Escan/english/firewall

From eScan Wiki

Revision as of 20:31, 23 October 2008; view current revision
←Older revision | Newer revision→

eConceal Firewall is a comprehensive software firewall that is designed to prevent unauthorized access to a computer or network that is connected to the Internet. It enforces a boundary between two or more networks by implementing default or user-defined access-control policies (rules) between two or more networks.

It allows the user to choose the type of Internet access. The user can set rules to control network access from and to their system. Rules are user’s selection of Internet access either to allow or block on the system.The rules function as filters, analyzing packets (small chunks of data) to check if they fulfill the filter criteria and if they do pass them to the requesting system or else discard them.

Within the software, are provided set of predefined rules that can be added to the firewall by selecting those that are appropriate to one’s security needs. Users can define their own 'rules', and when they don't feel the need for any of the rules they have 'added', they can remove them. Among the pre-set rules involving Internet access that eConceal offers, the user is able to select ARP, DHCP & BOOTP, DNS, E-mail, WWW, News, NetBios, FTP, ICMP, ICQ, Telnet & SSH, IRC, MSN, and VPN.

Internet access involves the usage of these functions in one form or the other. When a system connects to a publci networkd like the Internet, the system becomes vulnerable to unauthorized access. The eConceal firewall is basically designed to protect from unauthorized access by people designed to disrupt or destroy your personal and/or business data functions, often stealing valuable information like your Identity, Account Numbers, other Personal information, Confidential information or Proprietary business related data among other things.

Vulnerable Scenarios -

A user is vulnerable to hacker attack when their system connects to a public network

- When you log in to chat, you connect to Internet Relay Chat (IRC) servers on the Internet and join others in the numerous 'channels' on the IRC network.

- When you use Telnet to connect to a server on the Internet and execute commands 'on' the server from your computer.

- When you use FTP to transfer files from a remote server to your computer. FTP is the File Transfer Protocol for exchanging files over the Internet, and works in the same way that HTTP and SMTP do in transferring Web pages from servers to user's browser and transferring e-mail across the WWW respectively.

- When you use NetBIOS (Network Basic Input/Output System) to communicate with another user on the LAN; the LAN could in turn be connected to the Internet. NetBIOS insulates the applications that users use to communicate with one another, from understanding the underlying network details.

- When you are a part of a Virtual Private Networks (VPN). These private network connections communicate 'securely' over a public network, such as the Internet.

- When you browse the Web.

- When you send/receive e-mail.

The “Firewall” option page shows the current status of the Firewall Protection. The green color right tick mark denotes that the module is “Active” while the red color cross mark displays that the module is “InActive”.

On the Firewall option page in the “Configuration” section, when clicked on the “Settings” option, one can change and customize the Firewall Protection level, while clicking on either the “Allow All”, “Filter All” and “Block All” options (next to Settings) makes the module to “Allow”, “Filter” or “Block” traffic.

1. Configuration section -

When clicked on “Settings” the below options are available, through which the eScan software’s Firewall protection can be customized -

It has different options like "Zone Rule", "Expert Rule", “Application Rule”, “Trojan Rule”, “Trusted MAC Address” and “Local IP list”.

A) Zone Rule - This option page has different options on the right hand side of the page like – Add Host Name, Add IP, Add IP Range, Modify and Remove.

1) Add Host Name - This option enables you to add a “host” that you wish to add to a zone. When clicked on the option of “Add Host Name”, it displays a window prompting for the Host Name, Zone, if trusted or blocked and Name for the Zone Rule and when clicked on the “OK” option, gets added to the “Zone Rule” page.

2) Add IP – This option enables you to add an “IP” that you wish to add to a zone. When clicked on the option of “Add IP”, it displays a window prompting for the IP Address, Zone, if trusted or blocked and Name for the Zone Rule and when clicked on the “OK” option, gets added to the “Zone Rule” page.

3) Add IP Range – This option enables you to add an “IP Range” that you wish to add to a zone. When clicked on the option of “Add IP Range”, it displays a window prompting for the IP Address Range, Zone, if trusted or blocked and Name for the Zone Rule and when clicked on the “OK” option, gets added to the “Zone Rule” page.

4) Modify - This option works in conjunction with the present rules defined in the above categories. To change the same, select any of the above rules defined and then select the “Modify” option

5) Remove – This option works in conjunction with the present rules defined in the above categories. To remove, select any of the above rule defined and then click on the “Remove” option

B) Expert Rule - This option page has different options on the right hand side of the page like – Add, Modify, Remove, Default Rule along with the UP and DOWN arrows.

1) Add - This option enables you to add a new rule to the “Expert Rule”. When clicked on the option of “Add”, it displays a window with four screen, viz. General, Source, Destination and Advanced.

a. General - This screen page helps to define a name for the rule being defined, the action to be taken, i.e. either to pass or reject the packet, protocol to be used and the interface to be used (network adaptors).

b. Source – This screen page helps to define the “source” of the connection, i.e. source IP Address and Port of the connection.

c. Destination - This screen page helps to define the “destination” of the connection, i.e. destination IP Address and Port to get connected to.

d. Advanced - This screen page is helpful ONLY incase if the ICMP protocol is selected in the above “General” screen page.

2) Modify - This option works in conjunction with the present rules defined in the above category. To change the same, select any of the above rules defined and then select the “Modify” option.

3) Remove - This option works in conjunction with the present rules defined in the above category. To remove, select any of the above rule defined and then clck on the “Remove” option.

4) Default Rule - This option reverts back to the default rules set within the software.

Do note - this option should be used with caution for if the user has defined any rules they would be lost when this option is used.

The UP and DOWN arrows provided below the “default rule” option help you to move the defined rule either Upward or Downward based on one’s requirements.

C) Application Rule - This option page has different options on the right hand side of the page like – Add and Remove.

1) Add - This option enables you to add a new rule to the “Application Rule”. When clicked on the option of “Add”, it displays a window prompting for the name of the application that needs to be filtered along with the action to be set, i.e Ask, Permit and Deny.

2) Remove – This option works in conjunction with the present rules defined in the above category. To remove, select any of the above rule defined and then click on “Remove” option.

Do note – in order to change the action preference for a particular application, simply right click on the desired application name and select the new action to be taken provided on the menu. Likewise, more information on the process properties and it’s other details can also be accessed using the appropriate options provided within.

D) Trojan Rule – This option page has different options on the right hand side of the page like – Add, Modify, Remove, Default Rule along with the UP and DOWN arrows.

1) Add - This option enables you to add a new rule to the “Trojan Rule”. When clicked on the option of “Add”, it displays a window with four screen, viz. General, Source, Destination and Advanced.