Firewall : x-Wall

Programs
Internet-active applications control

The list contains all the applications, which has tried to perform an Internet connection. Each new program trying to perform an Internet connection will be added to the list automatically. The list contains two columns - application's name and application's zone. In order to change zone for an application you need to activate a string with an application's name and need to press SPACE or Double-Click this item. Right mouse button click will activate the application's control menu. In order to delete the unnecessary application from the list, press DEL.
If some new application attempts to perform an internet connection, you will be shown with an application's access permission dialog, where you will have a possibility to choose the application's operating zone. It is a very powerful tool for the Internet access control. If you see an unknown (or undesirable) application trying to perform an Internet connection, you will have an opportunity to inhibit it. Incoming activities are very seldom for using of a computer personally. Usually they are related to special internet services (like WEB, FTP etc.) If you do not provide these services to the world and are only using them, never permit an incoming access (though FTP applications may require incoming internet access too)


Settings : x-Wall

Settings

There are to main panels in Setting tab
  • Firewall panel
  • Content Antivirus panel
Both of them allow you to tune Log-to-disk savings.
  • Maximum Log file size
  • Log File pathname
Firewall panel

In Firewall panel "default zone" option is available. This zone (if any) will be used as initial zone for each new application trying to perform access to the network.

Antivirus panel (for c,e,s-Wall)

  • Antivirus option chooses the antivirus to process internet content.
  • Quarantine parameter sets path to store infected and temporary files.
  • Test button allows verifying preinstalled antivirus for scanning of separate internet content types (Plain File, E-mail and archive)
SaveSettings and RestoreSettings

These items in Programs menu allow you to backup and the restore all the x-Wall settings at once. Do not forget that x-Wall keeps the copy of the settings in memory and saves them to the disk from time to time. As the result, you can SaveSettings at any time but before RestoreSettings you should exit x-Wall to avoid interference of x-Wall internal save options process. Then you have to run x-Wall again. You do not need to reboot the computer.


3D reports : x-Wall

3D reports (s-Wall)

3D reports allow presenting the internet access summaries graphically. The next graphs are available (separately by TCP/UDP and incoming/outgoing traffic):
  • Applications summaries divided by the protocols
  • Day statistics by hours
  • Week statistics by days
  • Month statistics by days
  • Year statistics by months
Rotate the graph using mouse holding Ctrl Key.


Content Antivirus : x-Wall

Content Antivirus (c,e,s-wall)
The Antivirus Traditions

There are two main approaches to virus deliverance.

  • File Scanning allows detecting an infected file and possibly curing it. Unfortunately, it is the time consumption process especially in the case of large number of files. This process could be performed manually or by scheduler. In both cases, we concern with the long process, which could not be performed frequently.
  • File Monitoring allows to catch open, read or write operations on all or selected files and to perform AV scan on the file being operated. It is more efficient technique allows scanning only files, which a program needs. However, as the result we should waste the time and CPU resources to scan the same file during each operation. If the files are big (database or multimedia files) or are used often the CPU will be overloaded. Of course, fine file monitor tuning could help but it requires tuning.
All hese strategies presume that the potentially infected files are already on your disk and already could hurt you.
x-Wall Technology
As the majority of the viruses are coming through the network, we should scan firstly the network traffic blocking viruses directly inside windows network subsystem. It could be performed transparently and independently for applications and the result viruses will not be passed to your disk. It saves the CPU resource and significantly decreases virus attack probability.
There several AV controlling options
  • Enable turns on/off antivirus behavior completely and separately for internet protocol (application type)
  • Block virus switches between simple virus detecting and blocking. Do not disable virus blocking until you are sure that you need the content exposed like infected. If Block virus is on x-Wall prevents the infected internet content receiving and substitutes it with safe, detailed and suitable notification message.
  • Log controls the appearance of AV events in Log tab and in Log file (if log is switched on in Settings tab)
  • AV timeout parameter defines the maximum AV response time. As x-Wall fulfils AV checking directly in the network subsystem, it could be impossible to wait forever for AV engine response. Nevertheless, AV response time could vary depending on chosen AV system, CPU loading and complexity of processing content (ex: archive inside archive), the situation should be foreseen. AV timeout parameter limits "waiting for AV" time.

The Content Substitution
Here are the content substition samples appeared instead of infected e-mail or web page and the alert message
x-Wall : Virus Alert
Virus Name EICAR-AV-Test
Content location sphinx.test/virsample/eicarcom2.zip
Quarantine
"C:\Program Files\x-Wall\quarantine\htt7D.tmp"

Using
x-Wall does not include an antivirus program, but can utilize some famous preinstalled antivirus processors. Choose suitable antivirus in Settings dialog.
Some antivirus systems compatible to x-Wall can provide only file scanning. For that reason, the internet content should be temporarily saved on the disk as the files in x-Wall's quarantine for AV scan. It could interfere with AV's file monitoring (if any). Do not enable AV's file monitoring in the x-Wall's quarantine directory ("C:\Program Files\x-Wall\quarantine").


Content Filter : x-Wall

Content Filter (c,e,s-Wall)
Content Security via content filtering

All the information in the network has at least two parameters: address (from/to description) and the data itself (content). Each internet security software or appliance should analyze each piece of the information to make the decision - it is safe for you or it should be blocked. Address part of the information is discussed in Firewall and Zones Sections
In most cases, address part of the information in not enough for making decision about safety. You should mostly receive all the e-mail and have access to the web all over the world. The single criterion of information security is the content (the data itself). Only by analyzing the content it would be possible to solve - Do you want a banner, is a letters infected, is it spam, is a web page potentially unsafe, might your privacy be disturbed. There are many separate applications providing you with that type security, so called content security. Majority of these applications guard you separately, separate programs for ad blocking, separate for spam suppression, separate for privacy and so on.
All of them process the internet content under their own, separate point of view. It is possible to perform all these tasks simultaneously. All these tasks are operating with the same data parameters, so they could be performed in the single place by the single universal and configurable mechanism. Fortunately, all the information transmitting via the internet is in the text form. Web pages are the text in HTML, e-mails are texts too (file attachments are converted to the text form before transmitting). There is the universal method for text processing (Regular Expressions - RegExp). That method is used in x-Wall content security.

Using the rules
To use the Content Filter you do not need to understand all the Content Rule details. You can only turn on/off the rules you need. Web filtering rules could be verified browsing the set of test pages at x-Club. To verify e-mail filtering rules you could write various test e-mails and send it to yourself.
You have to know that some web elements could be used at the site you visiting for its functionality. Unfortunately, there is no exact way to predetermine which elements are used for site functionality. Some of those functional elements consider as potentially unsafe (see myths and legends).
  • Cookies often used for user authorization. Some sites became unusable if the cookies are turned off
  • ActiveX is most dangerous element in the web because it contains a code running directly on your computer. Nevertheless, some sites are using them for their functionality. Well-known flashes are ActiveX too.
Security is always the opponent to availability. The best way is to use default filter settings. If you find, that a site does not work, you should start gradually enabling the content rules.
However, only flexible (RegExp based) and configurable content filters are able to guard from any known and unknown yet unsafe internet content.
Content Filters List
The dialog sets options for content filtering and antivirus options separately for each internet protocol. The product can process internet content before any other application and computer's storage. "Before" forces the application to wait while x-Wall will complete receiving and processing internet content. Each internet application has its own time limitation for waiting period. After that period expires, application will show an error. "MaxSize" avoids this problem. If an internet content size is below that value, x-Wall can fully process the content. If the size is above the content cannot be modified (It still can check viruses but cannot cure (block) them).
The dialog contains the list of rules applied to current protocol. The rules may be
- enabled for outgoing traffic
- disabled for outgoing traffic
- enabled for incoming traffic
- disabled for incoming traffic
The rules can be edited, deleted and new rules may inserted with the toolbar, the right-mouse-button menu, or with the "Ins", "Del" and "Space" (for edit) keys. See Rules manual for the details.
Inside Content Filtering
The best place for the content filter is Windows network subsystem. That location of content filter provides application independence. All the applications make their network connection in the same way (using so-called TCP stack). It is the single place inside OS for providing network data to any Web browser, E-mail program, FTPs and other ones. Fortunately, the Windows developers foresee the well documented the network subsystem providing us the content filter compatible with all Windows versions.
The Content filter works as follows. It can extract all the incoming\outgoing content directly from network subsystem for all the applications, detect the high-level protocol (HTTP, POP3 etc) without unnecessary settings and process each protocol separately with the internal engine (RegExp) or (theoretically) any external program, obtain engine results and put them transparently back to the network traffic.


Distributed Security : x-Wall

Distributed Security

One of the most popular method for providing security to a computer group is as follows (simplified)
There is the computer group, connected via an ethernet to each other and to the Internet. Security policy in that case is determined by the single host (Firewall/Proxy). The traffic between the computers can not be controlled at all.
x-Wall allows to control the security more precisely. If all the computers inside the LAN have x-Wall (special edition) installed, you will have the opportunity to provide more security.
Because of special x-Wall centralized security control you can
  • Stop uncontrolled information exchange via shareable disks (and other resources)
  • Dramatically slow down virus and private information propagation
  • Stop group computer game players
  • Determine complex (individual or group) security rules for internal and external networks
  • Make your security control fast and flexible
  • Forget about physical network modifications (fragmentations) for security reasons
Additional information will be sent by request.


x-Wall series
Personal: Internet Content Filter, Antivirus, Language Translator, Firewall.

x-Wall is a series of 4 products intended to shield your computer and keep your data safe.
x-Wall includes fully customizable and user-defined content filter, antivirus-ready internet processor, personal firewall and on-the-fly language translator.
Content filter includes rule tester-composer and separate options for each internet protocol processing.

Features
  • Internet content filter used to suppress ads, spam, cookie, popups, flash, private data etc. with fully customizable user defined rules
  • Internet content antivirus-ready processor (antivirus not included)
  • On-the-fly web page translation to/from English and the major European and Asian languages (translator not included)
  • Internet access control and automatic internet activity detection for applications
  • User-defined internet content filters
  • Content filter rule composer and tester
  • Separate internet protocol control options
  • Detailed Log and logging control
  • Automatic Internet protocol detection
  • Support for all Web browsers and E-mail applications
  • Customizable and user-defined internet security zones
  • 3D statistical reports (for internet access, found viruses and rule statistics)
  • Non-standard user interface
  • Free 14-days trial


Logs : x-Wall

Logs
Internet Activity Log

Each Log is the history list of all the Internet events. The Internet activity Log relates to each internet applications activities. The latest events are located on the list's top. Each event is supplied with an icon.
- approved outgoing event (or rule)
- rejected outgoing event (or rule)
- approved incoming event (or rule)
- rejected incoming event (or rule)
This list contains detailed connections' data: IP address and a port of a remote computer, time and date of the connections.

Content Filter (c,e,s-Wall) Log

The Antivirus and Content Filtering Log contain events of the antivirus and content filtering rules processing. Information on the content event (name and type), source (protocol and address) and quarantine filename is included.


Regular Expressions : x-Wall series

Regular Expressions

A "regular expression" (RegEx) is a text string that describes the other string's content. RegEx may be used to find substring in a string or make the decision about strings matching.
Regular expressions have a syntax in which a few characters are special constructs and the rest are ordinary. An ordinary character is a simple regular expression, which matches that character and nothing else. The special characters are '$','^','.','*','+','?','[',']' and '\'. Any other character appearing in a regular expression is ordinary, unless a '\' precedes it.
.
is a special character that matches anything except a new line. Using concatenation, we can make regular expressions like 'a.b' which matches any three-character string which begins with 'a' and ends with 'b'.
*
is not a construct by itself; it is a suffix, which means the preceding regular expression is to be repeated as many times as possible. In 'fo*', the '*' applies to the 'o', so 'fo*' matches 'f' followed by any number of 'o''s. The case of zero 'o''s is allowed: 'fo*' does match 'f'. '*' always applies to the smallest possible preceding expression. Thus, 'fo*' has a repeating 'o', not a repeating 'fo'. The matcher processes a '*' construct by matching, immediately, as many repetitions as can be found. Then it continues with the rest of the pattern. If that fails, backtracking occurs, discarding some of the matches of the '*''d construct in case that makes it possible to match the rest of the pattern. For example, matching 'c[ad]*ar' against the string 'caddaar', the '[ad]*' first matches 'addaa', but this does not allow the next 'a' in the pattern to match. So the last of the matches of '[ad]' is undone and the following 'a' is tried again. Now it succeeds.
+
'+' is like '*' except that at least one match for the preceding pattern is required for '+'. Thus, 'c[ad]+r' does not match 'cr' but does match anything else that 'c[ad]*r' would match.
?
'?' is like '*' except that it allows either zero or one match for the preceding pattern. Thus, 'c[ad]?r' matches 'cr' or 'car' or 'cdr', and nothing else.
[ ... ]
'[' begins a character set, which is terminated by a ']'. In the simplest case, the characters between the two form the set. Thus, '[ad]' matches either 'a' or 'd', and '[ad]*' matches any string of 'a''s and 'd''s (including the empty string), from which it follows that 'c[ad]*r' matches 'car', etc. Character ranges can also be included in a character set, by writing two characters with a '-' between them. Thus, '[a-z]' matches any lower-case letter. Ranges may be intermixed freely with individual characters, as in '[a-z$%.]', which matches any lower case letter or '$', '%' or period. Note that the usual special characters are not special any more inside a character set. A completely different set of special characters exists inside character sets: ']', '-' and '^'. To include a ']' in a character set, you must make it the first character. For example, '[]a]' matches ']' or 'a'. To include a '-', you must use it in a context where it cannot possibly indicate a range: that is, as the first character, or immediately after a range.
[^ ... ]
'[^' begins a complement character set, which matches any character except the ones specified. Thus, '[^a-z0-9A-Z]' matches all characters except letters and digits. '^' is not special in a character set unless it is the first character. The character following the '^' is treated as if it were first (it may be a '-' or a ']').
^
is a special character that matches the empty string -- but only if at the beginning of a line in the text being matched. Otherwise it fails to match anything. Thus, '^foo' matches a 'foo' which occurs at the beginning of a line.
$
is similar to '^' but matches only at the end of a line. Thus, 'xx*$' matches a string of one or more 'x''s at the end of a line.
\
has two functions: it quotes the above special characters (including '\'), and it introduces additional special constructs. Because '\' quotes special characters, '\$' is a regular expression which matches only '$', and '\[' is a regular expression which matches only '[', and so on. For the most part, '\' followed by any character matches only that character. However, there are several exceptions: characters which, when preceded by '\', are special constructs. Such characters are always ordinary when encountered on their own. No new special characters will ever be defined. All extensions to the regular expression syntax are made by defining new two-character constructs that begin with '\'.
|
specifies an alternative. Two regular expressions a and b with '\|' in between form an expression that matches anything that either a or b will match. Thus, 'foo\|bar' matches either 'foo' or 'bar' but no other string. '\|' applies to the largest possible surrounding expressions. Only a surrounding '\( ... \)' grouping can limit the grouping power of '\|'. Full backtracking capability exists when multiple '\|''s are used.
( ... )
is a grouping construct that serves three purposes:
  1. To enclose a set of '\|' alternatives for other operations. Thus, '\(foo\|bar\)x' matches either 'foox' or 'barx'.
  2. To enclose a complicated expression for the postfix '*' to operate on. Thus, 'ba\(na\)*' matches 'bananana', etc., with any (zero or more) number of 'na''s.
  3. To mark a matched substring for future reference.
This last application is not a consequence of the idea of a parenthetical grouping; it is a separate feature which happens to be assigned as a second meaning to the same '\( ... \)' construct because there is no conflict in practice between the two meanings. Here is an explanation of this feature:
\b
matches the empty string, but only if it is at the beginning or end of a word. Thus, '\bfoo\b' matches any occurrence of 'foo' as a separate word. '\bball\(s\|\)\b' matches 'ball' or 'balls' as a separate word.
\B
matches the empty string, provided it is not at the beginning or end of a word.
\<
matches the empty string, but only if it is at the beginning of a word.
\>
matches the empty string, but only if it is at the end of a word.
\w
matches any word-constituent character.
\W
matches any character that is not a word-constituent.
[:alnum:]
letters and digits
[:alpha]
letters
[:cntrl:]
control characters (in the ASCII encoding, code 0177 and codes less than 040)
[:digit:]
digits
[:graph:]
same as `print' except omits space
[:lower:]
lowercase letters
[:print:]
printable characters (in the ASCII encoding, space tilde--codes 040 through 0176)
[:punct:]
neither control nor alphanumeric characters
[:space:]
space, carriage return, newline, vertical tab, and form feed
[:upper:]
uppercase letters
[:xdigit:]
hexadecimal digits: `0'-`9', `a'-`f', `A'-`F'


Rules : x-Wall

Rules (c,e,s-Wall)

Regular Expressions
Significant part of the data transferring via the internet is in text format. E-mail messages are a text (or data transformed to the text form). Web pages (except pictures etc) are in HTML format, which is based on text format too and may be edited with a text editor.
Because x-Wall is to process the text forms, it uses one of the most famous and powerful text manipulation instrument - Regular Expressions (RegExp). It's not a programming language. A single RegExp line of letters and the special symbols is a template of the text fragment we would like to find (compare, replace) in a text or an internet content.
If a RegExp template matches to a text, than it's called "Found" or otherwise "Not Found".
Rules structure

A RegExp Rule consists of three PartRules: "Main","Sub Rules" and "Replace".
  • 1. "Main" PartRule (MainRule) is trying to find substring in whole content. If substring was not found, the whole Rule is expected to be not processed.
  • 2. Substring found by MainRule is applied to list of SubRules in series. If the SubRule is "Not Found" all the list is expected "Not Found". For an example, you can find a html tag with main rule and then find (compare, replace) it's attributes separately by SubRules.
  • 3. If MainRule is in "Found" state and SubRules List (if is not empty) is in "Found" state too, then "Replace" PartRule (ReplaceRule) is applied to the whole content. For an example, ReplaceRule may be used to change subject of the an e-mail if that e-mail contains something we could define in a Rule or SubRule.
RegRule

Each PartRule has the same structure (RegRule) and consists of three strings (in RegExp or text format): "Find","Compare" and "Replace".
  • "Find" string is RegExp of the template to be found in the content.
  • "Compare" string (if enabled) is RegExp to compare the substring (i.e. part of the internet content) found on previous step with a template.
  • If the substring is found and matches the template, then it can be replaced with a given "Replace" text (if enabled).
Composing and Testing Rules
Every PartRule and whole rule may be tested separately to insure be OK with the special dialogs. You have to be careful with the rules composition and modification. These Rules will be applied to the whole internet content (including all protocol internal structures). Improper rules may cause application program not to work properly.
Content Rule Sample
Let us try to understand how the RegExp filter works on the example of the banner filter. As everybody knows, that banner is the picture of the several common sizes. We will describe the steps to detect and remove the picture. (see "Web: Ad/Banners by size")
  • As banner is an image, we firstly should detect the image. An image is coded as <IMG> tag in a web page or in an e-mail. The first RegExp determines all the <IMG> tags from the content
  • As banner is an image of predefined size, we should test the both dimensions of the image. If the dimensions are matched with the predefined sizes, we can decide that the image is a banner. If it is so we will go to the next step. If the sizes are not matched, we will go to find a next IMG tag until the content ends.
  • If we have decided that the image is a banner, we should substitute a picture with a more attractive one (from our repository or any other). We have to find the SRC parameter of the picture and set to the URL of the new image.


Zone tips : x-Wall

Zone tips
Setting Application's Zone

Your are always in charge of your own Internet security. You may decide not to connect to the Internet at all -- and be totally safe. You may decide to freely allow any kind of access from the Internet to all your applications -- and be in utter danger. What you probably want to aspire to is to have reasonably safe system allowing you to work with the Internet.
The basic principle is simple: keep the Internet connectivity minimized. If you know why certain application issues Internet connection, allow it. If you don't, don't. Of course there are application that should be allowed to make the connections: Internet Explorer, Messengers, Email programs etc.
Usually these applications make outgoing connections only. On typical PC incoming connections are VERY seldom. They are usually needed for Internet services that your PC provide. Surely there are exceptions, for example, getting files via FTP protocol requires you to allow incoming connections for your ftp client.
Some FTP clients have "passive mode" options. It prohibits incoming connections and you usually want to do exactly that. When you just click to ftp link in your Internet Explorer and you have no control on using passive mode. Then you have to enable incoming connections for your Explorer in order to be able to use ftp from within it. For the "normal" access to the Internet use "Internet Client" or "LAN+Internet" zone. For downloading use "Internet Download" zone. For most cases the latter is equal to "Enable ALL" zone.
There are .... correctly. Consider following instructions.
  • "System". This is not a real applications, but rather a part of Windows core. It requires enabled outgoing connections to access remote (shared) disks. Incoming connections are used to access your PC shared resources (disks and printers). For this purpose System uses "13x and 44x" ports.
  • "Generic Host Process for Win32 Services". This is the most usable service for your Internet connectivity. Every time you want to establish connection to any site you need to resolve its name into its IP address. This is done by these Services connecting (both outgoing and incoming connections are used) to "Domain Name Service (DNS)" via port "53". If your Internet connection uses dynamic IP address (and it usually does) these Services also obtain an IP address for you from your provider's "DHCP" service (port "67", both outgoing and incoming). This is why "Internet Client" (or "LAN+Internet") zone is most suitable for this application.
  • "ALG (Application Level Gateway)". Windows XP uses this application to help other applications establish their Internet connections. It's used by all Internet-oriented applications including any application wishing to download any data from the Internet. This is why "Internet Download" (or "LAN+Download") zone is most suitable for this application.


User's manual : x-Wall

User's manual

All x-Wall programs are an easy-to-use and a very comprehensible.
After the program start (or rebooting) you will see an icon [image] on the task-bar (usually next to a clock). Left mouse button click activates the main program control dialog. "Ctrl-Tab" key or a mouse switches between the dialogs. Right mouse button click gives you an access to the complete program menu. There are 7 (for s-Wall) main dialogs in the program:
  • Programs
  • Content Filtering and Antivirus (c,e,s-Wall)
  • Settings
  • Security Zones (e,s-Wall)
  • 3D reports (s-Wall)
  • Internet activity Log
  • Antivirus and Content filtering Log (c,e,s-Wall)

Compatibility
Firewall
It's strongly recommended NOT to use x-Wall with any other firewall software. Combined (simultaneous) using of two (and more) firewall products may dramatically decrease your security and make system unstable (system may crash).
Remove/Uninstall any other firewall software from your computer. Disabling/Exiting of previously installed firewall software is not enough. Each personal firewall is based on its specific kernel driver to guaranteeing complete network traffic management. Driver is a special program acts as part of operation system and usually starts/stops with the operation system. Disabling/Exiting main program usually means nothing for the driver; it stays in memory and works. However, the kernel driver is the main reason of all possible incompatibility (frozen windows, system crashes, blue screens). Therefore, entire previous firewall software should be removed (uninstalled).
Antivirus
It's possible to use x-Wall with number of antivirus software installed if they are properly configured. Some antiviruses have the opportunity to check viruses at the real-time. Virus checking occurs while files are reading and writing to disk. x-Wall temporary stores internet content as data files for antivirus processing. This may produce double antivirus checking and slows down the performance. To avoid double checking disable antivirus real-time scanning.

Internet Content
There are Internet sites fundamentally using ActiveX, Cookies etc for their functionality. Cookies (for example) are often used on the sites with a registration capability for keeping your registration data between multiple web pages. In some cases ActiveX may be used for an access to an internal site's data. In any situation, it is your personal decision to trust (or not) in the site content, which may be potentially unsafe.


Zones : x-Wall

Zones (e,s-Wall)
Trusted Zone Traditions

Many personal security products divide the entire network into two main zones: Trusted and Unsafe. Trusted zone includes the computer under protection and (possibly) the local network (if any) and allows any network operations. These operations are expected safe because the zone is trusted. Unsafe zone is the all the other network, that is unknown and as the result unsafe. This principle works fine but it could be significantly improved by "Application's Zone" approach.
Suppose that a computer has a number of applications (stand-alone or system dependant). The system itself (operation system) could be assumed as a special application too because it is independent participant of the network interaction providing disk and printer sharing and so on. Each of this application could have its own creation of zone safety.
Application's Zone
Consider several applications in terms of zone trust
  • Internet Explorer (or another Web browser) needs to have the access anywhere inside the local network as all over the world too. There is no special trust difference between local and internet access of a web browser.
  • Outlook (or another e-mail program) needs the access to correspondent mail (POP3/IMAP/SMTP) server only. It could be strange (as the result unsafe) for access anywhere else.
  • Antivirus could obtain its updates only at the AV developers' site and nowhere else. For that reason, Antivirus's trust zone is only one host in the internet.
As the result, Application's zone is more safe and reliable approach to protect your computer. It only expands the traditional method. If you suddenly want to use habitual zone method, you could create only one zone that fully enables only local network traffic and apply that zone to all the applications.
Zone Override
Zone override also expands the traditional point of view. It is usually to have a "panic button" to disable all traffic and (vice versa) a button to disable the guard temporarily (enable all traffic). "Zone Override" can significantly expand this approach. You can use a single zone to use with all the applications saving separate application-specific settings. If you set "Disable All" zone as Zone override you will block all the network traffic. "Enable All" disables all the traffic and stops the guard. However, you could set "LAN Only" zone as Zone override and fill free only in the local network. More than that, you could use temporarily any zone including custom created one to trust temporarily in your "maternal" computer only.
Zone Manager
x-Wall has Zone manager to create, delete, import, export or modify zones. Zones are most powerfull opportunity for applications' internet access control. Right mouse button menu is available.
First time x-Wall starts after the installation, it detects windows network configuration. It tries to detect all the present LAN setting and to configure LAN dependent zones. x-Wall initially assumes that all the LAN access (via all currently installed adapters) is safe. There are two buttons helping to make group rule/zone changing (for advanced users)
  • LAN button helps you to override initial settings retrieved from configuration of LANs that your computer is connected. Pressing the button x-Wall collects the entire present network configuration and makes separate Rule for each LAN adapter. You are given a chance to tune these rules. For example, your computer is connected to more than one LAN simultaneously. Not all the LANs are trusted (consist of trusted computers). The dialog allows you to modify the rules for each the LAN separately. After all the rules are configured, the automated rule-replace procedure will be started. x-Wall examines each zone and finds the zones containing NET rules. The rule name starting with NET indicates the LAN rule. If a zone contains the NET named rule, all those rules will be deleted and the new NET rules you have just edited will be placed at the head of the zone. Be careful, it is fully automated procedure. You can backup all the x-Wall's setting using Save/Restore Setting procedure from Programs menu
  • Rule button is used to update rules with the same name in the all zones. Firstly, all the unique named rules from all the zones are collected. Than you are shown the edit zone dialog with all these rules and you have chance to make correction. After that x-Wall will iterate through all the zones and will replace all rules with matched names with the new parameters you have just entered.
"System" Application
Windows itself could be assumed as the application with the special name System (without correspondent EXE file of course). System application performs network operation as any other application and could be controlled by x-Wall. As the System network activity concerns with disk/printer sharing x-Wall can perform the art control under the sharing. Majority of the network security manual recommends to disable disk sharing as the most dangerous point of possible unauthorized access. However if you really need to give somebody the access your disk shares you can provide yourself with the security using x-Wall. In that case you should use zones and give the access to the disk share for trusted computers only.
Zone Explanation
Zone is a set of rule and options to make the decision of permission or prohibition the internet access. Each time an application accesses to internet, it has the parameters of the connection trying to perform (address and port of the remote computer, used protocol and interaction (in or out) direction). Each time an application trying to access the internet x-Wall compares the connection parameter with correspondent zone (separate application's zone or zone override if any). x-Wall should match the zone with connection parameters and pass or stop the internet access.
Zone Assignment
Each time a new application tries to have the internet access you will be notified via special dialog with application details for making correct decision of suitable application's zone. The "default zone" from Settings tab is initially used. You can change it by that dialog or any time later. However, the main question is still the same. Which zone should I use?
The answer in not so exact, but is useful. Choose the most suitable zone by name. (see Zone tips)
To define exact answer you should know the applications as its developer and have to its behavior in details. It is impossible for a user, but correct zone setting is possible indeed.
Usually, you will find the suitable application zone at the second iteration maximum (in 99% of cases).
It is impossible to perform that kind of security actions formally and automatically. In that case, "press button to full secure" applications would have been available. The main principle is enabling the minimal internet access you need only. In any case, zone (security) tuning is the iterative process with attempts and error corrections (see myths and legends).
The main principles are:
  • Do not enable the internet access to unknown application.
  • Keep internet access at the minimal sufficient level.
  • Always check internet access log to prevent security holes
  • Remember that any security solution is only a tool in your hand without any magic
Suggest the next paradigm.
  • Disable maximum number of applications (including system services and the System itself)
  • Find that something is not working
  • Check the Log
  • If you find that something is not working try to set another (more suitable) zone.
Imagine the application something.exe is detected as internet access candidate. If you do not understand what it is, or the application appearance is not caused by your actions choose disable all. Verify that all that your vitally internet access is enough for you. If something is not working try LAN only zone.
In other words, increase the internet access rights gradually until everything will be good enough.
Do not think that extremely complex, it is the single way to provide yourself with real security.
How Zone Works
To use predefined zone you don not need to understand zone details. Simply choose suitable zone for an application or for Zone Override. Zone details will be needed only for zone edit or custom zone creation.
Zone is a set of rules and zone result saved under zone name. Each rule consists of the rule's name, set of parameters (as connection parameters) and rule's result. To make pass/stop decision x-Wall iterates throw the zone's rule list (if any) and compares the connection parameter with the rule parameter. If defined rule's parameters matched the connection parameters, the zone result (and result application permission) will be equal to the matched rule result. If no rules are matched with the connection parameter, zone result will be used to make application stop/pass decision.
The sample LAN+Internet Zone. An application is trying to access computer at 123.456.789.123 address, port 80, protocol TCP and direction outgoing and it uses the zone LAN+Interent. Let us walk through the rules
  • Local Enable. Rule's address/mask is 127.0.0.1/255.255.255.0. It means the address diapason from 127.0.0.0 to 127.0.0.255. Value of 255 in the mask means exact part of address; value of 0 in the mask means any from 0 to 255. It is simplified but correct. Our address (123.456.789.123) is not matched with rule's address interval. As the result the whole rule is not matched and we should try with the next rule
  • LAN 1. LAN rule (if any) depends on your local network connections. It could differ from the sample.
    • Assume your first LAN (LAN adapter) has the address 10.0.1.4/255.255.255.0. It is not matched with our remote computer. As the result rule is skipped.
  • DNS Enable rule does not contain address/mask conditions defined but has the port (53) defined. It is not matched to desirable port (80). As the result rule is skipped.
  • DHCP Enable is skipped too for the same reason.
  • EnableOut rule does not have any parameter defined expect direction parameter. We are trying to perform outgoing connection, which is matched with out direction. The rule result is enabling. As the result, the access will be granted.
  • If the last rule is not matched, the whole zone result (disable) will be used and application's access will be stopped.
To obtain IP address from name of a site you can fill the host field with the name of a site and press "Address by name" button. IP address will be filled automatically.
Composing Zones (for advanced users)
Before the composing your own zone you should be sure that there are no predefined zone suitable for you and there are no zones could be corrected to be suitable for you. To correct the existent zone is much simpler than create your own from scratch.
You could follow one from two paradigms
  • Choose the zone result equal to disable and add rules enabling some hosts, protocols or directions.
  • Choose the zone result equal to enable and add rules disabling some hosts, protocols or directions.
In other words, you should decide you mostly permit the access or prohibit it. Then use an application performing the test, check the Log and play with the rules ...
Always remember that there are some well-known services (DNS, DHCP etc) could be required for the new zone.