Port scanned behind firewall???

I have a network setup. Two pc's, one win98se and the other winxphome, both connected via a belkin router with built in firewall and nat, and on a cable modem.

I also have SYGATE personal firewall on these computers.

My question is, how can someone do a port scan on my computer and get past the belkin, and have the SYGATE pick it up?

Would the belkin firewall stop the port scan before it reached the sygate?

In other words, are portscans supposed to be seen by the hardware firewall as well as the software firewall?

I checked the security log on the belkin router and it didnt show any intrusions, and its on.

Thanks,

Sky

 

Hi, Skyblue. I doubt that your Sygate firewalls are going to see any portscan activity from outside your network as long as your router and its firewall are set up properly. So they will function mainly to protect you from rogue programs that got onto your own computers somehow. When those programs try to call home, Sygate should alert you. You can tighten up its rules a bit, e.g., limit svchost to the IPs on your network using your NAT IP range as trusted host. But your focus will be on controlling the access from your computer outbound.

 

Scanning behind a router is a common problem. As far as I know, there are two ways to do it.
You can physically bypass your router in some cases, and some even switch to a dialup connection to do the scan.
The other possibility is if your router can forward all traffic to a DMZ, then your firewall can be scanned.
I don't have a router so I am only passing on what I have heard others discussing. May not be worded correctly.
What Finn McCool said is correct about the need for control of outbound traffic. As a matter of fact, I have little if any concern about someone trying to DDoS or "hack" me. I am more concerned about having a backup in case some Malware does get past my first and second line of defense.
On a small lan mostly you want to be sure your ports 135-139, 445, and for XP a couple of others are not open to the net with file sharing enabled. A router usually does that quite well I believe.

 

Hi SKYBLUE,

if you do an online port scan test for example it's not your computer which will be tested, but your router. If there are packets coming through and the software firewall (Sygate) picks them up, this means, that the router's security isn't at 100%. That's the reason why you have Sygate installed behind the router!

But to improve the security of your router, check out the vendors site and look for a new firmware. If you don't have the latest firmware of it installed do it! Sometimes they add additional security features to it. After that check out the router's settings. Are they all correct? After having done all this, check out some online port scans and check your router again -especially check out port 113 (most of the routers don't stealth this special port).

If you have done all this and you still have any questions how to improve the security of your router come back and let us know!

Best regards,

Patrice

 

It seems as though the computer that was registering the port scans in sygate was in the DMZ, I fixed that, However I am wondering if the following services are harmless and should I let them have access all the time:

NT KERNEL & SYSTEM

LSA SHELL

GENERIC HOST PROCESS FOR WIN 32 SERVICES

COMMON CLIENT CC APP

?

THANKS

SKY

 

Hi SkyBlue

Just to add to what LWM said, you will need to allow ccapp access as well because it will be required to validate certain live update files for NAV and is also used for email scanning if you have that enabled.

Regards,

CrazyM