Patch for Application Filtering under Vista

[Frederic]

Hi All,

Here is a small patch to fix a registry issue under Vista RC1 that prevents the application filtering to work:
http://looknstop.soft4ever.com/Beta/Vista/LnSVistaPatch.exe

To be used on top of the 2.05p3. A reboot is required after the pach has been applied.

For experts:
- under Vista Lnsfw1 driver has to be started after AFD driver
- AFD driver comes with no tag value under Vista
- the patch creates a tag for AFD and updates GroupOrderList to have Lnsfw1 tag after the AFD one.
- using LoadOrder utility from SysInternal (http://www.sysinternals.com/Utilities/LoadOrder.html) you can verify the position of lnsfw1 before and after the patch

Regards,

Frederic

[lucazade]

Hi!

I think I need a fix also for the internet filtering page, because my ruleset works good only for some minutes, than i've to disable and renable it for making everythings work ok.
Any idea? I'm using vista rc2, i tried all the ruleset supplied.

Thanks

[Frederic]

Hi,

You should try to select manually the network interface (instead of the automatic mode), then quit/restart Look 'n' Stop.
I've experienced similar things with the automatic mode.

By the way, could you confirm the Application Filtering is working with the patch (and it wasn't before).

Thanks,

Frederic

[lucazade]

ok, i'll try with the manual selection!

Yes, your patch works good! ;-)

Edit: No luck with the manual selection of the adapter... lns works ok just for few minutes, than it blocks inbound connections (like rdp or ftp server)... :-(

[lucazade]

any idea how to solve this problem?

:P

[Frederic]

I didn't see you edited the post with this information (actually it's better to add a new post when changing the content so I receive an email notif, edit is more to change the form or spelling).

I understand that only inbound connections doesn't work. Does that mean they working for some time and suddenly it stops ? and however all other outbound access are OK ?

What is the log content after having the issue ?

Thanks,

Frederic

[lucazade]

Yes, it works for some time, maybe some minutes, and suddenly stops but all outbound access are still OK.
I've to disable internet filtering to make it continue working; i tried the same ruleset on xp and it is ok.. manual choice of adapter make no difference.
Log is empty :-(

[RetupmocSoft]

I'm apply Patch for Vista (build 6000)
BSOD!!!

....if connect on internet.....instant BSOD....

HELP~~~~

[Frederic]

I guess you got the BSOD after rebooting the PC (and not just when running the patch).
Did you also update the drivers from here: http://looknstop.soft4ever.com/Beta/Vista/ ?

Frederic

[RetupmocSoft]

-{ Quote: "I guess you got the BSOD after rebooting the PC (and not just when running the patch).
Did you also update the drivers from here: http://looknstop.soft4ever.com/Beta/Vista/ ?

Frederic" }-

Hi Frederic,

I using 2.05p3 (without any patch, including DEP patch)

Reboot vista 6000, LnS running ok, but Application filter no any response.
Without Application filter, Internet Filter block any of DNS packet. (I think this is side-effect)....Of course, I can't do anything on the internet.

After I download and patch Vista Application filter,
Reboot, run LNS, connect to internet......instant BSOD
If I don't run LNS, connect tio internet, .....OK

I'll try download http://looknstop.soft4ever.com/Beta/Vista/
and test again and report.

(Edit after apply Vista driver+Vista Patch........instant BSOD after connect on internet, Vista 6000)

ps. I test Vista 6000 in VMWare 5.53 Workstation.

[Frederic]

Hi,

Ok I forgot something: the DLL filtering, this is not supported under vista with the current driver; and this causes BSOD.
Could you confirm this is disabled when you get the BSOD ?
If it is, could you send us the minidump file at lnssupport@soft4ever.com ?

For DNS request that are filtered, another thing to be done under vista: for all rules using 1024-5000 port range you need to extend/change the range so it includes 50000 or even 60000 port values. You should look at the log to check the port that are used.

Regards,

Frederic

[RetupmocSoft]

-{ Quote: "Hi,

Could you confirm this is disabled when you get the BSOD ?

For DNS request that are filtered, another thing to be done under vista: for all rules using 1024-5000 port range you need to extend/change the range so it includes 50000 or even 60000 port values. You should look at the log to check the port that are used.

Regards,

Frederic" }-

Oh....Ya. I have set enable the DLL Filter when BSOD.




(EDIT: I've test again, Lns running on Vista 6000 is OK....not instant BSOD)

I found following problem: (after turn off and disabled windows firewall competely)

DNS range from 1024..5000 change to 40000..60000, DNS problem solved.

1. Network Interface automatic selection not functional, it will select "IPv6" interface.

[IPv6] by checked will "correctly" report Internet IP, but packet-filter no use. (look like no firewall at all),
Of course, Log page is empty all the time even www.grc.com firewall test.

2. If I manual select IPv4 network interface...

[IPv4], can't report Internet IP "0.0.0.0", and packet-filter use "0.0.0.0" instead "Equip my IP@", cause large blocks.

3. If I connect internet using manual select [IPv6] to get real IP, and switch [IPv4] after connected....

[IPv6] -> [IPv4], finally, log page show block information , look like packet-filter work.
But "Equal my IP@" is 0.0.0.0 (due to IPv4)



So...the problem "core" list:
IPv4 can't detect IP, "Equip my IP@ always 0.0.0.0" cause packet-filter can't functional correctly.
IPv6 detect "Equip my IP@ is real IP", but packet-filter no functional.



Or....something fault with my setting LNS....
Any suggestion?

[Frederic]

Hi,

Yes, I confirm there is an issue there.
Still under investigation. I don't know yet the root cause.

In my case, automatic doesn't work properly, I have to select manually the adapter, and the IP address in the welcome page is correct, but not consistant with the information given in the Options page, however the internet filtering is working and the IP (for "equal my @" rules) is OK.

Regards,

Frederic

[SVic]

Hello Frederic.
In advance I ask to excuse for bad English since I use the translator from Russian.
Has established L'n'S 2.05p3 on Vista 32bit Ultimate (6000). Has applied a patch "LnSVistaPatch.exe" and has copied files from " Drivers for Vista v2+v1.zip ". A problem: Sometimes the resolving rule does not work.

[Frederic]

Hi SVic,

Maybe you need to update some port ranges for rules using 1024-5000 as source ports ? (see RetupmocSoft post just above).

Otherwise, could you give us more information: which kind of rule doesn't work and do you have some alerts in the logs ?

Thanks,

Frederic