Rising Firewall: Always fails in Shields Up!

Discussion in 'other firewalls' started by sg09, Jan 30, 2012.

Thread Status:
Not open for further replies.
  1. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    I have heard good words about Rising Firewall. But whenever I try it against Shields Up! test it fails. I got the pop-up "port Scanning intercepted" multiple times and after all port scan I find a few opened, some stealth and most closed.

    http://i.imgur.com/QCzn4.jpg

    Open ports
    https://www.grc.com/port_135.htm
    https://www.grc.com/port_445.htm
    https://www.grc.com/port_902.htm
    https://www.grc.com/port_912.htm

    I have installed Rising just today and before installing I checked that Windows Firewall Stealth all ports in Shields Up!
     
  2. wat0114

    wat0114 Guest

    A few minutes of testing in a Win7x64 vm reveals similar results to yours with several open ports. To fix it, try:

    Defence -> Network Data Protection -> Enable

    that should do it :)
     
  3. whitedragon551

    whitedragon551 Registered Member

    Joined:
    Sep 30, 2008
    Posts:
    3,189
    Location:
    USA
    Whats your point? If your on a secure network in your own house who cares what Shields Up says. This is another one of those things that makes everyone think they need this and that just to stay safe.
     
  4. wat0114

    wat0114 Guest

    The firewall in its default state leaves several ports open. At the very least the firewall should close all ports.
     
  5. King Grub

    King Grub Registered Member

    Joined:
    Sep 12, 2006
    Posts:
    814
    If you have unexpected open ports, maybe you should try configuring the service or application using them first. Ports aren't open by themselves.
     
  6. clubhouse

    clubhouse Registered Member

    Joined:
    Apr 14, 2009
    Posts:
    180

    I agree with what you are saying but, I had the same problem with this firewall (port 1025 open)...I changed to Privatefirewall and its closed, no configuration needed....It should ideally work out of the box...no?
     
  7. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    I have that enabled...:(

    http://i.imgur.com/XIstL.jpg


    As I said in the post

    This means that no applications were using those ports. Only after installing RFW this happened. I had experienced that before too and also confirmed by wat0114.

    Btw...

    Did the test once again..,
    New result

    http://i.imgur.com/I0pTA.jpg

    Some ports which were opened yesterday are closed today (902 and 912). Does that mean RFW has kind of adaptive behavior?

    http://i.imgur.com/4RkGa.jpg

    https://www.grc.com/x/ne.dll?rh1dkyd2

    How check if RFW has some adaptive nature? And how to disable that?
     
  8. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
  9. wat0114

    wat0114 Guest

    I took another look in case I missed something. Of the two separate scans I tried using Zenmap, it seems to block or stealth all ports with the possible exception of TCP 6059 or TCP 49154, 49157 & 49158 depending on which scan you believe :rolleyes: The second scan result was after I denied ports 135 & 445. I don't believe this to be a Zenmap issue, but rather a Rising fw issue. You might also try:

    Settings->Net Defence->IP Rule setting->Deny 135 and 445. It didn't seem to make a difference for me.

    Some of my observations of this fw and my final thoughts, fwiw:

    1. It does not alert on port scans

    2. It does not alert to applications (Firefox for example) attempting network access.

    3. Unless I missed it, there is no logging built in whatsoever!

    4. even though it's not necessarily important, it does not seem to stealth all ports. It appears to close some, leave one or more open, and stealth all the others.

    All of this I find, imo, unacceptable. I would never recommend this firewall/security suite to anyone.
     

    Attached Files:

  10. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    1. It alerts on Port Scans

    http://i.imgur.com/pCcHb.jpg

    2. It actually automatically allows some applications

    http://i.imgur.com/QqEb7.jpg

    3. There is a logging built

    http://i.imgur.com/mZy9i.jpg

    What I am really concerned is that it lefts ports open but there could be an adaptive behavior and it fails against PC Flank test.
     
  11. wat0114

    wat0114 Guest

    No wonder I couldn't find the logs; they are under the Antivirus tab :(

    The alert now works after I put the "Outbound attack interception" levels to "High".

    Thanks for the clarifications :)

    Strange, however, that scan results are all over the map. Sometimes certain ports are open and sometimes they're not. I ran two more and the first showed 139 & 445 open, but a second time they were closed??
     
  12. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    That's what I found too. Adaptive nature..?
     
  13. taleblou

    taleblou Registered Member

    Joined:
    Jan 9, 2010
    Posts:
    1,166
    Hi:

    Did you test the 2012 beta version to see if any port anomaly is present? the 2012 beta might be better then 2011. Try it and let us know.
     
  14. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    I usually refrain myself from trying out beta products in my real machine. I might give it a try in virtual machine.
     
Loading...
Thread Status:
Not open for further replies.