About

About program

NeT Firewall is an effective solution for protecting your system or local network from external and internal threats and malicious acts without limiting network capabilities.

All incoming or outgoing traffic from external networks to internal network or vice versa passes thru the machine that has NeT Firewall installed. The traffic is being filtered basing upon specified security policy. Only the data permitted by security policy in use are passed along.

Your system security policy depends on selected levels (modes) of security of interfaces and currently active set of rules.

NeT Firewall allows enabling and disabling access to your personal computer resources such as files and printers, mail services and web-server.

NeT Firewall implements complete network traffic monitoring cycle on your system as well as it allows viewing and sorting traffic.


Network interfaces

Network interfaces or network adapters are expansion boards installed on your computer motherboard. There are also non standard interface types intended for notebooks and handhelds. In some cases network interfaces are integrated into motherboard.

Ethernet uses MAC-addresses to determine the destination of network packets. MAC-addresses resemble unique serial numbers given to each Ethernet network adapter upon manufacturing. This unique address is used to identify network interface on local network, thou it can be changed using software. When operating a network adapter monitors all network traffic passing thru and looks for its MAC-address in each packet. If it is found the adapter receives the packet. There are also special means of broadcasting packets to all adapters on the network. MAC-address is six bytes long and is usually specified as a hexadecimal value, e.g.:

11 - 35 - 56 - F8 - A1 - C4

The hyphen signs (dashes) are not present in MAC-address; they are intended for increasing readability of MAC-address only. Each manufacturer assigns addresses from its own range of addresses. First three bytes of MAC-address define the network adapter manufacturer.

To view your local system network interfaces left-click the ‘Network interfaces’ to expand the tree.


Levels of Security of Interfaces

Level of security should be set for each network interface installed on your system in accordance with security policy. Incoming packets are passed thru or blocked basing on this setting. The following levels of security of interfaces are supported:

  • Low Security
  • 1st Level Stealth Security
  • 2nd Level Stealth Security
  • 3rd Level Stealth Security
  • High security
  • Emergency level

Low level of security means the network interface acts as follows: everything that is not forbidden is allowed. All packets are passed thru except for those that are not prohibited by security rules.

1st Level Stealth Security means the network interface works in incoming packets checking mode, ensuring the address of an incoming packet complies with your request. Any incoming packet that does not comply with your request will be blocked.

2nd Level Stealth Security means the network interface works in incoming packets checking mode, ensuring the address and protocol of an incoming packet complies with your request. Any incoming packet that does not comply with your request will be blocked.

3rd Level Stealth Security means the network interface works in incoming packets checking mode, ensuring the address, protocol and port of an incoming packet complies with your request. Any incoming packet that does not comply with your request will be blocked.

High level of security means the network interface acts as follows: everything that is not allowed is forbidden. All packets are blocked except for those that are allowed by security rules.

To select a level of security for network interface

1. Click the desired network interface node in program tree.

2. Move the slider to the desired level of security in the window that appears.

Note

  • Regardless of level of security set for a network interface, each packet is first checked for compliance with security rules; it is checked for compliance with level of security of local system only in case that no rule is sufficient to determine whether a packet should be passed thru or blocked.

Important

  • All packets are blocked in Emergency level, regardless of security rules in use.


Emergency Level

Emergency interface security level resembles full blocking of network activity for given interface. No packets will be processed on this level of security and all packets will be blocked.

Note

  • All packets are blocked in Emergency level, regardless of security rules in use.


Network interface activity diagrams

NeT Firewall allows monitoring network activity of each and every of your local network interfaces visualizing data by means of incoming and outgoing traffic diagrams (with axis representing speed (bytes per second) and time of operation). Diagram scale is variable depending on Current maximum speed parameter at any given moment of time. To view network interface activity data left click the corresponding node of program tree.


What is a security rule?

A security rule stands for principle upon which the packet either is passed thru or blocked. Each rule has its unique identifier or in other words usage priority. Identifier determines the order of application of rules to a packet received. The smaller is the priority value of a rule, the higher is its priority and the faster it will be applied when analyzing packets. Packet analysis is stopped when there is a security rule strictly determining whether the packet should be passed thru or blocked. In case that there is no rule that can be applied to a packet received it is checked for compliance with level of security of an interface it was delivered to. Summing up the above said, security rules are applied prior o checking a packet for compliance with level of security settings.

Important

  • It is important to determine the order of applying security rules, when developing computer security system.
  • All packets are blocked in emergency security level , regardless of security rules in use.


Terms

Rule description is a human readable line of text intended to provide description of a rule and what packets it applies to.

Rule identifier (or rule priority) is a numeric value within the range of 1 to 65535. The smaller is the priority value of a rule, the higher is its priority and the faster it will be applied when analyzing packets.

Network interface is a network adapter that receives the packets that are analyzed basing on a security rule.

Depending on Type the rule will either pass packets thru or block them.

Rule direction defines packets affected by the rule. Security rules can be applied to incoming packets only, outgoing packets only or both incoming and outgoing packets.

According to protocol, the rule is applied to the packets with the same protocol only.

Source IP-address and port - control over packets with given source defined by security rules.

Destination IP-address and port - control over packets with given destination defined by security rules.

Note

  • The Port term applies to TCP and UDP network protocols only.


Loading and saving security rules

NeT Firewall allows saving and loading security rules to and from file making it possible to transfer security settings from one computer to another.

To load rules from file

  1. Open rules loading dialog window by doing one of the following
    • Select Tools from the main menu, click Load rules.
    • Press the Load rules button on the Toolbar.
  2. Select file name and specify the rules you want to import to your local system.
  3. Press the Append button.

Important

  • After loading rules from file they will be marked as not active. To make a rule active
    1. Click Rules node on the program tree.
    2. In the left list click the required rule and then on the Action menu, click Enable.

To save rules from current configuration to a file

  1. Open rules saving dialog window by doing one of the following
    • Select Tools from the main menu, click Save rules.
    • Press the Save rules button on the Toolbar.
  2. Select file name and specify the rules you want to save to a file.
  3. Press the Save to overwrite the existing file or the Append to append rules to the end of existing file.

Note

  • A file with standard security rules is bundled with NeT Firewall.


Creating a new rule

To create a new rule using Rule Wizard

  1. Run a Rule Wizard by doing one of the following
    • Select Rules node from the program tree and then on the Action menu, click Run Wizard.
    • Press the Run Rule Wizard button on the program Toolbar.
  2. Follow the on-screen instructions on creating a rule.
  3. If the newly created rule needs to be activated immediately after creation, check the Enable after Finish option on the last step of the Wizard.

To create a new rule using property pages

  1. Open property pages for new security ruleby doing one of the following
    • Select Rules node from the program tree and then on the Action menu, click New Rule.
    • Press the New Rule button on the program Toolbar.
  2. Follow the tips available on property pages.

Important

  • Keep in mind: by default block packets property is set when creating a new security rule.

Note

  • After the new rule is created using property pages it will be added to the list of inactive security rules. To activate the rule
    1. Click the Rules node of the program tree.
    2. In the left list click the desired rule and then on the Action menu, click Enable.
  • Several rules can be created at a time when creating a new security rule using Rule Wizard and specifying destination IP-addresses using URL.


Rules operations

There are three possible rules operations: Enable, Disable and Delete.

Enable operation includes the rule to the list of active rules; this list of rules defines which packets to block and which to pass thru.

Disable operation excludes the rule from the list of active rules, making it inactive when analyzing which packets to block and which to pass thru.

Delete operation deletes the rule from the list of rules.

Notes

  • To perform the desired operation, click the desired rule and then select the appropriate command on the Action menu.
  • If the rule is included in the list of active rules, the Delete operation will first result in the rule being Disabled.


Port/Protocol Mapping?

As you may already know Port Mapping (or Port Address Translation - PAT) is the process where packets arriving to a particular IP address/port can be translated and thus redirected to a different IP/port. NeT Firewall allows you creating Port Mappings and even Protocol Mappings (mapping particular IP/Protocol to the different IP).

In order to create new mapping right-click Port/Protocol Mapping entry under selected network interface and choose “New Port/Protocol Mapping”. Then fill in required mapping properties.

Important

  • It is important to determine the order of applying Port/Protocol Mappings, when developing computer security system.


Viewing network packets statistics

To view blocked and passed thru packets on local system, click Log node in the program tree.

If you select a child node of a node representing a network interface you will be able to view statistics on packets processed by the given network interface; otherwise you get the stats on all packets processed by all network interfaces installed on the system.

Packet view window resembles a list with the following columns: Type, Source IP: Port, Destination IP: Port, Protocol, Num, Time First, Time Last and Reason.

The Type field can take one of the following values: incoming packet, outgoing packet or blocked packet.

Source and destination IP-addresses and ports values are extracted from network packet parameters.

Protocol field represents protocol used to deliver the packet.

Time First and Time Last values are based on time when the very first or the very last packet of identical type was received from identical IP-address and port over the identical protocol.

Num value represents the total number of packets received from Time First to Time Last.

Reason represent the identifier of the rule that defines whether packets to block or to pass thru.

Important

The list of network packets is not updated automatically, so to update the information you should perform one of the following actions

  • Click Log node on the program tree or the list of network packets and then press the Refresh button on Toolbar.
  • Click Log node on the program tree or the list of network packets and then on the Action menu, click Refresh.
  • Click Log node on the program tree or the list of network packets and then push F5 button on keyboard.

Note

  • Types of packets to log can be set by specifying them on property pages for Log-type nodes that belong to a network interface. Use Action menu Start, Stop and Clear commands to start packet logging, stop packet logging or clear the list of packets window respectively.


Aliases

Alias is a pair: a description and computers IP-addresses range. It is sometimes useful to an alias for a group of computer or a range of IP-addresses.

Aliases are very convenient in use when creating rules that should apply to the group of computers.

To create an alias you should select the Aliases node from the program tree and then on the Action menu, click New Alias. On the properties page that appears you should enter the alias name and description as well the range of IP-addresses the alias will be associated with.

To delete an alias

1. Click the Aliases node of the program tree.

2. In the right list click the alias to be deleted and then on the Action menu, click Delete.

Note

  • Deleting an alias does not result in deletion of rule(s) associated with it.

Important

  • All security rules created without using aliases but including IP-addresses or destinations that fall into existent alias IP-range will be associated with the Alias.


Options

For increased ease of use NeT Firewall start end exit program options can be configured.

  1. Start NeT Firewall startup: either on operating system startup or manually.

  2. NeT Firewall main window: either show or hide on startup.

  3. NeT Firewall startup set of rules: either the last used one or nor security rules.

  4. NeT Firewall configuration on exit: can be set to ‘keep configuration as is’, ‘allow access to local system from external networks for all packets’ or ‘block access to local system from external networks for all packets’.

To change current settings you should perform one of the following actions:

  • On the Action menu, click Options.

  • Press Options button on program Toolbar.