Click here to get back home

Firewalls That Report / Filter Just Incoming Connections?

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Firewalls That Report / Filter Just Incoming Connections? Will 11-01-2006
Posted by Will on November 1, 2006, 9:57 pm
Please log in for more thread options
Is there a "personal firewall" that does a good job of reporting / filtering
incoming and outgoing connections that violate the firewall policy? A
good solution might be simply letting me set up views of the firewall log so
I can view it in different ways that suit my usage, in real time as well as
historically.

After being away from the computer, I would like for example to see just the
failed incoming connections. I would like to be able to further filter
things so that certain expected connection types I can ignore and not see in
the log (e.g., port 137).

The tool gets brownie points if it can not only tell me about an incoming
RPC, but can elaborate what RPC or DCOM service was requested.

--
Will



Posted by Galen on November 2, 2006, 2:53 am
Please log in for more thread options
Will had this to say:

My reply is at the bottom of your sent message:

> Is there a "personal firewall" that does a good job of reporting /
> filtering incoming and outgoing connections that violate the firewall
> policy? A good solution might be simply letting me set up views of
> the firewall log so I can view it in different ways that suit my
> usage, in real time as well as historically.
>
> After being away from the computer, I would like for example to see
> just the failed incoming connections. I would like to be able to
> further filter things so that certain expected connection types I can
> ignore and not see in the log (e.g., port 137).
>
> The tool gets brownie points if it can not only tell me about an
> incoming RPC, but can elaborate what RPC or DCOM service was
> requested.

Outpost...

www.agnitum.com

Disclaimer: I have absolutely no financial interest in the company but am
biased and have an interest in the longevity of the company for my own
personal use.


--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/ http://kgiii.info/

"Chance has put in our way a most singular and whimsical problem, and
its solution is its own reward." - Sherlock Holmes



Posted by Will on November 2, 2006, 1:10 pm
Please log in for more thread options

> Will had this to say:
> > Is there a "personal firewall" that does a good job of reporting /
> > filtering incoming and outgoing connections that violate the firewall
> > policy? A good solution might be simply letting me set up views of
> > the firewall log so I can view it in different ways that suit my
> > usage, in real time as well as historically.
> >
> > After being away from the computer, I would like for example to see
> > just the failed incoming connections. I would like to be able to
> > further filter things so that certain expected connection types I can
> > ignore and not see in the log (e.g., port 137).
> >
> > The tool gets brownie points if it can not only tell me about an
> > incoming RPC, but can elaborate what RPC or DCOM service was
> > requested.
>
> Outpost...
>
> www.agnitum.com

Have you tried Kerio at all? I'll give Outpost a spin as well, thanks.

--
Will



Posted by Galen on November 4, 2006, 2:49 am
Please log in for more thread options
Will had this to say:

My reply is at the bottom of your sent message:

>> Will had this to say:
>>> Is there a "personal firewall" that does a good job of reporting /
>>> filtering incoming and outgoing connections that violate the
>>> firewall policy? A good solution might be simply letting me set
>>> up views of the firewall log so I can view it in different ways
>>> that suit my usage, in real time as well as historically.
>>>
>>> After being away from the computer, I would like for example to see
>>> just the failed incoming connections. I would like to be able to
>>> further filter things so that certain expected connection types I
>>> can ignore and not see in the log (e.g., port 137).
>>>
>>> The tool gets brownie points if it can not only tell me about an
>>> incoming RPC, but can elaborate what RPC or DCOM service was
>>> requested.
>>
>> Outpost...
>>
>> www.agnitum.com
>
> Have you tried Kerio at all? I'll give Outpost a spin as well,
> thanks.

I wasn't so fond of Kerio - I think it was the difficulty in managing rule
sets or overly broad rules for pregenerated rules or something odd like that
but yes and that was quite some number of years ago when I'd last poked at
it. I'm sure there have been many changes since.

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/ http://kgiii.info/

"Chance has put in our way a most singular and whimsical problem, and
its solution is its own reward." - Sherlock Holmes



Similar ThreadsPosted
OS account report March 17, 2008, 12:42 am
windows logs parsing report ? June 20, 2005, 3:28 pm
Blocking incoming IP's July 1, 2008, 3:11 pm
Re: MAC address filter... March 23, 2006, 2:20 am
Re: MAC address filter... March 23, 2006, 2:45 am
Re: MAC address filter... March 23, 2006, 3:10 am
IPSec Filter August 31, 2006, 11:23 pm
ISAPI Filter Vulnerability November 7, 2006, 11:15 pm
Password Filter Issue March 29, 2007, 3:19 pm
Re: Password Filter Issue April 2, 2007, 4:08 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap