Rising Firewall: Always fails in Shields Up!

I have heard good words about Rising Firewall. But whenever I try it against Shields Up! test it fails. I got the pop-up "port Scanning intercepted" multiple times and after all port scan I find a few opened, some stealth and most closed.

http://i.imgur.com/QCzn4.jpg

Open ports
https://www.grc.com/port_135.htm
https://www.grc.com/port_445.htm
https://www.grc.com/port_902.htm
https://www.grc.com/port_912.htm

I have installed Rising just today and before installing I checked that Windows Firewall Stealth all ports in Shields Up!

 

A few minutes of testing in a Win7x64 vm reveals similar results to yours with several open ports. To fix it, try:

Defence -> Network Data Protection -> Enable

that should do it

 

Whats your point? If your on a secure network in your own house who cares what Shields Up says. This is another one of those things that makes everyone think they need this and that just to stay safe.

 

The firewall in its default state leaves several ports open. At the very least the firewall should close all ports.

 

If you have unexpected open ports, maybe you should try configuring the service or application using them first. Ports aren't open by themselves.

 

I agree with what you are saying but, I had the same problem with this firewall (port 1025 open)...I changed to Privatefirewall and its closed, no configuration needed....It should ideally work out of the box...no?

 

I have that enabled...

http://i.imgur.com/XIstL.jpg

As I said in the post

This means that no applications were using those ports. Only after installing RFW this happened. I had experienced that before too and also confirmed by wat0114.

Btw...

Did the test once again..,
New result

http://i.imgur.com/I0pTA.jpg

Some ports which were opened yesterday are closed today (902 and 912). Does that mean RFW has kind of adaptive behavior?

http://i.imgur.com/4RkGa.jpg

https://www.grc.com/x/ne.dll?rh1dkyd2

How check if RFW has some adaptive nature? And how to disable that?

 

Results of PC Flank are also not encouraging...

http://i.imgur.com/YWrX1.jpg

http://i.imgur.com/41F4b.jpg

 

I took another look in case I missed something. Of the two separate scans I tried using Zenmap, it seems to block or stealth all ports with the possible exception of TCP 6059 or TCP 49154, 49157 & 49158 depending on which scan you believe The second scan result was after I denied ports 135 & 445. I don't believe this to be a Zenmap issue, but rather a Rising fw issue. You might also try:

Settings->Net Defence->IP Rule setting->Deny 135 and 445. It didn't seem to make a difference for me.

Some of my observations of this fw and my final thoughts, fwiw:

1. It does not alert on port scans

2. It does not alert to applications (Firefox for example) attempting network access.

3. Unless I missed it, there is no logging built in whatsoever!

4. even though it's not necessarily important, it does not seem to stealth all ports. It appears to close some, leave one or more open, and stealth all the others.

All of this I find, imo, unacceptable. I would never recommend this firewall/security suite to anyone.

 

1. It alerts on Port Scans

http://i.imgur.com/pCcHb.jpg

2. It actually automatically allows some applications

http://i.imgur.com/QqEb7.jpg

3. There is a logging built

http://i.imgur.com/mZy9i.jpg

What I am really concerned is that it lefts ports open but there could be an adaptive behavior and it fails against PC Flank test.

 

No wonder I couldn't find the logs; they are under the Antivirus tab

The alert now works after I put the "Outbound attack interception" levels to "High".

Thanks for the clarifications

Strange, however, that scan results are all over the map. Sometimes certain ports are open and sometimes they're not. I ran two more and the first showed 139 & 445 open, but a second time they were closed??

 

That's what I found too. Adaptive nature..?

 

Hi:

Did you test the 2012 beta version to see if any port anomaly is present? the 2012 beta might be better then 2011. Try it and let us know.

 

I usually refrain myself from trying out beta products in my real machine. I might give it a try in virtual machine.