Zonealarm Port Control

[Coreper]

does anyone here know how i can configure the access to my open ports on my computer?

so i can allow certain programs, and block others

please help

thanks

[andsome]

When the firewall is new, and you try to get on line with a program, you will get a warning. Put a tick in the box which says 'remember this action', and then either tick to allow or disallow access. Is this what you mean?

[Coreper]

maybe...

you know about ports right?

you can open them or close them [through your router]

but ,in this case, can you set ZoneAlarm this way to only allow 1 program to access a certain port?

or is this by default? [the protection]

note: i have read this article, but couldnt figure out how to do it >> doesnt it only tell you how to make "holes" in your firewall?

[cozofdeath]

The link you posted opens ports in the firewall for any program. To do that Open ZA, go to the Firewall section, the Main tab, click the Custom button next to Internet Zone Security. When the Custom Firewall Settings box pops up scroll down to "Allow incoming UDP ports: (non selected)". It may not say (non selected) but this is were you would add the UDP ports, the TCP ports are below the two UDP settings.

If you want to control a certain program, Open ZA, go to the Program Control tab, click the Programs tab, right click on the selected program and choose Options. When the Program Options box pops up click the Expert Rules tab and set an expert rule.

From there just choose what protocol and port to allow/block and or what ips.

Hope it helps.

[Coreper]

but i dont want to open a port through ZA [already did that through my router]

so i can configure ZA this way that it would only allow one program through a port?

or will ZA automatically do that if i get a warning and allow it?

'cause wouldnt i make a major security hole if i would open a port for everything?

if ZA doesnt automatically does this, could you explain me how to configure it to only allow 1 program through a specified port?

[cozofdeath]

or will ZA automatically do that if i get a warning and allow it?

Yes, sorry I didn't understand at first.

'cause wouldnt i make a major security hole if i would open a port for everything?

Not usually. An attacker would know your computer is online if it found an open port but if there are no applications listening on that port it should pose no danger. Having an open port is like having a house door open, you can see in a little and you see the people are home but the locked screen door is keeping you from entering. If the screen door (application) is designed with a flaw, say a loose frame, someone with that knowledge of the screen can pop it open and illegally break in. ZA and other Firewall makers like to make it seem like your computer isn't even online by shutting all front doors until an application requires access to it. That way an attacker doesn't know what to attack as you probably already know.

if ZA doesnt automatically does this, could you explain me how to configure it to only allow 1 program through a specified port?

I believe the only method of doing this is program control. Letting ZA do automatically and manually customizing program options. The firewall has the main control over all network traffic so if you set an expert rule for a program the firewall will override it. Like if theres a firewall rule to block all tcp traffic on destination port 80 then you set an expert rule for the program firewall to allow it to use tcp/80, it still will not be allowed. So I don't really know if there is an exact way to do what you want but this is want I know about ZA.

[Coreper]

so what your saying is that it doesnt really matter that i have an open port, because ZA protects me well enough?

and it i would like to block a port and only allow one program to access it, i should set up an expert rule...

[cozofdeath]

so what your saying is that it doesn't really matter that i have an open port, because ZA protects me well enough?

No. An attacker will be able to see the open port and if there is an application listening on that port it could be possible to exploit it. ZA will not block traffic to that port any more and it will no longer be hidden from queries. So if I knew your ip address and wanted to port scan your computer I would see that port. Depending on the port number I would guess what application is running behind it and attempt to connect to it. So if it was port 21 I would open an ftp connection to you and see what I get in return. So it does lower your security and you shouldn't open a port if you don't have to. Sorry I should have clarified this earlier. It sort of depends what application would be using the port.

and it i would like to block a port and only allow one program to access it, i should set up an expert rule..

I tried this and it doesn't work because the firewall takes precedence over the program control. In the firewall there are no expert options for programs just protocols and ports. So if you block all access to port 666 then you wanted to play doom and allowed the doom.exe program to send data through 666 in the program control expert rules, it would not work because the firewall would stop it.

[Coreper]

oh, ok...

would there be another way to keep my pc secure AND have an open port...?

[cozofdeath]

IDS or IPS software. Or just keep the program listening on the port updated. The ZA firewall suite should be enough that it should detect something. Most attacks come from bots searching ip ranges for exploitable ports and software. Then if found place a downloader, trojan, etc on the computer. ZA would detect this or important system changes. More than likely you won't have to worry if the program is just updated.

[Coreper]

so... i can just leave the port opened and as long as ZA is on, it will protect me?

btw: what do you mean with: "keep the program listening on the port updated?" >> i dont get the "listening"-part and the "updated"-part...

sorry that i dont understand it well

[cozofdeath]

Sorry about that. What I meant is for a port to generally be open something has to be ready to accept the data. So if you open a port in ZA and there isn't an application ready to accept the data coming to your computer nothing will happen. For example if you were to open port 23 and try to telnet to it using Windows telnet you would get nothing. Or if you open port 80/http on your computer and you use another computer to try to open http://your_computer, it would do absolutely nothing because you don't have a web server running/listening on that port to receive/respond to the data. So an attacker can do nothing with that. Its like the port is dead. But if you do have a web server listening on that port you would get a web page.

If the example web server hasn't been updated for a long time then there are probably security holes not patched. So they could simply attack the holes left in the old web server because it was not patched.

[Coreper]

so... [still dont really get it]

what should i do to keep my open my port [and pc] secure?

{btw: whats with this topic's email notification: i check it every time, but it doesnt work!}

[cozofdeath]

You should be ok to just open the port. Can you post why your opening it or for what program?

{btw: whats with this topic's email notification: i check it every time, but it doesnt work!}

I have no clue. I don't use email notification except for IMs. So I kind of just visit in, look around and try to find new stuff.

[Coreper]

i opened the port for uTorrent >> faster download rate

[cozofdeath]

As long as its v1.6.1 build 490 the beta. If you have an older version you should update or watch what torrents your downloading. Theres a remote exploit for all older versions that works on xp sp1, sp2, win2000 sp1-4.

[Coreper]

ive got that one! > i keep my software as updated as possible