Need your help! No idea about it..

Discussion in 'other firewalls' started by mecute, Feb 15, 2009.

Thread Status:
Not open for further replies.
  1. mecute

    mecute Registered Member

    Joined:
    Oct 9, 2006
    Posts:
    51
    Got an Ashampoo Firewall. In the "Log" Tab it shows an IP address who's incoming imcp (don't know about it) is being blocked..

    IP: 10.115.7.87
    Port: 0
    Reason of blockage: Incoming ICMP blocked


    In the "Active Connection" Tab it also shows..

    Typ: TCP
    Local IP: 10.115.7.87
    Remote IP: 67.195.12.88
    Local Port: 1402
    Remote Port: HTTP
    Status: established


    Got also this "localhost"

    Typ: TCP
    Local IP: 127.0.0.1
    Remote IP: 127.0.0.1
    Local Port: 1406; 30606; 1392.....
    Remote Port: HTTP
    Status: established


    Shields Up got a good result except for this..

    Any idea on how to resolve this? I really dont have an idea about setting up firewalls. An expert advice is needed. THANKS..
     
  2. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    5,128
    Location:
    USA
    It's normal for firewalls to block ICMP (ping/echo) requests. If you're not experiencing connection problems I would ignore it.
     
    Last edited: Feb 15, 2009
  3. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    Regarding the logs, the first is most likely a blocked ping. Can't say for sure as your log entry doesn't specify the type of ICMP. This is commonplace and nothing to be concerned about.

    Can I assume that 10.115.7.87 is your PCs LAN IP? If so, that's a standard outbound connection. 67.195.12.88 is the IP of Yahoo mail. Were you connected to Yahoo mail via the browser at that moment?

    The 3rd is a standard loopback connection. Most browsers establish these during normal operations. All the log entries are fine.

    Regarding the Shields Up, that's one of their standard tests, the file sharing test specifically. All it does is check if the NETBIOS port (139) is accessible from the web. You didn't post the results of what it found. Some local networks make use of that port for sharing files on a local network (LAN) but it shouldn't be accessible from the internet. If Shields Up found that port open, it is accessible from the web and should be blocked at the gateway firewall. This is only possible if you own the network. You didn't say what type of network this PC is connected to, which makes it hard to give a specific answer. Your local IP suggests that it's large, possibly a university network. If this was a small home network with no need for file sharing between local or network PCs, you can either close it by system configuration or make a firewall rule blocking all traffic to that port. Windows Worm Doors Cleaner (WWDC) can close that port and others for you. It's available at http://www.firewallleaktester.com/wwdc.htm. I'm not familiar with Ashampoo firewall so I can't tell you specifically how to create that rule. A little more information (home, school, work, etc) regarding the network this PC is connected to would help too.
     
  4. mecute

    mecute Registered Member

    Joined:
    Oct 9, 2006
    Posts:
    51
    Thanks for all the info guys. you've given me a peace of mind :D atleast i know for now that im safe.

    Shields Up actually reported ports to be invisible except for one that is "closed", the port #1.. hehe don't know why.

    noone particular:

    Im only using a laptop and only connect thru a wireless dialup server.
     
    Last edited: Feb 15, 2009
  5. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    Your ISP might be blocking traffic on that port, a setting in your dialup server, or just the way Ashampoo handles that particular port. It's not open so it's not a problem. There's no major advantage to being stealthed.
     
  6. mecute

    mecute Registered Member

    Joined:
    Oct 9, 2006
    Posts:
    51
    noone_particular:

    I must say you are right. those IP address you mentioned (10.115.7.87) pertains to my IP address. But it may also seem that those pinging my IP belongs to the server where im connected..

    [​IMG]

    Should I let the Ashampoo firewall block it?
     

    Attached Files:

    • conn.JPG
      conn.JPG
      File size:
      35.3 KB
      Views:
      153
  7. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    As long as your service is working properly, let the firewall keep blocking them. If your service starts disconnecting for no apparent reason, then you might have to allow ICMP echo (ping) and echo reply. In some cases, an internet service provider ping their customers to see which ones are using the service at the time. If your system doesn't reply to the ping, the assume the IP isn't being used and make it available to another customer. This only happens with some services that use dynamically assigned IPs. Most ISPs don't do this. Your first post suggests that your firewall has been blocking ICMP all along. If it hasn't caused any connectivity issues by now, it probably won't.
     
Loading...
Thread Status:
Not open for further replies.