The rule will be applied for the outgoing traffic originating from the computer as per the IP address specified.<br>
+<b>Whole IP Range </b> To enable the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the outgoing traffic from the computer(s) which is within the defined IP range.<br>
+<b>Any IP Address </b> When this option is selected, the rule will be applied for the traffic originating from ANY IP address.<br>
+<b>Any –</b> When this option is selected, the rule gets applied for outgoing traffic originating from any port.<br>
+<b>Single Port –</b> When this option is selected, the rule gets applied for the outgoing traffic
+originating from the specified/defined port.<br>
+<b>Port Range –</b> To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the outgoing traffic originating from the port which is within the defined range of ports.<br>
+<b>Port List –</b> A list of port can be specified. The rule will be applied for the outgoing traffic originating from the ports as per specified in the list.</p>
+<br>
+<table class="MsoNormalTable" style="background: #DBE5F1; border-collapse: collapse; border: none;" border="1" cellspacing="0" cellpadding="0">
+<tr>
+<td style="width: 36.9pt; border: solid windowtext 1.0pt; padding: 0in 5.4pt 0in 5.4pt;" width="49">
+<p style="font-size: 11.0pt; font-family: 'Open Sans';"><strong>NOTE</strong></p>
+</td>
+<td style="width: 425.2pt; border: solid windowtext 1.0pt; border-left: none; padding: 0in 5.4pt 0in 5.4pt;" valign="top" width="567">
+<p style="font-size: 11.0pt; font-family: 'Open Sans';">The rule will be applied when the selected Source IP Address and Source Port matches together.</p>
+</td>
+</tr>
+</table>
+<br>
-:::::Whole IP Range – To enable the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the outgoing traffic from the computer(s) which is within  the defined ip range.
+<p style='color:#32CD32;font-size:12.0pt;font-family:"Open Sans"'><b>Destination tab</b></p>
-:::::Any IP Address – When this option is selected, the rule will be applied for the traffic originating from ANY IP Addresses.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>In this section, specify/select the location of the computer where the incoming network traffic is destined.<br><br>
+<b>Destination IP Address –</b><br>
+<b>My Computer –</b>The rule will be applied for the incoming traffic to your computer.<br>
+<b>Host Name –</b> The rule will be applied for the incoming traffic to the computer as per the
+host name specified.<br>
+<b>Single IP Address –</b> The rule will be applied for the incoming traffic to the computer as per the IP address specified.<br>
+<b>Whole IP Range –</b> To apply the rule on a group of computers in series, you can specify a range of IP address. The rule will be applied for the incoming traffic to the computer(s) which is within the defined IP range.<br>
+<b>Any IP Address –</b> When this option is selected, the rule will be applied for the incoming
+traffic to ANY IP Addresses.<br><br>
+<b>Destination Port</b><br>
+<b>Any –</b> After selecting this option, the rule will be applied for the incoming traffic to ANY port.<br>
+<b>Single Port –</b> After selecting this option, the rule will be applied for the incoming traffic to the specified/defined port.<br>
+<b>Port Range –</b> To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the incoming traffic to the port which is within the defined range of ports.<br>
+<b>Port List –</b>A list of port can be specified/added. The rule will be applied for incoming
+traffic originating from the ports as per specified in the list.</p>
+<br>
-::::* Source Port –
+<table class="MsoNormalTable" style="background: #DBE5F1; border-collapse: collapse; border: none;" border="1" cellspacing="0" cellpadding="0">
-:::::Any – When this option is selected, the rule will be applied for the outgoing traffic originating from ANY port(s).
+<tr>
+<td style="width: 36.9pt; border: solid windowtext 1.0pt; padding: 0in 5.4pt 0in 5.4pt;" width="49">
-:::::Single Port – When this option is selected, the rule will be applied for  the outgoing traffic originating from the specified / defined port.
+<p style="font-size: 11.0pt; font-family: 'Open Sans';"><strong>NOTE</strong></p>
+</td>
-:::::Port Range – To enable the rule on a group of  ports in series, you can specify a range of ports. The rule will be applied for the outgoing traffic originating from the port which is within the defined range of ports.
+<td style="width: 425.2pt; border: solid windowtext 1.0pt; border-left: none; padding: 0in 5.4pt 0in 5.4pt;" valign="top" width="567">
+<p style="font-size: 11.0pt; font-family: 'Open Sans';">The rule will be applied when the selected Destination IP Address and Destination Port matches together.</p>
-:::::Port List – A list of port can be specified / added. The rule will be applied for the outgoing traffic originating from the ports as per specified in the list.
+</td>
+</tr>
-:::::<U>'''NOTE:'''</U> The rule will be applied when the selected Source IP Address and Source Port matches together.
+</table>
+<br>
-:::iii. Destination tab – In this section, specify / select the location of the computer where the incoming network traffic is destined.
-::::* Destination IP Address –
-:::::My Computer – The rule will be applied for the incoming traffic to your computer.
-:::::Host Name – The rule will be applied for the incoming traffic to the computer as per the host name specified.
-:::::Single IP Address – The rule will be applied for the incoming traffic to the computer as per the IP address specified.
-:::::Whole IP Range – To apply the rule on a group of computers in series, you can specify a range of  IP address. The rule will be applied for the incoming traffic to the computer(s) which is within the defined IP range.
-:::::Any IP Address – When this option is selected, the rule will be applied for the incoming traffic to ANY IP Addresses.
-::::* Destination Port –
-:::::Any – When this option is selected, the rule will be applied for the incoming traffic to ANY port.
-:::::Single Port – When this option is selected, the rule will be applied for the incoming traffic to the specified / defined port.
-:::::Port Range – To enable the rule on a group of ports in series, you can specify a range of ports. The rule will be applied for the incoming traffic to the port which is within the defined range of ports.
-:::::Port List – A list of port can be specified / added. The rule will be applied for incoming traffic originating from the ports as per specified in the list.
-:::::<U>'''NOTE:'''</U> The rule will be applied when the selected Destination IP Address and Destination Port matches together.
-:::iv. Advanced tab – This tab contains advance setting for Expert Rule.
-::::* Enable Advanced ICMP Processing - This is activated when the ICMP protocol is selected in the General tab.
-::::* The packet must be from/to a trusted MAC address – When this option is selected, the rule will only be applied on the MAC address defined / listed in the Trusted MAC Address tab.
-::::* Log information when this rule applies – This will enable to log information of the Rule when it is implied.
-::::'''Modify''' – This button will enable to change or modify any Expert Rule.
-::::'''Remove''' – This button will delete a rule from the Expert Rule.
-::::'''Default Rules''' – This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.
-::::'''Up and Down Arrows''' – The UP and DOWN arrow button will enable to move the rules up or down as required and will take precedence over the rule listed below it.
-::::''Other options on Right Click on any rule''
-::::'''Enable Rule / Disable Rule '''–When clicked on this option this will either enable or disable the selected rules. The option toggles between Enable and Disable rule.
-:'''C. Application Rule – '''This rule is based on the Programs / Application(s) that is permitted / denied to access the Internet or any Network services. For e.g. Internet Explorer.
-::''Buttons (to configure an Application Rule)''.
-::# Add – To add a new Application rule click on the Add button and browse and locate the executable file and select the action to be taken i.e. either Permit or Deny.
-::# Remove – This button will delete a rule from the Application Rule.
-::# Default Rules - This button will load / reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.
-::To change / modify actions on a particular Application rule, you can right click on the applications.
-::''Other options on Right Click on any rule''
-:::Ask –When the selected application is executed, eScan Firewall will prompt whether to allow this application to be permited / denined. (Rule Color code – Gray).
-:::Permit - When the selected application is executed, eScan Firewall will allow this application to run. (Rule Color code – Green).
-:::Deny - When the selected application is executed, eScan Firewall will stop this application from running. (Rule Color code – Red).
-:::Process Properties – This will display the properties of the selected process / executable file.
-:::Process Details – This will provide the online detail of the selected process / executable file.
-:'''D. Trojan Rule – '''This rule is based on predefined rules set by MicroWorld on the basis of our database and research of various Trojans that exploits the Network Services like accessing a system in the network. This rule is similar to settings in the Expert Rule.
-:<U>'''NOTE: This feature was available only prior to eScan version 10.0.968.374 and have been removed after this version.'''</U>
-:'''E. Trusted MAC Address – '''This section contains the information of the MAC address of the system. A MAC address (Media Access Control address) is a hardware address that uniquely identifies each node of a network. The Trusted MAC address list will be checked alongwith the Expert Rule only when "The packet must be from/to a trusted MAC address" option is checked and the action will be as per specified in the rule. (refer to the Advance Tab of the Expert Rule).
-::''Buttons (to configure the Trusted MAC Address)''
-:::# Add – To add a MAC address click on this button. Enter the MAC address to be added in the list for eg. 00-13-8F-27-00-47
-:::# Edit – To modify / change the MAC Address click on this button.
-:::# Remove – To delete the MAC Address click on this button.
-:::# Clear All – To delete all the listed MAC Address click on this button.
+<p style='color:#32CD32;font-size:12.0pt;font-family:"Open Sans"'><b>Advanced tab</b></p>
-:'''F. Local IP List – '''This section contains a list of Local IP addresses.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>This tab contains advance setting for Expert Rule.<br>
+<b>Enable Advanced ICMP Processing -</b> This is activated when the ICMP protocol is
+selected in the General tab.<br>
+<b>The packet must be from/to a trusted MAC address –</b> When this option is selected, the
+rule will only be applied on the MAC address defined/listed in the Trusted MAC
+Address tab.</p>
+<b>Log information when this rule applies –</b> This will enable to log information of the Rule when it is implied.</p>
-::''Buttons (to configure the Local IP List)''
+<p style='font-size:11.0pt;font-family:"Open Sans"'><b>Modify</b> – Clicking <b>Modify</b> lets you modify any Expert Rule.<br>
+<b>Remove</b> – Clicking <b>Remove</b> lets you delete a rule from the Expert Rule.<br>
+<b>Shift Up and Shift Down</b>– The UP and DOWN arrow button will enable to move the rules up
+or down as required and will take precedence over the rule listed below it.<br>
+<b>Enable Rule/Disable Rule </b>– These buttons lets you enable or disable a particular
+selected rule from the list.</p>
-:::# Add – To add a Local IP address click on this button.
+<h3 style='color:#008000;font-size:18.0pt;font-family:"Open Sans"'>Trusted MAC Address</h3>
-:::# Remove – To remove a Local IP address click on this button.
-:::# Clear All – To clear all the Local IP address in the list click on this button.
-:::# Default List – To load the default list of IP address click on this button.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>This section contains the information of the MAC address of the system. A MAC address is a hardware address that uniquely identifies each node of a network. The Trusted MAC address list will be checked along with the Expert Rule only when &quot;The packet must be from/to a trusted MAC address&quot; option is checked and the action will be as per specified in the rule. (Refer to the Advance Tab of the Expert Rule). <br>
+Buttons (to configure the Trusted MAC Address)</p>
+<ul>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Add –</b> To add a MAC address click on this button. Enter the MAC address to be added in the list for e.g. 00-13-8F-27-00-47</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Edit –</b> To modify/change the MAC Address, click <b>Edit</b>.</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Remove –</b> To delete the MAC Address, click <b>Remove</b>.</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Clear All –</b> To delete the entire listed MAC Address, click <b>Clear All</b>.</li>
+</ul>
-::''Other Buttons''
+<h3 style='color:#008000;font-size:18.0pt;font-family:"Open Sans"'>Local IP List </h3>
-:::'''Clear Alert Cache''' - This option will clear / delete all the information stored by the Firewall cache
+<p style='font-size:11.0pt;font-family:"Open Sans"'>This section contains a list of Local IP addresses.</p>
-:::'''Show Application Alert''' – Selecting this option will display an eScan FireWall Alert displaying the blocking of any application as defined in the Application Rule.
+<ul>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Add –</b> To add a local IP address, click <b>Add</b>.</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Remove –</b> To remove a local IP address, click <b>Remove</b>.</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Clear All –</b> To clear all local IP addresses, click <b>Clear All</b>.</li>
+<li style='font-size:11.0pt;font-family:"Open Sans"'><b>Default List –</b> To load the default list of IP addresses, click <b>Default List</b>.</li>
+</ul>
+<h3 style='color:#008000;font-size:18.0pt;font-family:"Open Sans"'>Application Rule</h3>
-=='''Reports section'''==
+<p style='font-size:11.0pt;font-family:"Open Sans"'>In this section you can define the permissions for different application. The application can be set to Ask, Permit or Deny mode.</p>
-:''Statistics''
+<p style='color:#32CD32;font-size:12.0pt;font-family:"Open Sans"'><b>Defining permission for an application</b></p>
-::* Inbound Traffic Allowed – Displays the number of allowed incoming traffic.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>To define
-::* Outbound Traffic Allowed - Displays the number of allowed outgoing traffic.
+permission for an application,</p>
-::* Inbound Traffic Blocked - Displays the number of blocked incoming traffic.
-::* Outbound Traffic Blocked - Displays the number of blocked outgoing traffic.
-::'''a. View Current Network Activity''' – This will display all the network activities including Active connections and Established Connections. This will contain the information of the process, protocol, local address and the remote address and the status of each network connection.
+<ol >
+ <li style='font-size:11.0pt;font-family:"Open Sans"'>Click <b>Add</b>.</li>
+ <li style='font-size:11.0pt;font-family:"Open Sans"'>Add New Application window appears.</li>
+ <li style='font-size:11.0pt;font-family:"Open Sans"'>Enter the application name with path and select a
+     permission.</li>
+ <li style='font-size:11.0pt;font-family:"Open Sans"'>Click <b>OK</b>.<br>
+The permission for the application will be defined.</li></ol>
+<p style='color:#32CD32;font-size:12.0pt;font-family:"Open Sans"'><b>Removing permission of an application</b></p>
-::'''b. View Summary '''– Clicking on this option can create a Summary / Detailed report.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>Select an application and then click <b>Remove</b>. The application will no longer have the permission.</p>
-A Summary report will consist of information of the rules that has been invoked and applied by the Firewall. Rules like Application Rule, Expert Rule, Zone Rule, Trojan Rule.
-A Detailed report will consists of information of the rules including the Network Activity.
-The report also consists of Graphical reports.
-::'''c. View Report '''– Clicking on this option will display the Incoming and Outgoing traffic which is Allowed or Blocked.
+<p style='font-size:11.0pt;font-family:"Open Sans"'>Other Buttons</p>
+<ul >
+ <li style='font-size:11.0pt;font-family:"Open Sans"'><b>Clear All</b> This option will clear/delete all the information stored by the Firewall cache.</li>
+ <li style='font-size:11.0pt;font-family:"Open Sans"'><b>Show Application Alert</b> – Selecting this option will display an eScan Firewall Alert displaying the blocking of any application as defined in the Application Rule.</li>
+ <li style='font-size:11.0pt;font-family:"Open Sans"'><b>Default Rules </b>- This button will load/reset the rules to the Default settings present during the installation of eScan. This will remove all the settings defined by user.</li>
+</ul>