Print

Welcome to Smokey's Security Forums.

Guests have only limited access to the board and it's features, please consider registering to gain full access!

Registration is free and it only takes a few moments to complete.

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Kicker]

Hello,

Thanks Tommy! is there a way to monitor what UDP or TCP requests is done from the local PC? Because I guess Statefull inspection is no protection against trojans.

In JPF2, there is a Applications tab which shows which applications has which ports open and how they use it. I think there was something similar in JPF1 as well. If you need more information, then I would recommend using some dedicated diagnostic utility or network sniffer.

Regardsing trojans - statefull inspection will allow only responses to allowed requests. So if your rules does not allow the trojan to initiate the connection, statefull inspection won't help the trojan to get out.

BTW. I am not sure how well UDP statefull inspection works in JPF1. In JPF2 it is not yet fully implemented, so I doubt JPF1 would have robust implementation in place.

Another issue btw, what does these checkboxes mean? (to the left of a policy). Some of my policies are unchecked and with an exclamation mark - in the redirector to Application Blocked Zone and System Blocked Zone.

The checkbox mean if the rule is enabled or not. You can use it to quickly enable or disable rules (e.g. for debugging). The exclamation mark means the rule can't be used for some reason. I think that the only possible reason is that the rule is defined using a group, and that group is empty (happens often e.g. for rules "Block Network Blocked Addresses" or "Allow trusted" when the Blocked Networks group or Trusted Networks are empty).

[voessli]

Thanks Tommy! is there a way to monitor what UDP or TCP requests is done from the local PC? Because I guess Statefull inspection is no protection against trojans.

Another issue btw, what does these checkboxes mean? (to the left of a policy). Some of my policies are unchecked and with an exclamation mark - in the redirector to Application Blocked Zone and System Blocked Zone.

[Tommy]

The first rule explicit allows incoming UDP traffic from DNS servers on local port 53.
The second one allows any incoming UDP traffic but only when it was requested from your computer. This is called 'Statefull inspection'.

[voessli]

Hello to all!

here is a quite technical question. I am configuring my DNS settings and there are 2 confusing policies:

Code: [Select]

Allow incoming DNS: UDP - incoming packet - DNS IP (Source) - Local Adress - Port 53I think this entry resticts UDP connection to a DNS server on port 53.

Code: [Select]

Stateful UDP Inspection: - UDP - any (Event) - any (Source) - any (Destination) - and no port overridei dont understand what that is for, it completely overrides the first entry since no event or addresses are specified. That is, all events and addresses are allowed?

Can someone please explain the difference between both of these policies?

Thanks in advance!