Installation:
Configuration:
The Sygate
firewall needs a little adjustments to protect your computer well!
From the
bottom right on the desktop in systray you should see the SPF traffic/attack icon near the clock icon.
You can
always access the ‘SPF quick menu’ by moving the mouse pointer over it and right clicking
it.
Now you
should be fairly safe to connect again to the internet.
When you start a program that connects to net, SPF will ask if it should be allowed or not. Answer ‘Yes’ now if a newbie to firewalls, but write down the program's name for a later configuration. The programs should be disabled afterwards to act as server the same way it was done above to ‘Generic Host .... svchost.exe’. Only instant messengers, some p2p software etc. need server right. Not browsers, email clients and other normal software. Nor in my experience any Windows processes. The only exception is when needing to synchronize the computer's clock. More about that later in this guide.
BY DEFAULT, SPF GIVES ALL THE ALLOWED APPLICATIONS 'SERVER ACCESS RIGHT', SO ABOVE PARAGRAPH WAS WRITTEN TO BE READ TOO !
Testing the firewall:
From the
SPF main window, ‘Sygate Personal Firewall’, you can find a button ‘Security
Test’. It opens web site where you can do the port scan tests ‘Quick Scan’ and ‘Stealth
Scan’. If you are really testing your own internet connection IP as is a usual
case, then the test results should show ‘BLOCKED’ status in all the incoming
ports. Some ports maybe open, like port 5000, but about them later.
Warning:
It is
recommended in the Sygate test site to also run those tests without a firewall,
to see some open ports.
Also the test
‘Trojan Scan’ gives false indications of existing Trojans if some ports are
open, so leave it undone for now.
Seems that the site where that button leads is not working anymore.
Gibson's Shields Up! -test is very popular and I prefer it over Sygate’s. Check that the page shows your own IP number. If you are behind some NAT device or proxy server then this test should not be trusted. It is not then testing your firewall configuration.
Proceed -button and Common Ports -button from the new window.
All the
ports should show a green ’Stealth’-status if the SPF is properly configured.
Check that
the browser you are using has not been given ‘Act as Server’ right.
Incoming
port 5000 may be open. It can be closed/opened with the ’UnPlug n’ Pray’
utility.
Press ’Download
Now’ -button and execute the program..
Firewall general settings:
Some fine tuning:
In case you
have set your computer to go and check if any critical Windows updates are existing and
automatically download them, you have to 'Allow' Generic Host Process ...
svchost.exe to connect outbound to internet with the ‘Act as Client’ client
right. Allowing it server right is a
security risk I think, because it leaves some inbound ports open. That was
disabled in the configuration part of this instruction.
In case you
want to update the computers clock from a timeserver, a small hole must be made though
for the server setting of Generic Host:
Look at the
traffic log. SPF-quick menu, ‘Logs -> Traffic Log...’. There are
shown all the internet connections, both allowed and blocked ones.
Traffic checking and other hints:
From the
box under ‘Running Applications’ you can look all the applications and the 'Local'
ports that they are listening to the inbound connections. From
those you can disable the server right, ‘Act as Server’, in case the above
given firewall tests still show some open ports.
Learn to examine your Traffic Log, above. Sygate has excellent logging capabilities.
You can sort the log by Time (default), Action, Direction, Application Name, etc.
Best security policy is to block as much as you can with a firewall.
If something is not working you have the traffic log to check what is
blocked and then has to be allowed. Also, traffic log does not
really log traffic, it logs internet connections. Outgoing connection
generates usually both incoming and outgoing traffic as you very well
know having a browser as an example.
There is though an addon
program that is faster and allows more options, better sorting and
added filtering of what is shown or rather hidden: http://www.geocities.jp/bruce_teller/sygate5/spflgvw_en.htm
11. january, 2007
Jarmo Salonen
SAFE SURFING !
----------------------------
If you run such software, Proxomitron is one, you will loose outbound connection control from Sygate personal firewall to a various degree depending on the local proxy. I myself have only experience of avast! antivirus proxies, web browser shield and email/newsgroup client scanner. Those proxies only allow known browsers and email clients out that persons normally allow anyways. But you don't get asked by Sygate and the SPF blocking them also does not work. It is a many year known 'issue' of Sygate handling the loopback. As told in the forum, to fix this, a totally new rewrite of a firewall code would have been necessary.
With Avast's webshield it is possible to disable the transparent proxy for all internet browsers and instead to configure only those browsers you use to have proxied for viruses/malware. So if you are not usually running Internet Explorer and suspicious of some malware going out through it, it can be excluded from the antivirus proxy scanner. You will still have the standard shield. Then if you have IE on ask or block basis in application rules, SPF will respond accordingly.