SSM + CHX-I + sensiveguard

[ogodei]

I'm now using the combo SSM + kerio 2.1.5 (I'm in the learning curve of the former and have been a long time user of the later).

Do anyone here have tried / is using SSM + CHX-I + sensiveguard?
Do they work smoothly together?
Are sensiveguard's issues (http://www.wilderssecurity.com/showthread.php?t=102264&highlight=sensiveguard) solved?

[KDNeese]

-{ Quote: "I'm now using the combo SSM + kerio 2.1.5 (I'm in the learning curve of the former and have been a long time user of the later).

Do anyone here have tried / is using SSM + CHX-I + sensiveguard?
Do they work smoothly together?
Are sensiveguard's issues (http://www.wilderssecurity.com/showthread.php?t=102264&highlight=sensiveguard) solved?" }-

I have not tried Sensiveguard but have tried CHX-I with SSM & Kerio 2.1.5. I don't believe there are any conflicts with SSM, but I have read of there being some issues between Kerio & CHX-I. I know the combination did not work for me at all. CHX-I was always going nuts, giving me error messages, needing to close, etc. Also, if you are concerned about the fragmented packets issue with Kerio (which, I assume, is the reason you are considering running 2.1.5 and CHX-I together), there are other free firewalls out there that have proven themselves and which I feel would be better choices than Sensiveguard (such as Comodo, ZA free, Jetico 1).

[Jarmo P]

If those fragmented packets passing is troubling you, why don't you just get a router. CHX-I takes also memory. 17 MB from my experience. Plus it is 2 packet filters same time.

http://www.wilderssecurity.com/showpost.php?p=852030&postcount=17

[ogodei]

@ KDNeese

Thanks KDNeese, but I have read this (http://www.wilderssecurity.com/showthread.php?t=100040) post and I'm not so sure about that. I think that Harden-It 1.2 (free) is doing this (http://news.hping.org/comp.security.firewalls.archive/6847.html) registry teak, so it will let go outbound fragmented packets without reassembling them and kerio wouldn't notice them.

@ Jarmo P

Thanks Jarmo P. I see you are using Sygate 5.5 free. I also heard that syagate is very light on resouces (http://www.castlecops.com/t165823-I_need_a_firewall_that_uses_little_RAM.html), so why didn't you have mentioned sygate? Do sygate have any issues?

@ everyone

I've read this (http://www.castlecops.com/t165823-I_need_a_firewall_that_uses_little_RAM.html) post @ castlecops. Do anyone have tried A-wall? What is your opinion?

[Jarmo P]

I have run kerio 2.1.5 on my system for 1.5 years.

Sygate is an easy learned, light, stable firewall, that should NOT be used if you run local proxy software. Proxomitron is such and some antiviruses like Avast has them too. Makes you loose outbound connection protection of SPF.
It is no leaktest passer on its own.

With my current security setup I could use it. I have uninstalled one and installed other, switched between them many times.
But I remain in general with kerio.
They are both old discontinued firewalls.
You can read more from my user guide in the sig link below.

[Stem]

-{ Quote: "I'm now using the combo SSM + kerio 2.1.5 " }-That is a good combination.

-{ Quote: "Do anyone here have tried / is using SSM + CHX-I + sensiveguard?
Do they work smoothly together? " }-Personally I would not install, or advise a member to install 2 packet filter firewalls. Even if the installation may look o.k., there can be underlying conflicts with packet processing/filtering.

[ogodei]

-{ Quote: "Sygate is an easy learned, light, stable firewall, that should NOT be used if you run local proxy software. Proxomitron is such [...]" }-

I see... Not using proxomitron is out of question! In that case kerio's fragmented packets problem is a lesser issue.

Do anyone have tried a-wall (http://web.archive.org/web/20060519060157/http://www.sphinx-soft.com/firewall/order.html) (download link (http://www.sphinx-soft.com/download/a-Wall-Setup.exe) still working) or have a user manual for it?

[Stem]

-{ Quote: "Do anyone have tried a-wall" }-

There are some posts on this:examples: here (http://www.wilderssecurity.com/showthread.php?p=835455#post835455) and here (http://www.wilderssecurity.com/showthread.php?p=842399#post842399)

[ogodei]

Thanks Stem.

Although A-wall doesn't check the integrity of applications with network access, SSM would manage that, I think.

Concerning betauser2's question, can all ports be stealthed or not?

[Stem]

-{ Quote: "Although A-wall doesn't check the integrity of applications with network access, SSM would manage that, I think." }-Yes, SSM would inform you of program change.

-{ Quote: "Concerning betauser2's question, can all ports be stealthed or not?" }-I never got around to checking on that, but this is not a security problem, as long as the ports are not open.

[ogodei]

-{ Quote: "I never got around to checking on that, but this is not a security problem, as long as the ports are not open." }-

I know, but I rather prefer some obfuscation.

[ogodei]

Have tested a-wall and I didn't like it:

doesn't have a way of controlling traffic by protocol, doesn't have a way of controlling traffic by port / port range, doesn't have a way of controlling traffic by IP / IP range.

Have tried hard to find a manual / tutorial, but I haven't found one. When I tested a-wall, I understood why: there isn't that much to configure.

And at least, but not the last, a-wall does not pass basic stealth tests:


http://www.pcflank.com/scanner1s.htm http://www.grc.com/default.htm (shields up link) (http://www.grc.com/default.htm)

I am totally disappointed by this software. I guess that I have been spoiled by an almost perfect firewall: Kerio 2.1.5.

Thanks everyone for your input. BTW do anyone have other suggestions?

[Kees1958]

Ogedei,

Have a look at blink and coreforce.

I am running Antivir free + DefendeWall paid + SSM free + SensiveGuard free (behind a router inbound firewall) on my wife's PC.

Reason for this is:
- DW gives no pop-ups
- SSM free can be run with user interface disconnected = no pop-up
- SensiveGuard can set (not default rules, but you can in-activate them)
custom rules to deny = no pop-ups

Performance is fast, even with IE7 and I have still left 750MB out of 1 GB memory

[pcalvert]

-{ Quote: "I see... Not using proxomitron is out of question! In that case kerio's fragmented packets problem is a lesser issue.
" }-

If you are using Windows 2000 or higher, then the fragmented packets problem isn't really a problem at all-- just use Harden-It (http://www.sniff-em.com/hardenit.shtml). It can apply lots of registry tweaks, one of which prevents fragmented packets from being reassembled.

Phil