Welcome to iolo Personal Firewall

iolo Personal Firewall™ protects you against Internet threats by controlling the communication between your PC and other computers. (More product details.)

Once installed and enabled, the firewall is automatically securing your computer.

  • Read basics on running the firewall

  • Read basics on configuring the firewall

  • Read overview descriptions of all firewall tools

Click a link below to jump to instructions specific to each tool.

 | Firewall | Network Activity |  | IntelliDefense
Zone Security Program Policies |  |  | Firewall Odometer News Updates Online Assistance How does a firewall work?

Related topics:

Detailed Tour of Interface

System Requirements

How to use this Help system

Contact Technical Support


Product Overview

iolo Personal Firewall – Product Overview

See also: iolo Personal Firewall Web page

iolo Personal Firewall puts up a barrier against Internet dangers by controlling the communication between your PC and other computers. It prevents unauthorized users from gaining access to your computer.

Once installed, your computer is immediately protected against hackers, identity thieves, system attacks, and other Internet hazards.

While no further setup is required, iolo Personal Firewall allows you to easily configure settings to suit your work style. You can establish security levels, designate certain computers and Web sites as "trusted", block or allow access for specific applications, and more.

Use iolo Personal Firewall to:

  • Prevent identify thieves from accessing your private information.

  • Protect against malicious software that can destroy your computer.

  • Eliminate the downtime, wasted resources, and lost data caused by intrusions and attacks.

  • Set up special access rights for those computers, networks, and Web sites that you trust. (Show me how.)

  • Create tailored policies so that individual applications have specific access rights. (Show me how.)

  • Make informed decisions, or have the firewall automatically make decisions, based on program attributes. (Show me how)

  • View and analyze intrusion attempts and detect security vulnerabilities. (Show me how.)

iolo Personal Firewall Highlights and Advantages:

  • IntelliDefense™ is a proprietary threat-evaluation tool that makes iolo Personal Firewall "smarter": the firewall makes informed decisions and you see fewer messages.

  • Controls outgoing communication, not just the incoming threats.

  • Eliminates complicated setup for novices with preset security levels, a guided setup wizard, one-click features, and automated decision-making.

  • Gives advanced users greater control, allowing for detailed customizations of port settings, program policies, and more.

  • Automatically detects and blocks common attacks with no configuration needed.

  • Detects unauthorized modifications to programs.

  • One-click restoration of default settings allows for troubleshooting and worry-free configuration.

  • One-click feature to block all network traffic for instant restrictions.

  • Real-time monitoring and historical statistics allow for both quick traffic analysis and more advanced troubleshooting.

  • Integrated update feature keeps your PC continually protected from the latest Internet threats.

  • iolo offers email support, telephone support, and Web support – all unlimited and free.

Related topics:

System Requirements

Tour of the iolo Personal Firewall Home page

Basic Steps for Using the Firewall

Basic Steps for Configuring the Firewall

General Security Tips


Installation

From your Windows taskbar, click Start, then Run. Type [drive]:\setup.exe and click OK.

(For example, if your CD drive is drive D, type d:\setup.exe.)

  • Make sure no spaces are entered; spaces in the User ID or Serial Number will cause an error.

  • Make sure you type the entire User ID. If your User ID includes a hyphen "–" and a number at the end, all of this information is necessary.

Correct: johndoe@domain.com-3

Incorrect: johndoe@domain.com

Incorrect: johndoe

[Not the complete User ID]

Incorrect: johndoe@domain.com - 3

[Has spaces]

Incorrect: JohnDoe@domain.com-3

[Case does not match; the User ID field is case-sensitive]

  • Verify that you typed the license information exactly as shown. Some characters (such as the number 0 and the letter O) can look very similar.

Try double-checking the following: the letters O, l (lower-case L), I (capital i); and the numbers 0 (zero) and 1 (one).

  • If your User ID contains an email address, it must be the original address shown on your invoice. Do not substitute a different email address for the one shown.

  • Make sure you are entering license information for iolo Personal Firewall. License information for one iolo product is not interchangeable with another iolo product.

  • Make sure that you have not exceeded the allowed number of installations. You may install iolo Personal Firewall on up to, but not exceeding, 3 computers.

  • If you are still seeing invalid license information messages, please contact Customer Service.

Installation / Uninstallation

See also: System Requirements

Installation Instructions

  1. Uninstall any other third-party firewall you have installed.

  2. Close all programs (recommended).

  3. If you are installing from:

  4. A CD, insert the iolo Personal Firewall CD into your CD drive. The installation wizard automatically opens for most users. If the installation does not start:

  5. A download, double-click on the downloaded .exe file. The installation wizard opens.

  4. Licensed users: Enter the User ID and Serial Number. This information is on the CD case/sleeve or in the email message you received with license information.

  5. In the User ID field, completely type all letters, numbers, and hyphens, exactly as shown. This field is case-sensitive.

  6. In the Serial # field, completely type all letters and numbers, exactly as shown. (The hyphens will be automatically entered.) This field is case-sensitive.

After entering the license information, click OK. I see an incorrect or invalid license information message.

  5. Read and accept the license agreement. You must accept the license terms to install iolo Personal Firewall.

  6. Continue to follow the on-screen instructions. When designating the installation location for the program files and shortcut, you can keep the default selections or change them.

  7. On the last screen of the installation wizard, click Finish. You can restart your computer at that time or restart it later. You must restart your computer to complete the installation.

Upon installation, iolo Personal Firewall is enabled and its icon [image] sits in your system tray. The firewall is immediately controlling both incoming and outgoing Internet traffic using default settings built into the application.

Read more about getting started with iolo Personal Firewall.

Uninstallation Instructions

  1. Close all programs (recommended).

  2. From the Windows Start menu, go to the iolo Personal Firewall program group you set during installation. (The default installation location is Start > Programs > iolo Personal Firewall).

  3. Click Uninstall iolo Personal Firewall and then click Yes on the confirmation window to start the uninstall process.

  4. Restart your computer to complete the uninstall process.

Note: You can also use the "Add or Remove Programs" utility built in to Windows to uninstall. The program name listed on the window is iolo technologies' Personal Firewall.

Related topics:

System Requirements

License Agreement

Tour of iolo Personal Firewall Home page

Basic Steps for Using the Firewall

Basic Steps for Configuring the Firewall


System Requirements

Operating System. One of the following Microsoft operating systems:

  • Windows Vista

  • Windows XP (Home Edition or Professional)

  • Windows 2000

  • Windows Me

  • Windows 98

Note: iolo's products are not guaranteed to be compatible with 64-bit operating systems, such as Windows XP x64. It is recommended that iolo Personal Firewall not be used in a 64-bit environment. 64-bit compatibility is being researched and may be included in future versions.

Hardware

  • at least 20 MB available hard drive space

  • at least 128 MB RAM (256 MB or more is recommended)

  • at least a 400 MHz processor

Software

  • Microsoft Internet Explorer 6, with Service Pack 1 or later

Related topics:

Install iolo Personal Firewall

License Agreement

Product Overview


License Agreement

END USER LICENSE AGREEMENT FOR iolo technologies, LLC

IMPORTANT--READ CAREFULLY--READ THIS END USER LICENSE AGREEMENT ("LICENSE") CAREFULLY, BECAUSE BY DOWNLOADING, INSTALLING, COPYING OR USING THE SOFTWARE OR ATTEMPTING TO DO ANY OF THESE THINGS, YOU ARE AGREEING TO BE BOUND BY THESE TERMS AND CONDITIONS. IF YOU DO NOT AGREE TO ALL OF THESE TERMS AND CONDITIONS OR DO NOT WISH TO BE BOUND BY THIS LICENSE, DO NOT DOWNLOAD, INSTALL, COPY, TRANSMIT OR USE THE SOFTWARE.

This License governs your use of the SOFTWARE made available for your use by iolo technologies, LLC ("iolo"). All iolo applications (and third-party software included therein) downloaded, copied or otherwise obtained from the Websites owned and operated by or on behalf of iolo, all updates, patches, fixes, modifications and enhancements thereto, including releases of new versions (even if you allow us to provide these to you automatically), any associated media, any printed materials, any online or electronic documentation, as well as related services, shall hereinafter be collectively referred to as the "SOFTWARE". By installing, copying, downloading, or otherwise using the SOFTWARE, you agree to be bound by the terms of this License.

This License covers only the SOFTWARE. During the process of downloading and installing the SOFTWARE, there may be components that are proprietary to Microsoft or other third party providers and which iolo provides to you under a license or other grant of rights from them. There may be circumstances in which those other third parties may require you, during the download or installation process, to acknowledge and agree specifically to certain terms and conditions that apply to those components. If that is the case, you should review those terms and conditions carefully, since by continuing the download and installation process you will also be agreeing to them and you will be acknowledging and agreeing that those other parties, not iolo, are responsible for any questions, complaints or claims you may have related to any or all of those components.

SOFTWARE LICENSE

The SOFTWARE is protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. The SOFTWARE is licensed, not sold.

GRANT OF LICENSE

Subject to your agreement and compliance with the terms and conditions of this License, iolo grants you a limited, personal, non-transferable, non-exclusive and revocable license to use the Software. This License gives you the right to:

1) Install and use the SOFTWARE solely for your individual use and not for any other purpose or use whatsoever;

2) Copy the SOFTWARE to the hard disk or other fixed storage medium of a maximum of three (3) digital processors or computers that you own or that are under your control; and

3) Make one copy of the SOFTWARE solely for the purposes of back-up to the installed SOFTWARE.

RESERVATION OF RIGHTS, REQUIREMENTS, RESTRICTIONS, AND LIMITATIONS

Reservation of Rights. The license grants above are the only rights granted to you in connection with this License and your use of the SOFTWARE and any and all rights not expressly granted to you by the license grants, iolo expressly and fully reserves. Other than those license rights granted to you in this License or for backup or archival purposes specifically permitted by law, you may not use or make any other copies of the SOFTWARE.

Storage/Network Use. You may not use the SOFTWARE over a network or distribute the SOFTWARE to other computers over a network except as specifically described in documentation provided with the SOFTWARE.

No Reverse Engineering, Decompilation, and Disassembly. You are not permitted to tamper with or attempt to bypass, modify, defeat or otherwise circumvent the operation of the SOFTWARE or alter, reverse engineer, decompile, disassemble or otherwise attempt to discover or disclose the

SOFTWARE source code or underlying programming.

Separation of Components. The SOFTWARE is licensed as a single product. You may not separate its component parts unless expressly authorized by iolo.

Data Files. The SOFTWARE may create data files automatically for use with the SOFTWARE. Any such data files will be deemed part of the SOFTWARE.

No Rental or Resale. You are not permitted to distribute, transmit, sublicense, lease, sell or rent the SOFTWARE to any other person, firm or enterprise.

Termination. Without prejudice to any other rights, iolo may terminate this License if iolo reasonably believes that you fail to comply with the terms and conditions of the License. In such event, you must stop all use of the SOFTWARE and you must destroy the SOFTWARE and all copies of the SOFTWARE and all of the component parts thereof.

Confidentiality. You agree to keep information contained in the SOFTWARE that is not publicly known confidential to yourself and to not disclose such information to others without iolo’s prior written approval.

Dependent Software. The software, network services, or other products other than the SOFTWARE upon which the SOFTWARE’s performance depends might be interrupted or discontinued at the discretion of the suppliers (software suppliers, service providers, or iolo). iolo and its suppliers do not warrant that those software products, network services, or other products will continue to be available or that they will operate without interruption or modification.

COPYRIGHT

All title and copyrights in and to the SOFTWARE (including but not limited to any images, photographs, animation, video, audio, music, text, "applets" or other content or materials contained and/or incorporated therein) and any copies thereof, are owned by iolo and/or its suppliers.

USE OF SOFTWARE WITH COPYRIGHTED MATERIALS

The SOFTWARE may be used by you to store, process, and use content created by you and third parties. Such content may be protected by copyright, other intellectual property laws, and/or agreements. You agree to use the SOFTWARE only in compliance with all such laws and agreements that apply to such content. You further agree that iolo may take appropriate measures to protect copyrights or content stored, processed, or used by the SOFTWARE. Such measures include, but are not limited to, counting the frequency of your backup and restoration activities through certain SOFTWARE features, refusal to accept your request to enable restoration of data based on information from certain SOFTWARE features, and termination of this License in the event of your illegitimate use of the SOFTWARE.

U.S. GOVERNMENT RESTRICTED RIGHTS

The SOFTWARE is provided with RESTRICTED RIGHTS. Any use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph (c) (1) and (2) of the Commercial Computer Software—Restricted Rights at 48 CFR 52.227-19, as applicable. The manufacturer is iolo technologies, LLC, 7470 North Figueroa Street, Los Angeles, CA, 90041.

REPLACEMENT OF DEFECTIVE CD-ROM MEDIA

In situations where a back-up copy of the SOFTWARE is furnished to you by iolo on CD-ROM media, as your sole and exclusive remedy, for a period of ninety (90) days from the date of its delivery to you the CD-ROM media on which the back-up copy of the SOFTWARE is furnished iolo will replace any defective CD-ROM media used under conditions of normal use. This remedy extends only to you as the original licensee and represents iolo’s entire liability and your sole and exclusive remedy. Defective CD-ROMS must be returned to iolo within the 90-day period with proof of purchase in the form of a bill of sale (which is evidence that the CD-ROM media is within the warranty period). iolo will have no obligation to replace a disk, which, in its reasonable determination, has been damaged by accident, abuse, or misapplication.

DISCLAIMER OF WARRANTIES

YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT USE OF THE SOFTWARE IS AT YOUR SOLE RISK. THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND, AND IOLO, ITS AFFILIATES AND THEIR RESPECTIVE LICENSORS (HEREINAFTER, COLLECTIVELY REFERRED TO AS "IOLO") EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR ANY WARRANTIES OF TITLE AND/OR NON-INFRINGEMENT.. IOLO DOES NOT WARRANT THAT THE FUNCTIONS CONTAINED IN THE SOFTWARE WILL MEET YOUR REQUIREMENTS OR THAT THE OPERATION OF THE SOFTWARE WILL BE CORRECTED. FURTHERMORE, IOLO DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE USE OR THE RESULTS OF THE USE OF THE SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, OR RELIABILITY, OR IN ANY OTHER TERMS. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY IOLO, AN IOLO AUTHORIZED REPRESENTATIVE OR ANY OTHER PARTY SHALL CREATE ANY WARRANTY WITH RESPECT TO THE SOFTWARE. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU (AND NOT IOLO OR AN IOLO AUTHORIZED REPRESENTATIVE) ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES. ACCORDINGLY, SOME OF THE EXCLUSIONS DESCRIBED IN THIS LICENSE MAY NOT APPLY TO YOU.

IOLO PROVIDES NO WARRANTY THAT ANY COMPUTER HARDWARE OR SOFTWARE WILL NOT BE DAMAGED BY THE SOFTWARE OR ANY DATA YOU DOWNLOAD USING THE SOFTWARE. YOU ASSUME THE ENTIRE RISK OF DOWNLOADING, INSTALLING, COPYING, OPERATING AND USING THE SOFTWARE. IOLO STRONGLY RECOMMENDS YOU PERFORM A VIRUS CHECK OF ALL SOFTWARE BEFORE INSTALLATION OR USE.

LIMITATION OF LIABILITY

YOU ACKNOWLEDGE AND AGREE THAT TO THE FULLEST EXTENT PERMISSIBLE BY LAW, NEITHER IOLO, NOR ANY OF ITS AFFILIATES, ITS OR THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, REPRESENTATIVES, SUPPLIERS, LICENSORS AND CONTRACTORS SHALL BE LIABLE FOR ANY LOSS OR DAMAGE, OF ANY KIND, DIRECT OR INDIRECT, INCLUDING, BUT NOT LIMITED TO, COMPENSATORY, CONSEQUENTIAL, INCIDENTAL, DIRECT, INDIRECT, SPECIAL, EXEMPLARY OR PUNITIVE DAMAGES, IN CONNECTION WITH OR ARISING FROM USE OF THE SOFTWARE OR OTHERWISE IN CONNECTION WITH THIS LICENSE.. IN ALL CASES, IOLO’S ENTIRE LIABILITY UNDER ANY PROVISION OF THIS LICENSE SHALL BE LIMITED TO THE AMOUNT ACTUALLY PAID ALLOCABLE TO THE ASSOCIATED SOFTWARE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF OR CERTAIN LIMITATIONS ON DAMAGES AND REMEDIES. ACCORDINGLY, SOME OF THE EXCLUSIONS AND LIMITATIONS DESCRIBED IN THIS LICENSE MAY NOT APPLY TO YOU.

INDEMNIFICATION

You agree to defend iolo, its affiliates and its and/or their respective successors and assigns, as well as their respective officers, directors, employees, agents, licensors, representatives, operational service providers and suppliers against any and all claims, demand and/or actions and indemnify and hold iolo, its affiliates and its and/or their respective successors and assigns, as well as their respective officers, directors, employees, agents, representatives, suppliers, licensors and contractors harmless from and against any and all losses, damages, costs and expenses (including reasonable attorneys' fees), resulting from your breach or violation of this License, infringement, misappropriation or your violation of the rights of any other party, your violation or non-compliance with any law or regulation, or your alteration or export of the SOFTWARE. iolo reserves the right to assume, at its expense, the exclusive defense and control of any claims or actions and all negotiations for settlement or compromise, and you agree to fully cooperate with iolo upon its request.

SOFTWARE DATA COLLECTION AND MONITORING

The SOFTWARE contains features that allow iolo and/or third parties to collect data from, control, and/or monitor computers and devices running or interacting with the SOFTWARE in order to prevent unlicensed or illegal use of the SOFTWARE. The SOFTWARE may contain enforcement technology that imposes limits on the ability to install and uninstall the SOFTWARE to not more than a finite number of times on a finite number of machines. The SOFTWARE containing enforcement technology requires licensing as set forth during the installation process and in the documentation, and the SOFTWARE will only operate for a finite period of time prior to licensing by the user. If you do not complete licensing during the finite time period set forth in the documentation or as prompted by the SOFTWARE, the SOFTWARE will cease to function until licensing is complete. Under this License, you hereby agree that the activities described above may occur.

AUTOMATIC UPDATE FEATURE

From time to time, iolo or third parties may automatically update or otherwise modify the SOFTWARE. One, but not the only, example of when this may happen is for purposes of enhancement of security functions, error correction, and improvement of functions, at such time as you interact with iolo’s or third-parties’ servers, or otherwise. Such updates or modifications may delete or change the nature of features or other aspects of the SOFTWARE, including functions you may rely upon. You hereby agree that such activities may occur at iolo’s sole discretion and that iolo may condition continued use of the SOFTWARE upon your complete installation or acceptance of such updates or modifications.

SEVERABILITY

If any part of this License is held invalid or unenforceable, the remaining provisions of this License shall be unimpaired and remain in full force and effect.

GOVERNING LAW AND JURISDICTION, JURY TRIAL WAIVER

This agreement shall be governed by the laws of the State of California and the United States of America, without regard to conflict-of-laws provisions. Any disputes arising out of this License shall be subject to the exclusive venue of the state and federal courts of Los Angeles County, California, and the parties hereby consent to the venue and jurisdiction of such courts. THE PARTIES HERETO WAIVE TRIAL BY JURY WITH RESPECT TO ANY MATTERS ARISING UNDER OR RELATING TO THIS LICENSE. IOLO RESERVES THE RIGHT TO AMEND THE SPECIFIC TERMS OF THE LICENSE REGARDING THE SOFTWARE AT ITS SOLE DISCRETION BY NOTICE TO YOU AT THE E-MAIL ADDRESS YOU HAVE PROVIDED TO IOLO AS PART OF YOUR REGISTRATION, OR ANY OTHER LEGALLY RECOGNIZABLE FORM OF NOTICE. If you do not agree to the terms to be amended, of which you shall be notified by iolo before they take effect, you must return the entire SOFTWARE product and any other related materials bundled in the package at the time of purchase, together with any software you have obtained from the iolo Website, for refund pursuant to the terms in the first paragraph of this License, titled "IMPORTANT—READ CAREFULLY." Your continued use of the SOFTWARE after notice shall be deemed agreement to be bound by such amendment.

THIRD-PARTY BENEFICIARY

For all purposes of this License, each of iolo's third-party licensors of any of the SOFTWARE shall be expressly deemed an intended third-party beneficiary of this License and shall have the right to enforce the terms and conditions of this License.

QUESTIONS OR COMMENTS

Should you have any questions concerning this License or the limited warranty, you may contact iolo in writing at, 7470 North Figueroa Street, Los Angeles, California, 90041.

Copyright 2007 iolo technologies, LLC. iolo, iolo AntiVirus, iolo Personal Firewall, DriveScrubber, Search and Recover, Macro Magic, System Mechanic, and System Mechanic Professional are trademarks or registered trademarks of iolo technologies, LLC. All other trademarks are the property of their respective owners.


Basic Steps for Using the Firewall

  • Control which standard ports are open to incoming or outgoing traffic.

  • For additional ports that you specify, determine which ones are open to incoming or outgoing traffic.

  • See a list of all the known attacks that are blocked.

  • When enabled, control the program access based on its IntelliDefense classification.

  • Establish default program permissions.

  • Control broadcast/multicast programs.

  • Control IGMP packets.

  • Control whether the Zone locks when your PC is idle.

Basic Steps for Using the Firewall

See also: Basic Steps for Configuring the Firewall

Once installed, iolo Personal Firewall is immediately controlling both incoming and outgoing Internet traffic using default settings built into the application.

This topic provides basic instruction, and links to other topics, to help you get familiar with iolo Personal Firewall.

  • Understanding the firewall messages that display

  • iolo Personal Firewall Home page - Description of interface

  • Changing default settings in the firewall

  • Turning the firewall on or off

  • Getting assistance

Understanding Firewall Messages

As iolo Personal Firewall is defending your computer, you may see messages titled Allow Outgoing Access?, Allow Incoming Access?, and Communication Blocked.

Note: When you first install iolo Personal Firewall, you may see several of these messages, but as the firewall gains knowledge of your Internet preferences, you will see less of them.

  • The Allow Outgoing Access? and Allow Incoming Access? prompt windows display when a program is attempting Internet communication and the firewall needs a decision from you on how to proceed.

For trusted programs, simply click Allow always. You can also block or allow access for the application one time, or block access all of the time.

The window also displays information about the program, to help you decide whether or not you want to give it access.

See Allow Access? (Program Access Prompt) for more information.

  • The Communication Blocked window displays when a program is attempting to access a blocked port. This window is basically informational, but it does give you the option of opening the port to communication.

For trusted communications, click the Allow link to open the port.

See Communication Blocked (Port Closed Notice) for more information.

Go back to the top of the topic

Changing Default Settings in the Firewall

Open the iolo Personal Firewall Home page to customize firewall settings.

The Basic Steps for Configuring the Firewall topic provides an overview of the configuration process.

Below are links to topics on specific configuration areas:

  • To control access for specific computers, networks, and Web sites, see Zone Security – Overview. This control includes managing which ports are open and more.

  • To control the incoming and outgoing access for specific programs and applications, see Overview of Program Controls.

  • To enable and disable tools and change various advanced features, see Settings Window.

Go back to the top of the topic

Enabling/Disabling the Firewall

Upon installation, iolo Personal Firewall is enabled and its icon [image] displays in your system tray. To disable the firewall, click on the icon and click Disable iolo Personal Firewall from the menu.

See Firewall Icon Options for more information on the icon and its menu options.

Getting Assistance

For task-related assistance, click Help on any of the windows to open this Help system.

For additional assistance, refer to our Web-based support or contact Technical Support.

Related topics:

Description of iolo Personal Firewall Home page

Basic Steps for Configuring the Firewall

Flowchart of iolo Personal Firewall process

General Security Tips


iolo Personal Firewall Home Page - Overview of Interface

  • Control which standard ports are open to incoming or outgoing traffic.

  • For additional ports that you specify, determine which ones are open to incoming or outgoing traffic.

  • See a list of all the known attacks that are blocked.

  • When enabled, control the program access based on its IntelliDefense classification.

  • Establish default program permissions.

  • Control broadcast/multicast programs.

  • Control IGMP packets.

  • Control whether the Zone locks when your PC is idle.

Minimize. Click the dash (—) to reduce the window to a button on your taskbar.

Maximize/Restore. Click the single square to fill the screen with the window. Click the double square to restore the window to its previous size.

Exit. Click the X to close the firewall. The iolo Personal Firewall icon will still display in your system tray, but will not display as a taskbar button.

  • To resize the window: Place your mouse pointer over a border of the window. When the pointer becomes a double-headed arrow, press and hold the left mouse button and move your mouse in the direction you want the border to move. When the border is at the desired location, release the mouse button.

  • To move the window: Place your mouse pointer in the title bar ("iolo Personal Firewall"). Press and hold the left mouse button and move your mouse in the direction you want the window to move. When the window is at the desired location, release the mouse button.

iolo Personal Firewall Home page

The iolo Personal Firewall Home page allows you to view and configure the firewall settings. You can also view firewall and Internet activity, update software, and get help using the product.

See also: iolo Personal Firewall Icon Options

This topic provides an overview of all the iolo Personal Firewall tools and a description of the title bar and menu bar.

Click on the links within each section to view more detailed instructions.

Quick Links

The quick links across the top of the window provide a snapshot of your firewall protection, with links that allow you to quickly access configurations.

Zone Security

iolo Personal Firewall divides all computers, networks, and Web sites into two Zones: the Internet Zone and the Trusted Zone.

The Zone Security pane has a section for each Zone, which allows you to grant trusted systems (Trusted Zone) a level of access that differs from the level for untrusted/unknown systems (Internet Zone). With Zone security, you can manage which ports are open and more.

To begin, go to the Zone section that you want to update –Internet Zone or Trusted Zone –and click the View Zone options link to expand the section and view the security options.

Program Policies

A program policy controls the actions of a specific program/application when that program attempts communication within a Zone.

To begin, click the Manage policies button. The pane also displays the number of existing program policies.

Firewall Odometer

The Firewall Odometer pane shows the communication attempts that iolo Personal Firewall has blocked.

The pane also has the View event history link. Click this link to view all of the recent Internet activity.

Updates

The Updates pane allows you to download free software updates for iolo Personal Firewall. You can also view licensing information and customize the Internet connection settings for downloads.

News

The News pane displays bulletins and other valuable information from iolo technologies.

Online Assistance

The Online Assistance pane provides quick access to iolo's Web support page. Enter in the keyword you want to search and then click the green arrow.

The Customer Care page opens in your Web browser, displaying links to all the Knowledge Base articles, FAQs, and tutorials that contain the text you entered.

How does a firewall work?

Opens a graphic flowchart that shows the process iolo Personal Firewall follows to control Internet communication.

Menu Bar and Title Bar

The menu bar and title bar are accessible from all the screens in the firewall.

Menu Bar:

  • To change basic firewall settings, click Setup Wizard on the right side of the menu bar. (Read more about the Setup Wizard.)

  • To change detailed firewall settings, click Settings on the right side of the menu bar. (Read more about the Settings window.)

  • To open this Help system, click Help on the right side of the menu bar. (Read more about using the Help system.)

Task-specific help is also available within each window; look for the Help button on the bottom.

  • To go back to the Home page from a window, click the Home icon [image] on the left side of the menu bar.

Title Bar:

  • The title bar offers the standard Windows buttons: Minimize, Maximize/Restore, and Exit. More information:

Note: You can also move and resize the window with standard dragging operations.

Related topics:

Basic Steps for Using the Firewall

Basic Steps for Configuring the Firewall

Flowchart of iolo Personal Firewall process


iolo Personal Firewall Icon

Click Open iolo Personal Firewall to open the Home page. This window allows you to view and configure firewall settings, view event history, update software, and get help using the firewall.

See iolo Personal Firewall Home page for an overview.

This option is available when the firewall is enabled.

Click Disable iolo Personal Firewall to turn off the firewall and have no restrictions on all incoming and outgoing communication.

You can still open the firewall application and change configuration settings.

Note: Disabling the firewall makes your computer vulnerable to attack.

This option is available when the firewall is disabled.

Click Enable iolo Personal Firewall to enable the firewall and put its protection into effect.

Click Shut down iolo Personal Firewall to both disable the firewall (as described above) and remove the icon from your system tray.

Unlike disabling, when the firewall is shut down, you cannot access the functions offered by the icon, which includes opening the Home page to configure settings.

When selected, a confirmation window displays; click Yes to continue. To have the firewall enable itself the next time you start or restart your computer, select the Start iolo Personal Firewall when my computer starts check box.

Note: Shutting down the firewall makes your computer vulnerable to attack.

Open the Settings window, select the General tab, and clear the Show icon in tray when firewall is active check box.

You can restart the firewall in several ways:

  • Start the firewall from the Windows Start menu, in the iolo Personal Firewall program group you set during installation. (The default installation location is Start > Programs > iolo Personal Firewall > Start iolo Personal Firewall.)

  • If you elected to create a desktop icon during installation, double-click on the iolo Personal Firewall icon.

  • If you selected the Start iolo Personal Firewall when my computer starts check box when you shut the firewall down, the firewall will restart the next time you start or restart your computer.

This option only displays for evaluation customers.

Click Purchase iolo Personal Firewall to process a payment through iolo's secure online ordering system. With the purchase of a license, you can have permanent use of iolo Personal Firewall in minutes.

iolo Personal Firewall Icon - Display and Menu Options

Upon installation, iolo Personal Firewall is enabled and its icon [image] sits in your system tray. The icon:

  • Changes color to indicate various states of the firewall, so that you can easily see the status of your security.

  • Offers menu options, so that you can quickly access and change firewall settings.

States of the Firewall

When the firewall is enabled (and no Zones are locked), the icon is white. (More on Zones.)

When the firewall is disabled (and no Zones are locked), the icon is red.

When one or both Zones are locked, the icon is yellow. The firewall may be enabled or disabled.

When the firewall blocks a communication or displays a prompt , the icon briefly flashes red and then returns to its original state.

Firewall Icon Menu Options

When you click on the iolo Personal Firewall icon, it opens a menu with options for opening the firewall's Home page, enabling/disabling the firewall's functionality, removing the icon from your system tray, or purchasing a license (for evaluation users).

Each menu option is listed below (all menu options won't display for all users). Click on a menu name to view more information.

  • Open iolo Personal Firewall opens the Home page.

  • Disable iolo Personal Firewall turns off the firewall.

  • Enable iolo Personal Firewall turns on the firewall.

  • Shut down iolo Personal Firewall disables the firewall and removes its icon from system tray.

See also:

How to remove the icon from system tray with firewall still enabled

How to re-start the iolo Personal Firewall once it is shut down

  • Purchase iolo Personal Firewall allows evaluation users to process a payment for a licensed copy of iolo Personal Firewall.

Related topics:

iolo Personal Firewall Home page – Description of interface

Evaluation users – Purchase iolo Personal Firewall


Quick Links - Enable and Disable Tools

Quick Links

The top of the iolo Personal Firewall Home page provides a snapshot view of your firewall protection, with links that allow you to quickly access configurations.

As a default, all of these features are enabled.

Firewall

The default and recommended status for the firewall is Enabled.

  • To change various firewall settings or disable the firewall, click Settings. The Settings window opens.

  • If the firewall is disabled, click Enable to turn it on. The firewall will automatically enable without opening the Settings window.

Network Activity

The default and recommended status for network activity is Enabled.

  • To stop all Internet communications to and from your computer, click Block all activity. It will appear that your computer has disconnected from the Internet and the Web will not be accessible.

  • Click Enable to restore network communications.

Note: If you had previously blocked Network Activity and then re-enabled it, a currently open Web browser will still have its access blocked. To access the Web, close the Web browser and then re-open it.

When enabled, bars of varying length display in the image to indicate network activity (if the Display network activity on homepage option is selected on the Settings window).

IntelliDefense

The default and recommended status for IntelliDefense is Enabled. (More on IntelliDefense.)

  • To change IntelliDefense settings or disable the feature, click Settings. The Settings window opens.

  • If IntelliDefense is disabled, click Enable to turn it on. IntelliDefense will automatically enable without opening the Settings window.

Related topics:

iolo Personal Firewall Home page – Description of interface

Settings window

IntelliDefense


Basic Steps for Configuring the Firewall

To follow are the different security controls that can be applied to a Zone. After each description is the tab name of where the settings reside.

For the preset security levels, the following settings are fixed. For the Custom level, you can change these settings.

  • Control which standard ports are open to incoming or outgoing traffic. (Defined Ports tab)

  • For additional ports that you specify, you can determine which ones are open to incoming or outgoing traffic. (Custom level only - Custom Ports tab)

  • See a list of all the known attacks that are blocked. (Attacks tab)

  • When enabled, control the program access based on its IntelliDefense classification. (IntelliDefense tab)

  • Establish default program permissions. (General tab)

  • Control broadcast/multicast programs. (General tab)

  • Control IGMP packets. (General tab)

  • Control whether the Zone locks when your PC is idle. (General tab)

Basic Steps for Configuring the Firewall

See also:

  • Flowchart of iolo Personal Firewall process, which provides a graphic presentation of the firewall process.

  • Setup Wizard, a tool that guides you through configuring basic settings in the firewall.

This topic provides an overview of how to configure firewall settings.

1. Zone Security: Control specific computers, networks, and Web sites

Using Zones, you can grant trusted computers, networks, and Web sites (Trusted Zone) a level of access different from the access for locations you don't trust or know (Internet Zone). Zone security controls which ports are open and more.

There are two components to setting Zone security (click a link for detailed instruction):

  • Designate Security for a Zone. You can select a preset security level (Low, Medium, or High), designate individual settings to create your own security level (Custom), block all incoming/outgoing access for the Zone, or allow all incoming/outgoing access for the Zone.

  • Designate Zone Membership. Add the computers, networks, and Web sites that you trust to the Trusted Zone. There are several ways to add a computer or site, including by using its IP address, using its domain name, or selecting from a list of recently visited sites.

See Zone Security – Overview for more information.

2. Program Policies and IntelliDefense: Control specific programs/applications within a Zone

Program Policies and IntelliDefense work together to control the communication of programs/applications with a given Zone. One program can have different permissions depending on whether a Trusted Zone or an Internet Zone location is involved.

  • Program Policies. For the programs that you specify, you can create policies that control the actions when a program attempts incoming or outgoing communication. The actions can be allow, block, or prompt.

  • IntelliDefense. IntelliDefense handles all the programs that you don't create a policy for. You can set up the actions you want the firewall to take for a program based on its threat classification. As with program polices, the actions can be allow, block, or prompt.

Additionally, if you don't want to see prompts, you can select Do not show prompts - automatically use default program permissions on the Settings window to have all generated prompts automatically answered by the firewall, rather than requiring an answer from you.

See Overview of Program Controls for more information.

3. Change Defaults: Change other features for the firewall on the Settings window.

The settings on the Settings window apply to the entire firewall and are not Zone-specific. Some of the functions you can do on this window:

  • Enable or disable the firewall, IntelliDefense, and other tools.

  • Turn off or turn on the display of notices and prompts.

  • Control what displays on the Recent Firewall Events window.

  • Set up controls for ICMP communication, passive FTP connections, Microsoft Exchange connections, and more.

See Settings Window for more information.

Related topics:

Basic Steps for Using the Firewall

Flowchart of iolo Personal Firewall process


Allow Access? (Program Access Prompt)

If the prompt window is idle (meaning, you have not clicked on or moved your mouse/pointing device on the window), it will start to fade.

If the window has been idle for 15 seconds, the firewall will respond using the default program permission, which is to either block or allow access.

To change firewall settings:

  • You can change the time from 15 seconds on the General tab of the Settings window (see Action when program access prompts are generated options).

  • You can view or change the default program permission in Zone security.

You can turn off prompts in one of two ways:

  • When the Allow Access? prompt displays, select the Activate default program permissions check box.

  • On the iolo Personal Firewall Home page, click Settings from the menu bar to open the Settings window. Under the Firewall options section, select the Do not show prompts - automatically use default program permissions option.

Prompts will no longer display for any programs. Programs will either be blocked or allowed, as set up in default program permissions.

Note: To turn prompts back on, select the Show prompts - only use default program permission after [X] seconds option on the Settings window.

Read more information about program controls.

Allow Access? (Program Access Prompt)

Displays when:

The Allow Outgoing Access? or Allow Incoming Access? window displays when a program is attempting Internet communication and the firewall needs a decision from you.

Instructions:

An "Allow Outgoing Access?" or "Allow Incoming Access?" window displays when the firewall needs a decision from you on how to proceed. The window lets you allow or block access, and provides information to help you make a decision.

Note: You can take the time you need to make your decision. If the window starts to fade (an indication that it's idle), place your mouse over the window so that it remains active until you make your choice. More information on idle prompts:

How do I turn off all "Allow Access?" prompts?

To block or allow access

Click one of the following four buttons:

  • Allow once. Allows access this time. The prompt will display the next time this program attempts communication.

  • Allow always. Allows access all the time; you will no longer see a prompt for this program (in the current direction and Zone).

This selection will either automatically create a program policy for you or will change an existing program policy.

  • Block once. Blocks access this time. The prompt will display the next time this program attempts communication.

  • Block always. Blocks access all the time; you will no longer see a prompt for this program (in the current direction and Zone).

This selection will either automatically create a program policy for you or will change an existing program policy.

To view program information

Click any of the following:

  • For outgoing communication, click on the program name that displays on the top of the window. A Windows Properties window that displays various file attributes will open.

  • Click Show details to show information about the program and its communication attempt. The following displays:

  • Local Program. The location and program on your computer that is involved in the communication attempt.

  • IntelliDefense Category. The IntelliDefense category and description of the program. (More on IntelliDefense.)

  • Remote Address. The address of the remote computer or Web site that is involved in the communication attempt.

  • Direction. The direction of the communication attempt: Incoming or Outgoing.

  • Zone. The Zone that the communication attempt belongs to: Trusted Zone or Internet Zone.

To turn off all prompts

Select the Activate default program permissions check box if you do not want to see prompts for any programs. Programs will automatically either be blocked or allowed, as set up in default program permissions.

Note: Selecting this option turns of all prompts, not just the prompts for the current program.

Related topics:

Basic Steps for Using the Firewall

Basic Steps for Configuring the Firewall

Program Policies

Overview of all program controls


You can turn off informational notices in one of two ways:

  • When the Communication Blocked window, select the Don't show these messages anymore check box and click OK.

  • On the iolo Personal Firewall Home page, click Settings from the menu bar to open the Settings window. Clear the Display informational firewall notices check box.

Note: To turn notices back on, select the Display informational firewall notices check box on the Settings window.

If you are using one of the set security levels for the Zone (Low, Medium, or High), the firewall will need to change the security to the Custom level, so that it can include these customized port settings.

A Confirm window will display giving you the option of making this update; click OK to continue. The firewall will change the security of the Zone to Custom and will add the port setting, but all other settings will be the same as the security level you had previously: Low, Medium, or High.

Communication Blocked (Port Closed Notice)

Displays when:

A Communication Blocked window displays when a program is attempting Internet communication through a blocked port.

Instructions:

The window displays to inform you that a port is blocked, and provides information about the program and its communication attempt. The window also gives you the option of opening the port.

Click OK to close the window or to close the current alert*.

* Note: Where several alerts show (for instance, various IP addresses are involved in a single communication attempt), you can click the Previous and Next arrows to view each of the alerts.

Where there is more than one alert, click OK to close the current alert or click Close all alerts to close the window.

How do I turn off all "Communication Blocked" notices?

To view program information

Click Show details to show information about the program and its communication attempt. The following displays:

  • Local Program. The location and program on your computer that is involved in the communication attempt.

  • IntelliDefense Category. The IntelliDefense classification and description of the program. (More on IntelliDefense.)

  • Remote Address. The address of the remote computer or Web site that is involved in the communication attempt.

  • Direction. The direction of the communication attempt: Incoming or Outgoing.

  • Port Number. The port number that is blocked, and the protocol.

Click the "Allow" link in this section to allow access for that port. The port will open and the settings for the Zone will update to allow access for the current direction and protocol. See "To open the port to communication" below for more information.

  • Zone. The Zone that the communication attempt belongs to: Trusted Zone or Internet Zone.

To open the port to communication

Click Show details and then in the Port Number section, click the link to allow access for that port. The text of the link has the direction and the protocol; for example, "Allow outgoing UDP access" or "Allow incoming TCP access". The next communication through that port will be allowed (the current attempt has already been blocked).

  • If the port is defined, the Defined Port settings will be updated to allow access (in the current direction and Zone).

  • If the port is not defined, a Custom Port rule will be created to allow access (in the current direction, protocol, and Zone).

I see a "Confirm" window:

To turn off all notices

Select the Don't show these messages anymore check box to turn off future notices.

Note: Selecting this option turns of all notices, not just the notices for the current program or port.

Related topics:

Basic Steps for Using the Firewall

Basic Steps for Configuring the Firewall


  1. From the Program Policies pane, click Manage policies to open the Manage Program Policies window.

  2. For the applicable program policy, clear the Prompt me if this program is modified check box.

If the prompt window is idle (meaning, you have not clicked on or moved your mouse/pointing device on the window), it will start to fade.

If the window has been idle for 15 seconds, the firewall will respond using the default program permission, which is to keep permissions.

On the General tab of the Options window, you can change the default action to "discard permissions".

Keep Program Policy? (Program Modified Prompt)

Displays when:

The Keep Program Policy? prompt window displays when a program attempting access has been modified and it has an associated program policy with the "Prompt me if this program is modified" check box selected.

Instructions:

When a program has revised program characteristics (such as a signature or version information), the Keep Program Policy? window lets you decide whether you want to use the same program policy for the modified program. The window also provides program information to help you make a decision.

I want to stop seeing the Keep Program Policy? prompt:

To keep or discard the program policy

Click one of the following:

  • Click Keep Permissions to update the program policy with the new program characteristics. Click this option if you trust that the revision is valid (for instance, you installed an upgrade from the program's vendor) and want to use the same program policy for the modified program.

The firewall will then follow the actions you set in the policy (block, prompt, or allow).

  • Click Discard Permissions to delete the existing program policy. Click this option if you do not trust the revision (for instance, you suspect it is malicious software attempting to mimic a legitimate program) and do not want to use the existing program policy for it.

The firewall will then behave as it does for programs without a program policy. (See Program Controls – Overview for a description of the flow of program controls.)

Note: You can take the time you need to make your decision. If the window starts to fade (an indication that it's idle), click on the window or place your mouse over the window so that it remains active until you make your choice. More information about idle prompts:

To view program information

Click any of the following:

  • Click on the program name at the top of the prompt. A Windows Properties window that displays various file attributes will open.

  • Click Show details to show information about the program and its policy. The following displays:

  • Program Name. The location and name of the program.

  • IntelliDefense Category. The IntelliDefense category and description of the program. (More on IntelliDefense.)

  • Current Internet Zone Permissions. The permissions for incoming and outgoing access for Internet Zone communications. Either Allow, Block, or Prompt displays.

  • Current Trusted Zone Permissions. The permissions for incoming and outgoing access for Trusted Zone communications. Either Allow, Block, or Prompt displays.

Related topics:

Basic Steps for Using the Firewall

Basic Steps for Configuring the Firewall

Overview of Program Controls

Program Policies

Settings Window


Setup Wizard - Overview

To access:

Click Setup Wizard from the menu bar on top of the application. The wizard can also be opened immediately after installation.

What it does:

The Setup Wizard guides you through configuring basic settings in the firewall. The wizard consolidates some of the more common settings that people may wish to change.

Note: All of the settings made in this wizard can also be viewed or edited in other program locations.

Instructions:

The wizard has several screens to guide you through the setup. Click a screen name below for more information:

  1. PC Usage

  2. Preferences

  3. Trusted Web Sites

  4. Trusted Computers

  5. Program Policies

  6. Save Changes

Related topics:

Settings window - Change detailed settings

Basic Steps for Configuring the Firewall


Setup Wizard - PC Usage

Setup Wizard

PC Usage

Overview of the Setup Wizard

On the first screen, select the check box next to each feature you use on your computer. If you are not sure about an option, leave the default selection.

I connect to this computer using Remote Desktop software

Select this option to allow a Remote desktop connection to this computer while you are at another, remote computer (for example, you connect to your home computer from work).

I connect to other computers using Remote Desktop software

Select this option to allow a Remote desktop connection from this computer to another, remote computer (for example, you connect to your work computer from home).

I use this computer to share files, folders, or printers with other computers in a network

If you share files, folders, or printers with other computers on a network, select this option.

I use America Online when connecting to the Internet

If you use America Online (AOL) to connect to the Internet, select this option.

I use Apple iTunes to purchase or manage music and video

Select this option if you use iTunes to purchase media or view streaming media.

I connect to a Microsoft Exchange server for mail or other services

Select this option to allow communication for programs that connect to Microsoft Exchange, such as Microsoft Outlook.

I use Skype to make Internet phone calls

Skype is a software program that allows for Internet phone calls over a peer-to-peer network. Select this option if you use Skype to make and/or receive phone calls.

I play World of Warcraft online

World of Warcraft is a role-playing game in which a large number of players interact over the Internet. Select this option if you play World of Warcraft.

Once you have made your selections, click Next to open the Preferences screen.


Setup Wizard - Preferences

Setup Wizard

Preferences

Overview of the Setup Wizard

On the Preferences screen, you can control settings for the display of firewall notices and for automated decision-making.

I want to see informational notices when the firewall block communication

Firewall notices are messages that display to give you information, but do not require a decision from you. Select this option (recommended) to display these notices.

Read more about the Communication Blocked notice

I want the firewall to make automatic decisions about program communication whenever possible

The IntelliDefense feature analyzes programs attempting communication and then makes automated decisions based on the program's purpose and threat level. Select this option (recommended) to enable IntelliDefense.

Read more about IntelliDefense

Read more about program controls

Displays for Windows Vista users only:

Allow firewall to process all Internet Explorer® communication

Select this option to turn off Internet Explorer's Protected Mode and allow iolo Personal Firewall to process all browser communication using its security policies. Clear the option to leave Protected Mode on, allowing certain communication to pass without scrutiny by the firewall.

Once you have made your selections, click Next to open the Trusted Web Sites screen.


Setup Wizard - Trusted Web Sites

Setup Wizard

Trusted Web Sites

Overview of the Setup Wizard

The Trusted Web Sites screen allows you to add Web sites that you have visited or saved as a Favorite to the Trusted Zone. The Trusted Zone is for the computers, networks, and sites that you designate as trusted. This Zone is for communications that are assumed to be safe.

Read more about Zones

If you click:

  • Search for visited Web sites now, the screen will display a list of any Web sites that you saved to your Favorites folder and Web sites you recently visited. Once you have made selections, click Next to open the Trusted Computers screen.

For detailed instruction on using this screen, refer to the Add Visited Web Sites topic.

  • Skip this step, the Trusted Computers screen will open.

Note: You can also add visited and favorite Web sites from the Manage Zone Members window.


Setup Wizard - Trusted Computers

Setup Wizard

Trusted Computers

Overview of the Setup Wizard

The Trusted Computers screen allows you to add any computers in your network to the Trusted Zone. The Trusted Zone is for the computers, networks, and sites that you designate as trusted. This Zone is for communications that are assumed to be safe.

Read more about Zones

If you click:

  • Search for computers on my network now, the screen will display a list of any computer that are in your network. Once you have made your selections, click Next to open the Program Policies screen.

For detailed instruction on using this screen, refer to the Add Items in My Network topic.

  • Skip this step, the Program Policies screen will open.

Note: You can also add networked computers from the Manage Zone Members window.


Setup Wizard - Program Policies

Setup Wizard

Program Policies

Overview of the Setup Wizard

Create or edit program policies, which are security controls that apply to a specific program or application.

Program policies let you give individual programs their own set of instructions on how they can communicate over the Internet. When a program attempts incoming or outgoing communication, the firewall checks if the Zone allows access. If it does, the firewall then checks for a program policy.

Read more about program controls

If you click:

  • Review and edit my program policies now, the screen will display a list of any existing policies and allow you to create new policies. Once you have made your selections, click Next to open the final Save Changes screen.

For detailed instruction on using this screen, refer to the Manage Program Policies Window topic.

  • Skip this step, the Save Changes screen will open.

Note: You can also create and manage policies from the Manage Program Policies window.


Setup Wizard - Save Changes

Setup Wizard

Save Changes

Overview of the Setup Wizard

The final screen allows you to exit the Setup Wizard.

Either click Save changes and exit or Discard changes and exit.

You will return to the Home page.


Zone Security - Overview

To follow are the security controls that can be applied to a Zone. After each description is the tab name of where the settings reside.

For the preset security levels, the following settings are fixed. For the Custom level, you can change these settings.

  • Control which standard ports are open to incoming or outgoing traffic. (Defined Ports tab)

  • For additional ports that you specify, you can determine which ones are open to incoming or outgoing traffic. (Custom Ports tab)

  • See a list of all the known attacks that are blocked. (Attacks tab)

  • When enabled, control the program access based on its IntelliDefense classification. (IntelliDefense tab)

  • Establish default program permissions. (General tab)

  • Control broadcast/multicast programs. (General tab)

  • Control IGMP packets. (General tab)

  • Control whether the Zone locks when your PC is idle. (General tab)

Zone Security – Overview

To access:

See the Zone Security pane on the top, left side of the Home page.

What it does:

iolo Personal Firewall divides all computers, networks, and Web sites into two Zones: the Internet Zone and the Trusted Zone.

  • The Internet Zone is for all the computers, networks, and sites that are not in the Trusted Zone. This Zone is for communications that are unknown or undesignated.

  • The Trusted Zone is for those computers, networks, and sites that are explicitly designated as trusted. This Zone is for communications that are assumed to be predictable and safe.

The pane has a section for each Zone – Internet Zone and Trusted Zone – each allowing its own security.

  • You determine the security for each Zone. By either selecting preset security levels or designating your own settings, you manage which ports are open and more.

  • You determine the membership for each Zone. You designate which computers and Web sites you trust by adding them to the Trusted Zone. Those members will be controlled by the security you set in the Trusted Zone section. All other locations will be members of the Internet Zone and controlled by the Internet Zone security.

Instructions:

To begin, go to the Zone section that you want to update – Internet Zone or Trusted Zone –and click View Zone options to expand the list of security options. There are two components to setting Zone security (click a link for detailed instructions):

  • Designate Security for a Zone. Select a preset security level, designate individual settings to create your own security level, block all incoming/outgoing access for the Zone, or allow all incoming/outgoing access for the Zone.

Note: The default for the Internet Zone is the preset security level Medium; for the Trusted Zone, the default is the preset security level Low.

  • Designate Zone Membership. Add the computers, networks, and Web sites that you trust to the Trusted Zone.

Note: Any computer that is not a part of the Trusted Zone is automatically a member of the Internet Zone, so you can simply do nothing for a computer you want to belong to the Internet Zone. However, you are given the option of assigning a computer to the Internet Zone, which could be useful for visibility or if you plan to change the Zone membership later.

Related topics:

Basic Steps for Configuring the Firewall


Designating Security for a Zone

To follow are the different security controls that can be applied to a Zone. After each description is the tab name of where the settings reside.

For the preset security levels, the following settings are fixed. For the Custom level, you can change these settings.

  • Control which standard ports are open to incoming or outgoing traffic. (Defined Ports tab)

  • For additional ports that you specify, you can determine which ones are open to incoming or outgoing traffic. (Custom level security only - Custom Ports tab)

  • See a list of all the known attacks that are blocked. (Attacks tab)

  • When enabled, control the program access based on its IntelliDefense classification. (IntelliDefense tab)

  • Establish default program permissions. (General tab)

  • Control broadcast/multicast programs. (General tab)

  • Control IGMP packets. (General tab)

  • Control whether the Zone locks when your PC is idle. (General tab)

Provides protection from threats and uncommon communication. Most routine/standard Internet and network functionality is allowed. See the Medium level topic for details.

Provides protection from common threats, but most network and Internet functionality is allowed. See the Low level topic for details.

  1. Select the Turn on security and choose a specific security level option. The window expands to show columns of security levels.

  2. Click on the icon for the preset security level that you want to set for the Zone. Options are Low, Medium, and High.

  • Low. Provides basic protection. Common threats are blocked, but most network and Internet traffic is allowed.

  • Medium. Provides intermediate protection. Threats and uncommon types of communication are blocked, but most routine Internet and network traffic is allowed.

  • High. Provides the strongest protection. Only traffic that is fundamental to basic Internet and network functionality is allowed.

  3. The level that you select will be highlighted and will display at the top of the pane in the Status box.

The security level for the X Zone is Low

The security level for the X Zone is Medium

The security level for the X Zone is High

...where "X Zone" is either the Internet Zone or the Trusted Zone.

  1. Select the Turn on security and choose a specific security level option. The window expands to show columns of security levels.

  2. Click on the icon in the Custom column header to select it. Initially, the custom settings will be same as the default settings. (For the Internet Zone, the default is Medium and for the Trusted Zone, the default is Low.)

  3. The Custom level will be highlighted and Custom will display at the top of the pane in the Status box.

The security level for the X Zone is Custom

...where "X Zone" is either the Internet Zone or the Trusted Zone.

  4. Click Edit Settings. The Edit Custom Level Settings window for the selected Zone opens.

  5. Change the desired options. The window has the following tabs (click on a tab name for details):

  6. Defined Ports. Determine which ports are open to incoming or outgoing traffic.

  7. Custom Ports. For additional ports that you specify, determine which ones are open to incoming or outgoing traffic.

  8. Attacks. View a list of the known attacks that are blocked. (You can turn off the block temporarily for troubleshooting.)

  9. IntelliDefense. When enabled, determine the program access for each IntelliDefense classification. You also have the option of disabling IntelliDefense.

  10. General. Determine various settings, including default program permissions, broadcast/multicast protocols, and IGMP protocols.

  6. Click Save to save your changes and close the window.

  1. Select the Turn on security and choose a specific security level option. The window expands to show columns of security levels.

  2. Click Show security level details. The pane expands to show the settings for some common ports. One of the following displays next to each port name:

  • Allow. Both incoming and outgoing communication are allowed.

  • Block. Both incoming and outgoing communication are blocked.

  • In. Only incoming communication is allowed; outgoing communication is blocked.

  • Out. Only outgoing communication is allowed; incoming communication is blocked.

  3. Further detailed settings can be viewed by clicking View more at the bottom of any of the Security Level columns. The information on the View windows is read-only and cannot be changed. (To change settings, see Designate settings to create your own security level above.)

Click a link below for more information on the View windows.

  • View Low Level Settings

  • View Medium Level Settings

  • View High Level Settings

  • View Custom Level Settings. (To edit these fields, instead of View more, click Edit Settings.)

Select the Turn on security and block all inbound and outbound access option.

All the computers in the selected Zone will have no incoming or outgoing access.

The status box at the top of the pane will display a Block All message:

The security level for the X Zone is Block All

...where "X Zone" is either the Internet Zone or the Trusted Zone. The Zone will be locked.

Note: To block access for both Zones, you can click Block all activity on the top of the application window; refer Enable/Disable Security Tools for details.

Select the Turn off security and allow all inbound and outbound access option.

Computers in the selected Zone will have no restrictions for incoming and outgoing communication. (IntelliDefense settings and program policies you have in place will not apply.)

The status box at the top of the pane will display a Security Disabled message:

The security level for the X Zone is Security Disabled

...where "X Zone" is either the Internet Zone or the Trusted Zone.

Designating Security for a Zone – Using the Security Options

To access:

In the Trusted Zone or the Internet Zone section of the Zone Security pane, click View Zone options to expand the list of security options.

What it does:

Zone security allows you to grant Trusted Zone locations a level of access that differs from Internet Zone locations. (More on Zones.) The access you can manage for each Zone includes which ports are open and more.

The preset security levels (Low, Medium, and High) have fixed settings, while the Custom level lets you designate your own settings. You can also block all access or allow all access for a Zone.

Jump to descriptions of each security level:

  • Low

  • Medium

  • High

  • Custom

Instructions - Changing security:

The default security is as follows:

  • Internet Zone default is the preset security level Medium:

  • Trusted Zone default is the preset security level Low:

To make changes, go to the Zone section that you want to update (Internet Zone or Trusted Zone) and click View Zone options to expand the list of security options.

The options that display let you set the security for the Zone. You can:

  • Select a preset security level - Low, Medium, or High

  • Designate settings to create your own security level - Custom

  • View detailed settings for a security level - Low, Medium, High, or Custom

  • Block all inbound and outbound access for computers and Web sites in the selected Zone

  • Allow all inbound and outbound access for computers and Web sites in the selected Zone

Related topics:

Designating Zone Membership

Security Level - Low

Security Level - Medium

Security Level - High

Security Level - Custom

Program policies - security based on programs


Low security level

- Point to the divider between the column headers until you see a double arrow, and then drag the divider right or left

- Click on a column header once to sort the column in ascending order; click again to sort in descending order

- You can change the order of how the columns display. Click on the column header, hold the mouse down, drag the column to the new position, then release the mouse

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click Show security level details. The pane expands to show settings for some common ports.

  5. Click View more at the bottom of the Low column. The Viewing: Low Level Settings window for the selected Zone opens.

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click on the icon next to Low. The Low column will be highlighted and the status box at the top of the pane will display the following message:

The security level for the X Zone is Low

...where "X Zone" is either the Internet Zone or the Trusted Zone.

Low Level Settings

Overview of Zones

Overview of All Zone Security Options

The Low security level provides basic protection. Threats are blocked, but most network and Internet traffic is allowed. Most ports are open to incoming and outgoing traffic at this level.

Since much of the communication is not restricted, the Low security level is more appropriate for the Trusted Zone.

Viewing Low settings:

On the Viewing: Low Level Settings window, you can view the preset details, which are read-only and cannot be changed. The window has the following tabs (click on a tab name to view the detailed settings):

  • Defined Ports. Shows which standard ports are open to incoming or outgoing traffic.

  • Attacks. Shows all the known attacks that are blocked.

  • IntelliDefense. When enabled, shows the access for each IntelliDefense classification. You also have the option of disabling IntelliDefense.

  • General. Shows various settings, including default program permissions, broadcast/multicast protocols, and IGMP protocols.

Columns on each tab are resizable, sortable, and movable.

Other instructions:

Opening the Viewing: Low Level Settings window

Applying the Low security level to a Zone

Related topics:

Security Level - Medium

Security Level - High

Security Level - Custom

Overview of Zones

Overview of Zone Security


Low security level - Defined Ports tab

Certain ports must be open for routine Internet communication, but an open port can be a potential entrance for an attacker. The dangers posed by an open port could range anywhere from leaking information about your computer to a Denial of Service attack that crashes your system.

It is recommended you open only the ports you need.

Instead of Low level settings, use Custom level settings and define additional ports on the Custom Ports tab.

Low Level Settings

Defined Ports Tab

Overview of Zone Security Options

Overview of Low Level Security

The Defined Ports tab shows which standard ports are open to incoming and outgoing traffic.

A check mark on the tab indicates the port is open to traffic in that direction; a port with no check mark is closed.

Why should I control open ports?

To follow is a list of each defined port, with its fixed setting in the Low level and a short description of its purpose.

Note: Any port not defined here is closed. If you want to define additional ports:

Name

Port Range

Incoming

Outgoing

Name Description

DHCP

68

Allow

Allow

(Dynamic Host Configuration Protocol). Used to assign IP addresses and other parameters when a computer is added to a network.

SSH

22

Allow

Allow

(Secure Shell). Establishes a secure, encrypted channel between a local and a remote computer. Used for secure logins, file transfers, and port forwarding.

SMTP Submission

587

Allow

Allow

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server. Can also act as an alternate to port 25.

POP3

110

Allow

Allow

(Post Office Protocol 3). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

SMTPS

465

Allow

Allow

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail with authentication and encryption from a client to a mail server and between mail servers.

HTTPS

443

Allow

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used for secure transactions, such as payments, and provides authentication and encryption.

NNTP

119

Allow

Allow

(Network News Transfer Protocol). Used for reading and posting Usenet articles and transferring news among news servers.

Telnet

23

Block

Allow

Allows a client to remotely connect to a Telnet server and get a remote terminal session.

FTP Data

20

Allow

Block

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on port 21 for incoming connection from FTP clients. Then, the server binds on this port before connecting to the client.

Whois

43

Block

Block

Used to provide information about networks, domains, and hosts.

NetBIOS

137-139

Allow

Allow

(Network Basic Input/Output System). Allows applications on separate computers to communicate over a local area network.

Used for Windows File and Print Sharing.

SMTP

25

Allow

Allow

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server and between mail servers.

HTTP

80

Allow

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used to transfer information over the Web.

IRC

194

Allow

Allow

(Internet Relay Chat). Facilitates instant communication, such as instant messaging, over the Internet.

FTP

21

Allow

Block

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on this port for incoming connection from FTP clients. Then, the server binds on port 20 before connecting to the client.

DNS

53

Allow

Allow

(Domain Name Server). Translates domain names to IP addresses and stores other information.

IMAP

143

Allow

Allow

(Internet Message Access Protocol). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

Remote Desktop

3389

Block

Allow

Used for Remote Desktop connections that give access to a computer while at a remote computer.

See also Settings window > Advanced section > Remote Desktop connections field.

MSRPC

135

Allow

Allow

The RPC (Remote Procedure Call) is used to support applications with components located on different machines.

This port is used by Active Directory and Microsoft Exchange mail servers.

SMB

445

Allow

Allow

Use to share files, printers, serial ports, and miscellaneous communications between computers on a network.

LDAP

389

Allow

Allow

(Lightweight Directory Access Protocol). Used to query a server and access a directory listing.

HTTP Alternate

8080

Allow

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used when running a second web server on the same machine or for a web proxy and caching serve.

NTP

123

Allow

Allow

(Network Time Protocol). Used to synchronize the clocks of computers on a network.

Note: If you want to change these settings, instead of Low level settings, use Custom level settings and either make selections on the Defined Ports tab or define additional ports on the Custom Ports. Also, the Medium level and the High level have different settings for port access.


Low security level - Attacks tab

Low Level Settings

Attacks Tab

Overview of Zone Security Options

Overview of Low Level Security

The Attacks tab shows all the Internet attacks that are blocked by iolo Personal Firewall. The firewall analyzes arriving packets and communication attempts; when the signature of an attack is recognized, it is blocked.

Many of the attacks you are protected against are Denial of Service (DoS) attacks that can crash your computer or network. iolo Personal Firewall notes any blocked attacks in the Firewall Odometer.

To follow is a list of each known attack and a description.

Attack Name

Block

Attack Description

Ping of Death

Yes

A type of DoS attack that sends an ICMP PING packet with a large amount of data. It causes a buffer overload on the receiving operating system and crashes the system.

Land

Yes

A type of DoS attack that sends a packet with a header that has the same source and destination data, causing the system to go into an infinite loop. It causes computers running various operating systems to crash.

TCP Port Scan

Yes

A TCP port scan sends a message to ports. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a TCP scan, further communication from that source is blocked.

UDP Port Scan

Yes

A UDP port scan consists of sending sends empty UDP datagrams. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a UDP scan, further communication from that source is blocked.

SYN Flood

Yes

A type of DoS attack that sends a large volume of SYN packets. It causes a buffer overload, affecting the performance of a Web server.

UDP Flood

Yes

A type of DoS attack that sends malformed packets to UDP ports, causing the receiving system reply with ICMP "Destination Unreachable" packets. It causes a buffer overload on the receiving operating system and crashes the system.

ICMP Flood

Yes

A type of DoS attack that sends a host more ICMP PING packets than the system can handle. It causes a buffer overload on the receiving operating system and crashes the system.

Helkern

Yes

Also known as SQLSlammer, a worm that causes a DoS attack. It causes a buffer overload on servers running Microsoft SQL Server 2000 and spreads rapidly across unprotected networks.

SmbDie

Yes

A type of DoS attack that sends a malformed packet over the SMB (Server Message Block) protocol used for file and print sharing. It causes computers running Windows NT, 2000, or XP operating systems to crash.

Lovesan

Yes

Also known as MSBlast or Blaster, a worm that causes a DoS attack. The worm sends a malformed packet that causes a buffer overload in the Windows RPC (Remote Procedure Call) locator service. It causes computers running Windows XP or 2000 to crash. For systems running IIS 5.0, the worm can also give an attacker remote access to a computer.

Note: If you want to remove the block for an attack (not recommended), instead of Low level settings, use Custom level settings and select the Attacks tab.


Low security level - IntelliDefense tab

Low Level Settings

IntelliDefense Tab

Overview of Zone Security Options

Overview of Low Level Security

IntelliDefense uses threat-assessment technology to control incoming and outgoing communication for programs. (More on IntelliDefense.)

IntelliDefense is enabled by default; you can turn the feature on and off from the General tab of the Settings window, by selecting or clearing the Enable IntelliDefense check box.

Note: IntelliDefense applies to the programs that do not have a program policy.

  1. IntelliDefense first checks to see if a program attempting communication is signed by a software publisher you have designated as trusted. You control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window.

  2. If the program is not signed by a trusted publisher, then IntelliDefense determines which classification the program belongs to. Based on that classification, iolo Personal Firewall takes the associated action that is shown on this tab:

  • Allow. Allow the communication attempt.

  • Block. Block the communication attempt.

  • Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

To follow is a list of each IntelliDefense classification, with its fixed setting in the Low level and a description of its purpose.

Program Classification | Incoming | Outgoing | Program Classification Description
Unknown | Prompt | Prompt | Control access for programs and components that are not in the IntelliDefense database.
System | Allow | Allow | Control access for core components of the Windows operating system.
Necessary | Allow | Allow | Control access for safe programs that perform core functionality.
Optional | Allow | Allow | Control access for safe programs, or components of such applications, that may be desired but are not required to perform core functionality.
Dangerous | Block | Block | Control access for software that has been identified as malicious and dangerous by iolo's research team.
Trusted Publishers | Allow | Allow | Control automatic access for programs signed by a publisher you have designated as trusted. You control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window. Software from publishers added to this window will be automatically allowed access.

Note: If you want to change any the default values, instead of Low level settings, use Custom level settings and select the IntelliDefense tab.

Related topics:

IntelliDefense Described

How IntelliDefense works with other program controls

Manage Trusted Publishers window

Allow Access? (Program Access Prompt window)


IntelliDefense Tab

Manage Trusted Publishers Window

To access:

Within a Zone's security level, select the IntelliDefense tab and click Manage Trusted Publishers.

What it does:

When IntelliDefense is enabled, the Manage Trusted Publishers window allows you to designate software publishers as trusted. Prior to applying other classifications, IntelliDefense will first check to see if a program attempting communication is signed by a publisher you have designated as trusted.

The Manage Trusted Publisher window controls which publishers are considered trusted; how the firewall handles programs from trusted publishers is determined on the IntelliDefense tab:

  • At the Low, Medium, and High security levels, programs from trusted publishers are automatically allowed both incoming and outgoing access.

  • At the Custom level, the IntelliDefense tab allows you to control whether or not programs from trusted publishers are automatically allowed incoming and outgoing access.

Note: The settings you make on the Manage Trusted Publishers window apply across the entire firewall and are not specific to a security level or a Zone. The window is common to all security levels, within both Zones, so changes that you make in one security level will apply globally.

Adding a publisher to the Trusted Publishers list

By default, programs signed by iolo technologies and Microsoft are considered trusted publishers.

To add a publisher to the Trusted Publisher list, click Add New. The drop-down menu provides two options:

  • To add a publisher by publisher name, click Select from a list of publishers on this computer. The Select Installed Publisher window will open. Select the check box next to each publisher you want to add and click OK. The publisher's name will display in the Trusted Publisher list.

  • To add a publisher by the name of one of its programs, click Browse for a digitally signed program. A standard Browse window will open. Navigate to the desired program and click OK. The publisher of the selected program will be added.

Note: If the publisher of the selected program is already on the Trusted Publisher list, the publisher name will be highlighted.

Removing a publisher from the Trusted Publishers list

To remove a publisher from the Trusted Publisher list, select the publisher name and click Remove.

Disabling Trusted Publisher functionality

If you do not want to have IntelliDefense treat any programs as being from a Trusted Publisher, select each publisher name and click Remove until all publishers are removed.

Note: At the Custom security level, you can also disable Trusted Publisher functionality by clearing both the Allow all incoming communication and the Allow all outgoing communication check boxes on the IntelliDefense tab.

Related topics:

Select Installed Publisher window

Designate Security for a Zone

IntelliDefense described

How IntelliDefense works with other program controls


Select Installed Publisher Window

IntelliDefense Tab

Manage Trusted Publishers Window > Select Installed Publisher Window

The Select Installed Publisher window allows you to add or remove a publisher from the Trusted Publishers list on the Manage Trusted Publishers window.

This window displays a list of all the software publishers that have digitally-signed programs and files on your computer.

  1. Once you've opened the window, you can add and remove publishers from the Trusted Publisher list:

  • To add publishers to the Trusted Publishers list, select the check box next to each publisher you want to add.

  • To remove publishers from the Trusted Publishers list, clear the check box next to each publisher you want to remove.

Note: You can also remove a publisher from the Manage Trusted Publishers window: select the publisher name and click Remove.

  2. If you want to view the signed programs and files that are associated with a publisher, click the plus symbol (+) next to a publisher name. The window will expand to show all of the files signed by that publisher. To collapse the list, click the minus symbol (-).

  3. Click OK to save your changes and return to the Manage Trusted Publishers window.

Related topics:

Manage Trusted Publishers window


Low security level - General tab

Instead of the Low security level, use the Custom level and change the options on the General tab.

Also, the Medium level blocks incoming access and the High level blocks both incoming and outgoing access.

Instead of the Low security level, use the Custom level and change the options on the General tab.

Instead of the Low security level, use the Custom level and change the option on the General tab.

Enabling the Idle Lock blocks all traffic in a Zone if you have not used your mouse or keyboard for a certain amount of time that you specify.

Instead of the Low security level, use the Custom level and change the options on the General tab.

Also, the High level blocks both incoming and outgoing access.

Low Level Settings

General Tab

Overview of Zone Security Options

Overview of Low Level Security

The General tab shows various firewall controls that apply to the specific Zone. To follow is a list of each control, with its fixed setting and a description of its purpose.

Note: If you want to change any of the below default values, instead of the Low security level, use the Custom level and select the General tab.

Default Program Permissions - Incoming: Allow / Outgoing: Allow

Default program permissions are set to allow both incoming and outgoing communication.

A default program permission provides a default, or "fall-back", position so that the firewall knows how to handle a program when other firewall controls are not in place. These permissions apply if:

  • The Do not show prompts - automatically use default program permissions feature is turned on; OR

  • You do respond to a prompt within the time period specified in the Show prompts - only use default program permissions after [X] seconds option (default is 15 seconds).

Read more about program controls.

I want to change default program permissions:

Broadcast/Multicast - Allow incoming and outgoing

Communication that uses a broadcast and multicast protocol to broadcast messages over a network is given both incoming and outgoing access.

Note: Other settings in iolo Personal Firewall control one-to-one communications, but these communications use a one-to-many format.

I want to block broadcast/multicast communication:

Idle Lock - Disabled

Idle Lock is disabled. The firewall does not lock the Zone after the PC has been idle.

I want to enable Idle Lock:

IGMP - Allow incoming and outgoing

IGMP packets are given both incoming and outgoing access. IGMP access does not pose a significant threat, but some attacks can cause a computer to crash by sending malformed IGMP packets. (Older versions of Windows 95 and 98 are most susceptible.)

I want to block IGMP packets:

Related topics:

Overview of Program Controls

Locked Zone


Medium security level

- Point to the divider between the column headers until you see a double arrow, and then drag the divider right or left

- Click on a column header once to sort the column in ascending order; click again to sort in descending order

- You can change the order of how the columns display. Click on the column header, hold the mouse down, drag the column to the new position, then release the mouse

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click Show security level details. The pane expands to show settings for some common ports.

  5. Click View more at the bottom of the Medium column. The Viewing: Medium Level Settings window for the selected Zone opens.

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click on the icon next to Medium. The Medium column will be highlighted and the status box at the top of the pane will display the following message:

The security level for the X Zone is Medium

...where "X Zone" is either the Internet Zone or the Trusted Zone.

Medium Level Settings

O verview of Zones

Overview of All Zone Security Options

The Medium security level provides intermediate protection while still allowing standard traffic. Threats and uncommon types of communication are blocked, but most routine Internet and network traffic is allowed.

Medium is the default security level for the Internet Zone.

Viewing Medium settings:

On the Viewing: Medium Level Settings window, you can view the preset details, which are read-only and cannot be changed. The window has the following tabs (click on a tab name to view the detailed settings):

  • Defined Ports. Shows which standard ports are open to incoming or outgoing traffic.

  • Attacks. Shows all the known attacks that are blocked.

  • IntelliDefense. When enabled, shows the access for each IntelliDefense classification. You also have the option of disabling IntelliDefense.

  • General. Shows various settings, including default program permissions, broadcast/multicast protocols, and IGMP protocols.

Columns on each tab are resizable, sortable, and movable.

Other instructions:

Opening the Viewing: Medium Level Settings window

Applying the Medium security level to a Zone

Related topics:

Security Level - Low

Security Level - High

Security Level - Custom

Overview of Zones

Overview of Zone Security


Medium security level - Defined Ports tab

Certain ports must be open for routine Internet communication, but an open port can be a potential entrance for an attacker. The dangers posed by an open port could range anywhere from leaking information about your computer to a Denial of Service attack that crashes your system.

It is recommended you open only the ports you need.

Instead of Medium level settings, use Custom level settings and define additional ports on the Custom Ports tab.

Medium Level Settings

Defined Ports Tab

Overview of Zone Security Options

Overview of Medium Level Security

The Defined Ports tab shows which standard ports are open to incoming and outgoing traffic.

A check mark on the tab indicates the port is open to traffic in that direction; a port with no check mark is closed.

Why should I control open ports?

To follow is a list of each defined port, with its fixed setting in the Medium level and a short description of its purpose.

Note: Any port not defined here is closed. If you want to define additional ports:

Name

Port Range

Incoming

Outgoing

Name Description

DHCP

68

Allow

Allow

(Dynamic Host Configuration Protocol). Used to assign IP addresses and other parameters when a computer is added to a network.

SSH

22

Block

Allow

(Secure Shell). Establishes a secure, encrypted channel between a local and a remote computer. Used for secure logins, file transfers, and port forwarding.

SMTP Submission

587

Allow

Block

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server. Can also act as an alternate to port 25.

POP3

110

Allow

Allow

(Post Office Protocol 3). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

SMTPS

465

Allow

Block

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail with authentication and encryption from a client to a mail server and between mail servers.

HTTPS

443

Allow

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used for secure transactions, such as payments, and provides authentication and encryption.

NNTP

119

Allow

Block

(Network News Transfer Protocol). Used for reading and posting Usenet articles and transferring news among news servers.

Telnet

23

Block

Allow

Allows a client to remotely connect to a Telnet server and get a remote terminal session.

FTP Data

20

Allow

Block

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on port 21 for incoming connection from FTP clients. Then, the server binds on this port before connecting to the client.

Whois

43

Block

Block

Used to provide information about networks, domains, and hosts.

NetBIOS

137-139

Block

Allow

(Network Basic Input/Output System). Allows applications on separate computers to communicate over a local area network.

Used for Windows File and Print Sharing.

SMTP

25

Allow

Allow

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server and between mail servers.

HTTP

80

Allow

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used to transfer information over the Web.

IRC

194

Allow

Block

(Internet Relay Chat). Facilitates instant communication, such as instant messaging, over the Internet.

FTP

21

Allow

Block

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on this port for incoming connection from FTP clients. Then, the server binds on port 20 before connecting to the client.

DNS

53

Allow

Allow

(Domain Name Server). Translates domain names to IP addresses and stores other information.

IMAP

143

Allow

Block

(Internet Message Access Protocol). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

Remote Desktop

3389

Block

Allow

Used for Remote Desktop connections that give access to a computer while at a remote computer.

See also Settings window > Advanced section > Remote Desktop connections field.

MSRPC

135

Block

Allow

The RPC (Remote Procedure Call) is used to support applications with components located on different machines.

This port is used by Active Directory and Microsoft Exchange mail servers.

SMB

445

Block

Allow

Use to share files, printers, serial ports, and miscellaneous communications between computers on a network.

LDAP

389

Block

Allow

(Lightweight Directory Access Protocol). Used to query a server and access a directory listing.

HTTP Alternate

8080

Block

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used when running a second web server on the same machine or for a web proxy and caching serve.

NTP

123

Block

Allow

(Network Time Protocol). Used to synchronize the clocks of computers on a network.

Note: If you want to change these settings, instead of Medium level settings, use Custom level settings and either make selections on the Defined Ports tab or define additional ports on the Custom Ports. Also, the Low level and the High level have different settings for port access.


Medium security level - Attacks tab

Medium Level Settings

Attacks Tab

Overview of Zone Security Options

Overview of Medium Level Security

The Attacks tab shows all the Internet attacks that are blocked by iolo Personal Firewall. The firewall analyzes arriving packets and communication attempts; when the signature of an attack is recognized, it is blocked.

Many of the attacks you are protected against are Denial of Service (DoS) attacks that can crash your computer or network. iolo Personal Firewall notes any blocked attacks in the Firewall Odometer.

To follow is a list of each known attack and a description.

Attack Name

Block

Attack Description

Ping of Death

Yes

A type of DoS attack that sends an ICMP PING packet with a large amount of data. It causes a buffer overload on the receiving operating system and crashes the system.

Land

Yes

A type of DoS attack that sends a packet with a header that has the same source and destination data, causing the system to go into an infinite loop. It causes computers running various operating systems to crash.

TCP Port Scan

Yes

A TCP port scan sends a message to ports. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a TCP scan, further communication from that source is blocked.

UDP Port Scan

Yes

A UDP port scan consists of sending sends empty UDP datagrams. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a UDP scan, further communication from that source is blocked.

SYN Flood

Yes

A type of DoS attack that sends a large volume of SYN packets. It causes a buffer overload, affecting the performance of a Web server.

UDP Flood

Yes

A type of DoS attack that sends malformed packets to UDP ports, causing the receiving system reply with ICMP "Destination Unreachable" packets. It causes a buffer overload on the receiving operating system and crashes the system.

ICMP Flood

Yes

A type of DoS attack that sends a host more ICMP PING packets than the system can handle. It causes a buffer overload on the receiving operating system and crashes the system.

Helkern

Yes

Also known as SQLSlammer, a worm that causes a DoS attack. It causes a buffer overload on servers running Microsoft SQL Server 2000 and spreads rapidly across unprotected networks.

SmbDie

Yes

A type of DoS attack that sends a malformed packet over the SMB (Server Message Block) protocol used for file and print sharing. It causes computers running Windows NT, 2000, or XP operating systems to crash.

Lovesan

Yes

Also known as MSBlast or Blaster, a worm that causes a DoS attack. The worm sends a malformed packet that causes a buffer overload in the Windows RPC (Remote Procedure Call) locator service. It causes computers running Windows XP or 2000 to crash. For systems running IIS 5.0, the worm can also give an attacker remote access to a computer.

Note: If you want to remove the block for an attack (not recommended), instead of Medium level settings, use Custom level settings and select the Attacks tab.


Medium security level - IntelliDefense tab

Medium Level Settings

IntelliDefense Tab

Overview of Zone Security Options

Overview of Medium Level Security

IntelliDefense uses threat assessment technology to control incoming and outgoing communication for programs. (More on IntelliDefense.)

IntelliDefense is enabled by default; you can turn the feature on and off from the General tab of the Settings window, by selecting or clearing the Enable IntelliDefense check box.

Note: IntelliDefense applies to the programs that do not have a program policy.

  1. IntelliDefense first checks to see if a program attempting communication is signed by a software publisher you have designated as trusted. You control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window.

  2. If the program is not signed by a trusted publisher, then IntelliDefense determines which classification the program belongs to. Based on that classification, iolo Personal Firewall takes the associated action that is shown on this tab:

  • Allow. Allow the communication attempt.

  • Block. Block the communication attempt.

  • Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

To follow is a list of each IntelliDefense classification, with its fixed setting in the Medium level and a description of its purpose.

Program Classification | Incoming | Outgoing | Program Classification Description
Unknown | Prompt | Prompt | Control access for programs and components that are not in the IntelliDefense database.
System | Allow | Allow | Control access for core components of the Windows operating system.
Necessary | Allow | Allow | Control access for safe programs that perform core functionality.
Optional | Prompt | Prompt | Control access for safe programs, or components of such applications, that may be desired but are not required to perform core functionality.
Dangerous | Block | Block | Control access for software that has been identified as malicious and dangerous by iolo's research team.
Trusted Publishers | Allow | Allow | Control automatic access for programs signed by a publisher you have designated as trusted. You control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window. Software from publishers added to this window will be automatically allowed access.

Note: If you want to change any the default values, instead of Medium level settings, use Custom level settings and select the IntelliDefense tab.

Related topics:

IntelliDefense Described

How IntelliDefense works with other program controls

Manage Trusted Publishers window

Allow Access? (Program Access Prompt window)


Medium security level - General tab

Instead of the Medium security level, use the Custom level and change the options on the General tab.

Also, the High level blocks both incoming and outgoing access and the Low level allows both incoming and outgoing access.

Instead of the Medium security level, use the Custom level and change the options on the General tab.

Instead of the Medium security level, use the Custom level and change the option on the General tab.

Enabling the Idle Lock blocks all traffic in a Zone if you have not used your mouse or keyboard for a certain amount of time that you specify.

Instead of the Medium security level, use the Custom level and change the options on the General tab.

Also, the High level blocks both incoming and outgoing access.

Medium Level Settings

General Tab

Overview of Zone Security Options

Overview of Medium Level Security

The General tab shows various firewall controls that apply to the specific Zone. To follow is a list of each control, with its fixed setting and a description of its purpose.

Note: If you want to change any of the below default values, instead of the Medium security level, use the Custom level and select the General tab.

Default Program Permissions - Incoming: Block / Outgoing: Allow

Default program permissions are set to allow outgoing access, but block incoming access.

A default program permission provides a default, or "fall-back", position so that the firewall knows how to handle a program when other firewall controls are not in place. These permissions apply if:

  • The Do not show prompts - automatically use default program permissions feature is turned on; OR

  • You do respond to a prompt within the time period specified in the Show prompts - only use default program permissions after [X] seconds option (default is 15 seconds).

Read more about program controls.

I want to change default program permissions:

Broadcast/Multicast - Allow incoming and outgoing

Communication that uses a broadcast and multicast protocol to broadcast messages over a network is given both incoming and outgoing access.

Note: Other settings in iolo Personal Firewall control one-to-one communications, but these communications use a one-to-many format.

I want to block broadcast/multicast communication:

Idle Lock - Disabled

Idle Lock is disabled. The firewall does not lock the Zone after the PC has been idle.

I want to enable Idle Lock:

IGMP - Allow incoming and outgoing

IGMP packets are given both incoming and outgoing access. IGMP access does not pose a significant threat, but some attacks can cause a computer to crash by sending malformed IGMP packets. (Older versions of Windows 95 and 98 are most susceptible.)

I want to block IGMP packets:

Related topics:

Overview of Program Controls

Locked Zone


High security level

- Point to the divider between the column headers until you see a double arrow, and then drag the divider right or left

- Click on a column header once to sort the column in ascending order; click again to sort in descending order

- You can change the order of how the columns display. Click on the column header, hold the mouse down, drag the column to the new position, then release the mouse

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click Show security level details. The pane expands to show settings for some common ports.

  5. Click View more at the bottom of the High column. The Viewing: High Level Settings window for the selected Zone opens.

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click on the icon next to High. The High column will be highlighted and the status box at the top of the pane will display the following message:

The security level for the X Zone is High

...where "X Zone" is either the Internet Zone or the Trusted Zone.

High Level Settings

O verview of Zones

Overview of All Zone Security Options

The High security level provides the strongest protection. Only traffic that is fundamental to basic Internet and network functionality is allowed. Essential ports are open, but most other ports are closed to incoming and outgoing traffic at this level.

Viewing High settings:

On the Viewing: High Level Settings window, you can view the preset details, which are read-only and cannot be changed. The window has the following tabs (click on a tab name to view the detailed settings):

  • Defined Ports. Shows which standard ports are open to incoming or outgoing traffic.

  • Attacks. Shows all the known attacks that are blocked.

  • IntelliDefense. When enabled, shows the access for each IntelliDefense classification. You also have the option of disabling IntelliDefense.

  • General. Shows various settings, including default program permissions, broadcast/multicast protocols, and IGMP protocols.

Columns on each tab are resizable, sortable, and movable.

Other instructions:

Opening the Viewing: High Level Settings window

Applying the High security level to a Zone

Related topics:

Security Level - Low

Security Level - Medium

Security Level - Custom

Overview of Zones

Overview of Zone Security


High security level - Defined Ports tab

Certain ports must be open for routine Internet communication, but an open port can be a potential entrance for an attacker. The dangers posed by an open port could range anywhere from leaking information about your computer to a Denial of Service attack that crashes your system.

It is recommended you open only the ports you need.

Instead of High level settings, use Custom level settings and define additional ports on the Custom Ports tab.

High Level Settings

Defined Ports Tab

Overview of Zone Security Options

Overview of High Level Security

The Defined Ports tab shows which standard ports are open to incoming and outgoing traffic.

A check mark on the tab indicates the port is open to traffic in that direction; a port with no check mark is closed.

Why should I control open ports?

To follow is a list of each defined port, with its fixed setting in the High level and a short description of its purpose.

Note: Any port not defined here is closed. If you want to define additional ports:

Name

Port Range

Incoming

Outgoing

Name Description

DHCP

68

Allow

Allow

(Dynamic Host Configuration Protocol). Used to assign IP addresses and other parameters when a computer is added to a network.

SSH

22

Block

Block

(Secure Shell). Establishes a secure, encrypted channel between a local and a remote computer. Used for secure logins, file transfers, and port forwarding.

SMTP Submission

587

Block

Block

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server. Can also act as an alternate to port 25.

POP3

110

Allow

Block

(Post Office Protocol 3). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

SMTPS

465

Block

Block

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail with authentication and encryption from a client to a mail server and between mail servers.

HTTPS

443

Allow

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used for secure transactions, such as payments, and provides authentication and encryption.

NNTP

119

Block

Block

(Network News Transfer Protocol). Used for reading and posting Usenet articles and transferring news among news servers.

Telnet

23

Block

Allow

Allows a client to remotely connect to a Telnet server and get a remote terminal session.

FTP Data

20

Block

Block

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on port 21 for incoming connection from FTP clients. Then, the server binds on this port before connecting to the client.

Whois

43

Block

Block

Used to provide information about networks, domains, and hosts.

NetBIOS

137-139

Block

Block

(Network Basic Input/Output System). Allows applications on separate computers to communicate over a local area network.

Used for Windows File and Print Sharing.

SMTP

25

Block

Allow

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server and between mail servers.

HTTP

80

Allow

Allow

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used to transfer information over the Web.

IRC

194

Block

Block

(Internet Relay Chat). Facilitates instant communication, such as instant messaging, over the Internet.

FTP

21

Block

Block

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on this port for incoming connection from FTP clients. Then, the server binds on port 20 before connecting to the client.

DNS

53

Allow

Allow

(Domain Name Server). Translates domain names to IP addresses and stores other information.

IMAP

143

Block

Block

(Internet Message Access Protocol). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

Remote Desktop

3389

Block

Allow

Used for Remote Desktop connections that give access to a computer while at a remote computer.

See also Settings window > Advanced section > Remote Desktop connections field.

MSRPC

135

Block

Block

The RPC (Remote Procedure Call) is used to support applications with components located on different machines.

This port is used by Active Directory and Microsoft Exchange mail servers.

SMB

445

Block

Block

Use to share files, printers, serial ports, and miscellaneous communications between computers on a network.

LDAP

389

Block

Block

(Lightweight Directory Access Protocol). Used to query a server and access a directory listing.

HTTP Alternate

8080

Block

Block

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used when running a second web server on the same machine or for a web proxy and caching serve.

NTP

123

Block

Allow

(Network Time Protocol). Used to synchronize the clocks of computers on a network.

Note: If you want to change these settings, instead of High level settings, use Custom level settings and either make selections on the Defined Ports tab or define additional ports on the Custom Ports. Also, the Low level and the Medium level have different settings for port access.


High security level - Attacks tab

High Level Settings

Attacks Tab

Overview of Zone Security Options

Overview of High Level Security

The Attacks tab shows all the Internet attacks that are blocked by iolo Personal Firewall. The firewall analyzes arriving packets and communication attempts; when the signature of an attack is recognized, it is blocked.

Many of the attacks you are protected against are Denial of Service (DoS) attacks that can crash your computer or network. iolo Personal Firewall notes any blocked attacks in the Firewall Odometer.

To follow is a list of each known attack and a description.

Attack Name

Block

Attack Description

Ping of Death

Yes

A type of DoS attack that sends an ICMP PING packet with a large amount of data. It causes a buffer overload on the receiving operating system and crashes the system.

Land

Yes

A type of DoS attack that sends a packet with a header that has the same source and destination data, causing the system to go into an infinite loop. It causes computers running various operating systems to crash.

TCP Port Scan

Yes

A TCP port scan sends a message to ports. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a TCP scan, further communication from that source is blocked.

UDP Port Scan

Yes

A UDP port scan consists of sending sends empty UDP datagrams. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a UDP scan, further communication from that source is blocked.

SYN Flood

Yes

A type of DoS attack that sends a large volume of SYN packets. It causes a buffer overload, affecting the performance of a Web server.

UDP Flood

Yes

A type of DoS attack that sends malformed packets to UDP ports, causing the receiving system reply with ICMP "Destination Unreachable" packets. It causes a buffer overload on the receiving operating system and crashes the system.

ICMP Flood

Yes

A type of DoS attack that sends a host more ICMP PING packets than the system can handle. It causes a buffer overload on the receiving operating system and crashes the system.

Helkern

Yes

Also known as SQLSlammer, a worm that causes a DoS attack. It causes a buffer overload on servers running Microsoft SQL Server 2000 and spreads rapidly across unprotected networks.

SmbDie

Yes

A type of DoS attack that sends a malformed packet over the SMB (Server Message Block) protocol used for file and print sharing. It causes computers running Windows NT, 2000, or XP operating systems to crash.

Lovesan

Yes

Also known as MSBlast or Blaster, a worm that causes a DoS attack. The worm sends a malformed packet that causes a buffer overload in the Windows RPC (Remote Procedure Call) locator service. It causes computers running Windows XP or 2000 to crash. For systems running IIS 5.0, the worm can also give an attacker remote access to a computer.

Note: If you want to remove the block for an attack (not recommended), instead of High level settings, use Custom level settings and select the Attacks tab.


High security level - IntelliDefense tab

High Level Settings

IntelliDefense Tab

Overview of Zone Security Options

Overview of High Level Security

IntelliDefense uses threat assessment technology to control incoming and outgoing communication for programs. (More on IntelliDefense.)

IntelliDefense is enabled by default; you can turn the feature on and off from the General tab of the Settings window, by selecting or clearing the Enable IntelliDefense check box.

Note: IntelliDefense applies to the programs that do not have a program policy.

  1. IntelliDefense first checks to see if a program attempting communication is signed by a software publisher you have designated as trusted. You control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window.

  2. If the program is not signed by a trusted publisher, then IntelliDefense determines which classification the program belongs to. Based on that classification, iolo Personal Firewall takes the associated action that is shown on this tab:

  • Allow. Allow the communication attempt.

  • Block. Block the communication attempt.

  • Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

To follow is a list of each IntelliDefense classification, with its fixed setting in the High level and a description of its purpose.

Program Classification | Incoming | Outgoing | Program Classification Description
Unknown | Prompt | Prompt | Control access for programs and components that are not in the IntelliDefense database.
System | Prompt | Allow | Control access for core components of the Windows operating system.
Necessary | Prompt | Allow | Control access for safe programs that perform core functionality.
Optional | Prompt | Prompt | Control access for safe programs, or components of such applications, that may be desired but are not required to perform core functionality.
Dangerous | Block | Block | Control access for software that has been identified as malicious and dangerous by iolo's research team.
Trusted Publishers | Allow | Allow | Control automatic access for programs signed by a publisher you have designated as trusted. You control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window. Software from publishers added to this window will be automatically allowed access.

Note: If you want to change any the default values, instead of High level settings, use Custom level settings and select the IntelliDefense tab.

Related topics:

IntelliDefense Described

How IntelliDefense works with other program controls

Manage Trusted Publishers window

Allow Access? (Program Access Prompt window)


High security level - General tab

Instead of the High security level, use the Custom level and change the options on the General tab.

Also, the Medium level allows outgoing access and the Low level allows both incoming and outgoing access.

Instead of the High security level, use the Custom level and change the options on the General tab.

Instead of the High security level, use the Custom level and change the option on the General tab.

Enabling the Idle Lock blocks all traffic in a Zone if you have not used your mouse or keyboard for a certain amount of time that you specify.

Instead of the High security level, use the Custom level and change the options on the General tab.

Also, the Medium level and the Low level both allow incoming and outgoing access.

High Level Settings

General Tab

Overview of Zone Security Options

Overview of High Level Security

The General tab shows various firewall controls that apply to the specific Zone. To follow is a list of each control, with its fixed setting and a description of its purpose.

Note: If you want to change any of the below default values, instead of the High security level, use the Custom level and select the General tab.

Default Program Permissions - Incoming: Block / Outgoing: Block

Default program permissions are set to block both incoming and outgoing access.

A default program permission provides a default, or "fall-back", position so that the firewall knows how to handle a program when other firewall controls are not in place. These permissions apply if:

  • The Do not show prompts - automatically use default program permissions feature is turned on; OR

  • You do respond to a prompt within the time period specified in the Show prompts - only use default program permissions after [X] seconds option (default is 15 seconds).

Read more about program controls.

I want to change default program permissions:

Broadcast/Multicast - Allow incoming and outgoing

Communication that uses a broadcast and multicast protocol to broadcast messages over a network is given both incoming and outgoing access.

Note: Other settings in iolo Personal Firewall control one-to-one communications, but these communications use a one-to-many format.

I want to block broadcast/multicast communication:

Idle Lock - Disabled

Idle Lock is disabled. The firewall does not lock the Zone after the PC has been idle.

I want to enable Idle Lock:

IGMP - Block all

IGMP packets are given neither coming nor outgoing access. IGMP access does not pose a significant threat, but some attacks can cause a computer to crash by sending malformed IGMP packets. (Older versions of Windows 95 and 98 are most susceptible.)

I want to allow IGMP packets:

Related topics:

Overview of Program Controls

Locked Zone


Custom security level

- Point to the divider between the column headers until you see a double arrow, and then drag the divider right or left

- Click on a column header once to sort the column in ascending order; click again to sort in descending order

- You can change the order of how the columns display. Click on the column header, hold the mouse down, drag the column to the new position, then release the mouse

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click Show security level details. The pane expands to show settings for some common ports.

  5. Click View more at the bottom of the Custom column. The Viewing: Custom Level Settings window for the selected Zone opens.

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click Show security level details. The pane expands to show settings for some common ports.

  5. Click Edit Settings in the Custom column. The Edit Custom Level Settings window for the selected Zone opens.

Note: When editing, make sure you click Save to your changes.

  1. In the Zone Security pane of the Home page, go to the Zone section that you want to update (Internet Zone or Trusted Zone).

  2. Click View Zone options to expand the list of security options.

  3. Click Turn on security and choose a specific security level. The window expands to show each security level.

  4. Click on the icon next to Custom. The Custom column will be highlighted and the status box at the top of the pane will display the following message:

The security level for the X Zone is Custom

...where "X Zone" is either the Internet Zone or the Trusted Zone.

  5. Prior to making any changes, the initial settings within the Internet Zone will be Medium and within the Trusted Zone will be Low.

To change settings, click Edit Settings. The Edit Custom Level Setting window opens and you can change the desired options.

Custom Level Settings

O verview of Zones

Overview of All Zone Security Options

The Custom security level lets you create your own settings to control Internet and network traffic.

Prior to making any changes, the initial Custom settings within the Internet Zone will be Medium and within the Trusted Zone will be Low.

Viewing/editing Custom settings:

  • On the Edit Custom Level Settings window, you can change the settings.

  • On the Viewing: Custom Level Settings window, settings are read-only and cannot be changed.

Both windows have the following tabs (click on a tab name for details):

  • Defined Ports. Determine which standard ports are open to incoming or outgoing traffic.

  • Custom Ports. For additional ports that you specify, determine which ones are open to incoming or outgoing traffic.

  • Attacks. View a list of the known attacks that are blocked. (You can temporarily turn off the block for troubleshooting.)

  • IntelliDefense. When enabled, you can determine the access for each IntelliDefense classification. You also have the option of disabling IntelliDefense.

  • General. Determine various settings, including default program permissions, broadcast/multicast protocols, and IGMP protocols..

Columns on each tab are resizable, sortable, and movable.

Note: When editing, make sure you click Save to save your changes.

Copying settings from another Security Level:

You can copy settings from any of the preset levels. This is time-saving if you want to use a setup that is similar to a preset levels, but has a few options set differently. Any custom ports you have set up are not overridden.

Click Copy settings from another level and then click on one of the following from the pop-up menu:

  • Copy Low Level settings

  • Copy Medium Level settings

  • Copy High Level settings

Click Yes on the Warning window and then all tabs will be updated with the settings from the selected preset level. You can then make additional changes as desired.

Make sure you click Save on the tab to save your changes.

Other instructions:

Opening View mode: the Viewing: Custom Level Settings window

Opening Edit mode: the Edit Custom Level Settings window

Applying the Custom security level to a Zone

Related topics:

Security Level - Low

Security Level - Medium

Security Level - High

Overview of Zones

Overview of Zone Security


Custom security level - Defined Ports tab

Custom Level Settings

Defined Ports Tab

Overview of Zone Security Options

Overview of Custom Level Security

The Defined Ports tab shows which standard ports are open to incoming and outgoing traffic.

In the Incoming and Outgoing columns:

  • Select a check box to indicate that the port is open to communication in that direction.

  • Clear a check box for the ports that you want to close for that direction.

To follow is a list of each defined port with a short description of its purpose.

Note: Any port not defined here is closed. You can define additional ports on the Custom Ports tab.

Name

Port Range

Name Description

DHCP

68

(Dynamic Host Configuration Protocol). Used to assign IP addresses and other parameters when a computer is added to a network.

SSH

22

(Secure Shell). Establishes a secure, encrypted channel between a local and a remote computer. Used for secure logins, file transfers, and port forwarding.

SMTP Submission

587

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server. Can also act as an alternate to port 25.

POP3

110

(Post Office Protocol 3). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

SMTPS

465

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail with authentication and encryption from a client to a mail server and between mail servers.

HTTPS

443

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used for secure transactions, such as payments, and provides authentication and encryption.

NNTP

119

(Network News Transfer Protocol). Used for reading and posting Usenet articles and transferring news among news servers.

Telnet

23

Allows a client to remotely connect to a Telnet server and get a remote terminal session. Communication is unencrypted and not secure.

FTP Data

20

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on port 21 for incoming connection from FTP clients. Then, the server binds on this port before connecting to the client.

Whois

43

Used to provide information about networks, domains, and hosts.

NetBIOS

137-139

(Network Basic Input/Output System). Allows applications on separate computers to communicate over a local area network.

Used for Windows File and Print Sharing.

SMTP

25

SMTP (Simple Mail Transfer Protocol) is a standard for outbound e-mail transport.

This port is used to transmit e-mail from a client to a mail server and between mail servers.

HTTP

80

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used to transfer information over the Web.

IRC

194

(Internet Relay Chat). Facilitates instant communication, such as instant messaging, over the Internet.

FTP

21

FTP (File Transfer Protocol) is commonly used for exchanging files over the Internet.

The FTP server listens on this port for incoming connection from FTP clients. Then, the server binds on port 20 before connecting to the client.

DNS

53

(Domain Name Server). Translates domain names to IP addresses and stores other information. You may have problems browsing the Internet if this port is closed.

IMAP

143

(Internet Message Access Protocol). Used to retrieve e-mail messages from a mail server. Supported by most e-mail clients and servers.

Remote Desktop

3389

Used for Remote Desktop connections that give access to a computer while at a remote computer.

See also Settings window > Advanced section > Remote Desktop connections field.

MSRPC

135

The RPC (Remote Procedure Call) is used to support applications with components located on different machines.

This port is used by Active Directory and Microsoft Exchange mail servers.

SMB

445

Use to share files, printers, serial ports, and miscellaneous communications between computers on a network.

LDAP

389

(Lightweight Directory Access Protocol). Used to query a server and access a directory listing.

HTTP Alternate

8080

HTTP (HyperText Transfer Protocol) is the basis of the Web and is used to transfer and display HTML files.

This port is used when running a second web server on the same machine or for a web proxy and caching serve.

NTP

123

(Network Time Protocol). Used to synchronize the clocks of computers on a network.

Related topics:

Custom Ports


Custom security level - Custom Ports tab

Custom Level Settings

Custom Ports Tab

Overview of Zone Security Options

Overview of Custom Level Security

The Custom Ports tab allows you to control ports that are not listed on the Defined Ports tab.

Note: As a default, any port not defined on the Defined Ports tab is closed.

You can create a port rule that specifies the port number or port range, the applicable protocol (TCP or UDP), and the permission for incoming and outgoing communication.

As a default no custom port rules exist – all rules are created and configured by you, either explicitly on this tab or through selections made on the Communication Blocked or Recent Firewall Events windows.

You can also edit and delete rules that you've created.

Explicitly adding a port rule

  1. Click Add at the top of the Custom Ports tab. The New port rule window opens.

  2. Type in a short description in the Rule description field. An entry in this field is required.

  3. Enter either the port number or the port range (required):

  • For a single port number, select the Port number option and enter the number in the field below the option.

  • For a port range, select the Port range option and enter the starting number in the first field (directly under Port number) and the ending number in the second field (directly under Port range).

  4. Specify which protocol the rule applies to. Select either TCP, UDP, or both. A selection is required.

  5. Select which direction the rule applies to.

  6. To allow incoming access, select the Incoming check box. To block incoming access, clear the check box.

  7. To allow outgoing access, select the Outgoing check box. To block outgoing access, clear the check box.

  6. Click OK to save your rule and close the window. The rule now displays on the Custom Port tab.

Tip: The Internet Assigned Numbers Authority maintains a list of ports at www.iana.org/assignments/port-numbers

Go back to the top of the topic

Adding a port rule through the Communication Blocked window

  1. When the Communication Blocked notice displays, click Show details to display information about the program and its communication attempt.

  2. In the Port number section, click the link to allow access for that port.

  3. If the port is not defined, a custom port rule is automatically created for it.

Adding a port rule through the Recent Firewall Events window

  1. In the Firewall Odometer pane, click View event history to open the Recent Firewall Events window.

  2. Click on the desired row to select it.

  3. In the Port section of the Selected Event section, click the link to allow or block access to that port.

If a communication attempt was blocked, the link will let you open the port (if it isn't open already; if it is open, no link displays). If the communication was allowed, the link will let you close the port (if the port isn't closed already; if it is closed, no link displays).

  4. If the port is not defined, a custom port rule is automatically created for it.

Go back to the top of the topic

Viewing/editing port rules

The tab displays the port rules you have created and also allows for fast edits.

Fast edits: To change the protocol, the incoming access, or the outgoing access, you can make changes directly on the tab:

  • In the In and Out columns, select a check box to indicate that the port is open to communication in that direction; clear a check box for those ports that you want to close.

  • In the TCP and UDP columns, specify whether the rule applies to TCP, UDP, or both. At least one check box must be selected.

Full edits: To change any of the values:

  • Select an existing rule and click Edit at the top of the Custom Ports tab. The Edit port rule window opens. This window offers the same functionality as the New Port rule window described above.

Go back to the top of the topic

Deleting a port rule

Select the rule you want to delete and click Delete at the top of the Custom Ports tab. (No confirmation message will display.)

Related topics:

Defined Ports


Custom security level - Attacks tab

Custom Level Settings

Attacks Tab

Overview of Zone Security Options

Overview of Custom Level Security

The Attacks tab shows all the Internet attacks that are blocked by iolo Personal Firewall. The firewall analyzes arriving packets and communication attempts; when the signature of an attack is recognized, it is blocked.

Many of the attacks you are protected against are Denial of Service (DoS) attacks that can crash your computer or network. iolo Personal Firewall notes any blocked attacks in the Firewall Odometer.

To block an attack, select its check box. It is recommended that all attacks be blocked, but you may wish to temporarily remove a block for system troubleshooting.

To follow is a list of each known attack and a description.

Attack Name

Attack Description

Ping of Death

A type of DoS attack that sends an ICMP PING packet with a large amount of data. It causes a buffer overload on the receiving operating system and crashes the system.

Land

A type of DoS attack that sends a packet with a header that has the same source and destination data, causing the system to go into an infinite loop. It causes computers running various operating systems to crash.

TCP Port Scan

A TCP port scan sends a message to ports. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a TCP scan, further communication from that source is blocked.

UDP Port Scan

A UDP port scan consists of sending sends empty UDP datagrams. The response received indicates whether the port is used and can then be probed further for network vulnerabilities.

If iolo Personal Firewall's detection algorithm finds a UDP scan, further communication from that source is blocked.

SYN Flood

A type of DoS attack that sends a large volume of SYN packets. It causes a buffer overload, affecting the performance of a Web server.

UDP Flood

A type of DoS attack that sends malformed packets to UDP ports, causing the receiving system reply with ICMP "Destination Unreachable" packets. It causes a buffer overload on the receiving operating system and crashes the system.

ICMP Flood

A type of DoS attack that sends a host more ICMP PING packets than the system can handle. It causes a buffer overload on the receiving operating system and crashes the system.

Helkern

Also known as SQLSlammer, a worm that causes a DoS attack. It causes a buffer overload on servers running Microsoft SQL Server 2000 and spreads rapidly across unprotected networks.

SmbDie

A type of DoS attack that sends a malformed packet over the SMB (Server Message Block) protocol used for file and print sharing. It causes computers running Windows NT, 2000, or XP operating systems to crash.

Lovesan

Also known as MSBlast or Blaster, a worm that causes a DoS attack. The worm sends a malformed packet that causes a buffer overload in the Windows RPC (Remote Procedure Call) locator service. It causes computers running Windows XP or 2000 to crash. For systems running IIS 5.0, the worm can also give an attacker remote access to a computer.

Note: If you're in View mode and want to make changes, go back to the desired Zone in the Zone Security pane and click Edit Settings in the Custom column.


Custom security level - IntelliDefense tab

Custom Level Settings

IntelliDefense Tab

Overview of Zone Security Options

Overview of Custom Level Security

IntelliDefense uses threat-assessment technology to control incoming and outgoing communication for programs. (More on IntelliDefense.)

Note: IntelliDefense controls apply to programs that do not have a program policy.

  1. IntelliDefense first checks to see if a program attempting communication is signed by a software publisher you have designated as trusted. You control which publishers are trusted and how programs of trusted publishers are handled.

  • To control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window.

  • To control how a program of a trusted publisher is handled by the firewall:

  • Select the Allow all incoming communication check box to automatically give the program incoming access; clear the check box to remove this control; IntelliDefense will then apply its classification controls (described in step 2 below).

  • Select the Allow all outgoing communication check box to automatically give the program outgoing access; clear the check box to remove this control; IntelliDefense will then apply its classification controls (described in step 2 below).

  2. If access is allowed, the communication is complete and the firewall takes no further action. If a check box is cleared and access in a given direction is not controlled, the communication is then processed by IntelliDefense to determine its classification. Based on that classification, iolo Personal Firewall takes the associated action that you specify on this tab, which is one of the following:

  • Allow. Allow the communication attempt.

  • Block. Block the communication attempt.

  • Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

To follow is a list of each IntelliDefense classification and a description of its purpose.

Program Classification

Program Classification Description

Unknown

Control access for programs and components that are not in the IntelliDefense database.

System

Control access for core components of the Windows operating system.

Necessary

Control access for safe programs that perform core functionality.

Optional

Control access for safe programs, or components of such applications, that may be desired but are not required to perform core functionality.

Dangerous

Control access for software that has been identified as malicious and dangerous by iolo's research team.

Trusted Publishers

Control automatic access for programs signed by a publisher you have designated as trusted. Select or clear the Allow all incoming communication and Allow all outgoing communication check boxes as desired.

To control which publishers are trusted; click Manage Trusted Publishers to open the Manage Trusted Publishers window.

If you are in Edit mode, you can turn the IntelliDefense feature on or off. Click Disable to turn it off; click Enable to turn it back on. In any security level, you can turn the feature on and off from the General tab of the Settings window, by selecting or clearing the Enable IntelliDefense check box.

Note: If you're in View mode and want to make changes, go back to the desired Zone in the Zone Security pane and click Edit Settings in the Custom column.

Related topics:

IntelliDefense Described

How IntelliDefense works with other program controls

Manage Trusted Publishers window

Allow Access? (Program Access Prompt window)


Custom security level - General tab

Custom Level Settings

General Tab

Overview of Zone Security Options

Overview of Custom Level Security

The General tab has various firewall controls that you can apply to the specific Zone. To follow is a list of each control, with its available settings and a description of its purpose.

Note: If you're in View mode and want to make changes, go back to the desired Zone in the Zone Security pane and click Edit Settings in the Custom column.

All controls are described below: Default Program Permissions, Broadcast/Multicast, Idle Lock, and IGMP.

Default Program Permissions

A default program permission provides a default, or "fall-back", position so that the firewall knows how to handle a program when other firewall controls are not in place. These permissions apply if:

  • The Do not show prompts - automatically use default program permissions feature is turned on; OR

  • You do respond to a prompt within the time period specified in the Show prompts - only use default program permissions after [X] seconds option (default is 15 seconds).

To enter your settings:

  • For Incoming, select Allow to allow incoming communication; select Block to block incoming communication. You must select one.

  • For Outgoing, select Allow to allow outgoing communication; select Block to block outgoing communication. You must select one.

Read more about program controls.

Broadcast/Multicast

Broadcast/Multicast controls the broadcast of messages over a network.

  • Select the Incoming check box to allow incoming communication; clear the check box to block communication.

  • Select the Outgoing check box to allow outgoing communication; clear the check to box block communication.

Note: Other settings in iolo Personal Firewall control one-to-one communications, but these communications use a one-to-many format.

Idle Lock

Idle Lock controls whether all traffic in a Zone is blocked when your PC has been idle.

Idle Lock is enabled by selecting the Enable check box; clear the check box to disable it.

  • Enabled. The firewall locks the Zone after the PC has been idle (meaning, you have not moved the mouse/pointing device or used the keyboard) for more than the specified period of time.

A locked Zone does not allow any traffic in or out (unless the communication is by a program whose program policy has the "Bypass locked zone" option enabled for the Zone).

The default period of time after which a Zone will lock is 30 minutes. In the Lock after field, you can change the value by typing in a number or clicking on the up and down arrows.

Notes:

  • Any use of the keyboard or mouse/pointing device immediately unlocks a locked Zone.

  • When one or both Zones are locked, the Firewall tray icon changes to yellow.

  • Disabled. The firewall does not lock the Zone after the PC has been idle. The time shown in the Lock after field is not applicable.

IGMP

IGMP controls the whether IGMP packets are allowed to pass through the firewall.

IGMP access does not pose a significant threat, but some attacks can cause a computer to crash by sending malformed IGMP packets. (Older versions of Windows 95 and 98 are most susceptible.)

  • Select the Incoming check box to allow incoming packets; clear the check box to block incoming packets.

  • Select the Outgoing check box to allow outgoing packets; clear the check to box block outgoing packets.

Related topics:

Overview of Program Controls

Locked Zone


Manage Zone Members Window

You can add a computer, network, or Web site to a Zone in different ways, depending on what information you have.

The following list shows the information you can use to add a member, along with the appropriate link to click from the General Tasks pane. Click on a window name to read detailed instructions on using the window.

I want to:

  • Enter the IP address

Click Add IP Address.

The Add IP Address window opens.

  • Enter a range of IP addresses for a group of computers

Click Add IP Range.

The Add IP Range window opens.

  • Enter an IP address with a IP Subnet mask

Click Add IP Subnet.

The Add IP Subnet window opens.

  • Enter the name of the site or host

Click Add Site or Host.

The Add Site or Host window opens.

  • Select from a list of computers in my network

Click Add items in my network.

The Add items in my network window opens.

  • Select from a list of visited Web sites

Click Add visited Web sites.

The Add visited Web sites window opens.

You can add a computer, network, or Web site to a Zone in different ways, depending on what information you have.

The following list shows the information you can use to add a member, along with the appropriate link to click from the General Tasks pane. Click on a window name to read detailed instructions on using the window.

I want to:

  • Enter the IP address

Click Add IP Address.

The Add IP Address window opens.

  • Enter a range of IP addresses for a group of computers

Click Add IP Range.

The Add IP Range window opens.

  • Enter an IP address with a IP Subnet mask

Click Add IP Subnet.

The Add IP Subnet window opens.

  • Enter the name of the site or host

Click Add Site or Host.

The Add Site or Host window opens.

  • Select from a list of computers in my network

Click Add items in my network.

The Add items in my network window opens.

  • Select from a list of visited Web sites

Click Add visited Web sites.

The Add visited Web sites window opens.

The window displays all the computers, networks, and Web sites that you explicitly added to a Zone or were added to the Trusted Zone as a default (such as www.iolo.com).

Columns are resizable,sortable, and movable.The following fields display:

  • Member Name. The name or address of the computer, network, or site. This field can be edited. The data that shows depends on how the member was added; one of the following types of data will display:

  • An IP address.

  • An IP range. (The beginning IP address and the ending IP address, separated by a dash –.)

  • An IP subnet mask. (The IP address and the IP subnet mask, separated by a slash /.)

  • A site or host name.

  • Description. An optional description to identify the member. This field can be edited.

Note: Computers added as part of the application have a description "Default Trusted Zone Member".

  • Type. The type of information that was entered when the member was added. The type is not editable. One of the following terms will display:

IP Address

IP Range

IP Subnet

Site or Host

  • Zone. The Zone that the member belongs to. Either Trusted Zone or Internet Zone displays. This field can be edited.

- Point to the divider between the column headers until you see a double arrow, and then drag the divider right or left

- Click on a column header once to sort the column in ascending order; click again to sort in descending order

- You can change the order of how the columns display. Click on the column header, hold the mouse down, drag the column to the new position, then release the mouse.

  1. Select an existing member from the list on the Manage Zone Members window.

  2. Click Edit member from the Tasks for This Member pane.

One of the following windows will open. You can edit the same information that you entered when you created the member.

Click on a window name to read detailed instructions on using the window.

Window name

  • Edit IP Address

Opens for members that were added based on an IP address.

This includes computers added using the Add IP Address window and single computers added from the Add Items in My Network window.

  • Edit IP Range

Opens for members added by using a range of IP addresses.

This includes computers added using the Add IP Range window and a network of computers added from the Add Items in My Network window.

  • Edit IP Subnet

Opens for members added based on an IP subnet mask.

This includes computers added using the Add IP Subnet window.

  • Edit Site or Host

Opens for members added based on a site or host name.

This includes computers added using the Add Site or Host window and computers added from the Add Visited Web Sites window. All of the Default trusted computers are also edited on this window.

  1. Select an existing member from the list on the Manage Zone Members window.

  2. Click Delete member from the Tasks for This Member pane. A confirmation message displays; click OK to continue.

The computer will no longer display on the window and is now a member of the Internet Zone.

Designating Zone Membership – The Manage Zone Members Window

To access:

At the bottom of the Zone Security pane, click Manage Trusted Zone members.

What it does:

The Manage Zone Members window allows you to add the computers, networks, and Web sites that you trust to the Trusted Zone. (More on Zones.)

The security settings for the Trusted Zone will apply to the computers that are assigned to the Trusted Zone here. All other computers will be controlled by the Internet Zone security settings.

Note: You can also explicitly assign a computer to the Internet Zone, which may be useful for visibility or if you plan to change or toggle Zone membership.

Instructions - Designating Zone membership:

This topic describes the display of the Manage Zone Members window and describes how to add members to a Zone, edit existing members, and delete/remove members from the window.

  • Adding members to a Zone

Use the links in the General Tasks pane of the Manage Zone Members window to add a computer or range of computers to a Zone.

Click for instructions

  • Viewing information about existing members

The right side of the Manage Zone Members window displays all the computers, networks, and Web sites that have been explicitly added to a Zone.

Click for instructions

  • Editing existing members

Use the Edit member link in the Tasks for This Member pane of the Manage Zone Members window to edit information for an existing member.

Click for instructions

  • Deleting/removing existing members

Use the Delete member link in the Tasks for This Member pane of the Manage Zone Members window to remove an existing member from the display on the window.

The computer will automatically become a member of the Internet Zone.

Click for instructions

Related topics:

Designate security for a Zone

Add/edit using an IP address

Add/edit using a range of IP addresses

Add/edit using an IP subnet mask

Add/edit using a site or host name

Add by selecting from a list of networks

Add by selecting from a list of visited Web sites


IP Address Window

Adding or Editing Zone Members

Based on an IP Address

Overview of Zones

Overview of Manage Zone Members window

Add IP Address: Add a computer or site to a Zone using its IP address.

Edit IP Address: Edit a member that was added with an IP address.

  1. Open the Add IP Address window or the Edit IP Address window.

  2. Type in the IP address. A numerical entry is required.

Note: If you don't have this information, you can assign a computer to a Zone using different information.

  3. Type in a description to identify the computer. This field is optional.

  4. Select Trusted or Internet for the Zone. A selection is required. (More on Zones.)

  5. Click OK. The newly added or revised member displays on the Manage Zone Members window.

Note: An Error message will display if your entry matches an already existing member.

Related topics:

Add/Edit Member Based on Range of IP Addresses

Add/Edit Member Based on IP Subnet

Add/Edit Member Based on Site or Host

Add by selecting from a list of networked computers

Add by selecting from a list of visited/favorite Web sites


IP Range Window

Adding or Editing Zone Members

Based on a Range of IP Addresses

Overview of Zones

Overview of Manage Zone Members window

Add IP Range: Add a network to a Zone based on a range of IP addresses; all of the computers with IP addresses in the given range will be in this one group.

Edit IP Range: Edit a member that was added with a range of IP addresses.

  1. Open the Add IP Range window or the Edit IP Range window.

  2. Type in the IP address for the start of the range. A numerical entry is required.

  3. Type in the IP address for the end of the range. A numerical entry is required.

  4. Type in a description to identify this group of computers. This field is optional.

  5. Select Trusted or Internet for the Zone. A selection is required. (More on Zones.)

  6. Click OK. The newly added or revised member (a group of computers) displays on the Manage Zone Members window.

Note: An Error message will display if a computer in the entered range matches an already existing member.

Related topics:

Add/Edit Member Based on IP Address

Add/Edit Member Based on IP Subnet

Add/Edit Member Based on Site or Host

Add by selecting from a list of networked computers

Add by selecting from a list of visited/favorite Web sites


IP Subnet Window

Adding or Editing Zone Members

Based on an IP Subnet Mask

Overview of Zones

Overview of Manage Zone Members window

Add IP Subnet: Add a computer to a Zone using an IP address and IP subnet mask.

Edit IP Subnet: Edit a member that was added with an IP subnet mask.

  1. Open the Add IP Subnet window or the Edit IP Subnet window.

  2. Type in the IP address. A numerical entry is required.

  3. Type in the IP subnet mask. A numerical entry is required.

  4. Type in a description to identify this group of computers. This field is optional.

  5. Select Trusted or Internet for the Zone. A selection is required. (More on Zones.)

  6. Click OK. The newly added or revised member displays on the Manage zone members window. The Member column displays the IP address first, followed by the IP subnet; for example: 187.199.127.5 / 255.255.240.0

Note: An Error message will display if your entry matches an already existing member.

Related topics:

Add/Edit Member Based on IP Address

Add/Edit Member Based on Range of IP Addresses

Add/Edit Member Based on Site or Host

Add by selecting from a list of networked computers

Add by selecting from a list of visited/favorite Web sites


Site or Host Window

iolo.com

ftp://ftp.microsoft.com/

Adding or Editing Zone Members

Based on Site or Host Name

Overview of Zones

Overview of Manage Zone Members window

Add Site or Host: Add a member to a Zone using the name of a computer or Web site.

Edit Site or Host: Edit a member that was added with the name of a computer.

  1. Open the Add Site or Host window or the Edit Site or Host window.

  2. Type in the name of the site or the computer. An entry is required. Example:

  3. Type in a description to identify the computer. This field is optional.

  4. Select Trusted or Internet for the Zone. A selection is required. (More on Zones.)

  5. Click OK. The newly added or revised member displays on the Manage Zone Members window.

Note: An Error message will display if your entry matches an already existing member.

Related topics:

Add/Edit Member Based on IP Address

Add/Edit Member Based on Range of IP Addresses

Add/Edit Member Based on IP Subnet

Add by selecting from a list of networked computers

Add by selecting from a list of visited/favorite Web sites


Adding Zone Members

Add Items in My Network

Overview of Zones

Overview of Manage Zone Members window

The Add Items in My Network window shows the computers that are in networks your computer also belongs to. From this window, you can add individual computers or an entire network to the Trusted Zone.

  1. Open the Add Items in My Network window. The window displays all the computers found in networks that are connected to your computer. The following details display:

  2. Computer Name. The name of the computer.

  3. IP Address. The IP address of the computer.

  4. Workgroup. The name of the network.

  5. Zone. The Zone that the computer belongs to. Either Trusted Zone or Internet Zone displays. Any computer that has not been assigned to a Zone is automatically a member of the Internet Zone.

  2. Select a single computer or select multiple computers:

  • You can click on a single computer to highlight it. This computer will be controlled by the links in the Tasks for This Computer pane.

  • You can select multiple computers by clicking the check boxes [image]. These computers will be controlled by the links in the General Tasks pane.

Note: To select all the computers shown, click Select all from the General Tasks pane. To clear all check box selections, click Select none.

  3. To add a computer or group of computers to the Trusted Zone:

  4. For a single computer highlighted , click Trust this computer, or to add all the computers that are in the same network as the highlighted computer, click Trust network name.

  5. For single or multiple computers selected [image], click Trust selected.

  4. To remove a computer or group of computers from the Trusted Zone:

Note: Any computer that has not been assigned to the Trusted Zone is automatically a member of the Internet Zone.

  4. For a single computer highlighted , click Don't trust this computer. If in step 3 above you trusted the entire network, the option will allow you to remove the entire network from the Trusted Zone: click Don't trust network name.

  5. For single or multiple computers selected [image], click Don't trust selected.

  5. Click Save to save your changes and close the window; click Cancel to close the window without saving.

You will return to the Manage Zone Members window. Any computers added to the Trusted Zone will display, with a type of "IP Address" or "IP Range" (for computers in a contiguous range). The description field will show the computer name or the network name.

Note: Since any computer that is not a member of the Trusted Zone is automatically in the Internet Zone, computers that were added to the Internet Zone from this window will not display on the Manage Zone Members window.

You can always see any computers that have defaulted to the Internet Zone or that you added to the Internet Zone by opening the Add Items in My Network window.

Related topics:

Add/Edit Member Based on IP Address

Add/Edit Member Based on Range of IP Addresses

Add/Edit Member Based on IP Subnet

Add/Edit Member Based on Site or Host

Add by selecting from a list of visited/favorite Web sites


Adding Zone Members

Add Visited Web Sites

Overview of Zones

Overview of Manage Zone Members window

Use the Add Visited Web Sites window to quickly add those Web sites that you've already visited to the Trusted Zone.

  1. Open the Add Visited Web Site window. The window lists the recently visited Web sites that are in your History and the Web sites that are saved as Favorites. The following details display:

  2. Site Name. The domain name of the Web site.

  3. Zone. The Zone that the site belongs to. Either Trusted Zone or Internet Zone displays. Any site that hasn't been assigned to a Zone is automatically a member of the Internet Zone.

  2. Select a single site or select multiple sites:

  • You can click on a single site to highlight it. This site will be controlled by the links in the Tasks for This Site pane.

  • You can select multiple sites by clicking the check boxes [image]. These sites will be controlled by the links in the General Tasks pane.

  • To select all the sites shown, click Select all from the General Tasks pane. To clear all check box selections, click Select none.

Note: If a site is already assigned to a Zone as part of an IP range, the options described in the following steps #3 and #4 are not available. To make changes, instead edit the IP range.

  3. To add a site or group of sites to the Trusted Zone:

  4. For a single site highlighted , click Trust this site.

  5. For single or multiple sites selected [image], click Trust selected.

  4. To remove a site or group of sites from the Trusted Zone:

(Remember, any computer that has not been assigned to the Trusted Zone is automatically a member of the Internet Zone.)

  4. For a single site highlighted , click Don't trust this site.

  5. For single or multiple sites selected [image], click Don't trust selected.

  5. Click Save to save your changes and close the window; click Cancel to close the window without saving.

You will return to the Manage Zone Members window. Any sites added to the Trusted Zone will display, with a type of "Site or Host" and a description of "Visited website".

Note: Since any site that is not a member of the Trusted Zone is automatically in the Internet Zone, sites that were added to the Internet Zone from this window will not display on the Manage Zone Members window.

You can always view a list of the sites that have defaulted to the Internet Zone or that you added to the Internet Zone by opening the Add Visited Web Sites window.

Related topics:

Add/Edit Member Based on IP Address

Add/Edit Member Based on Range of IP Addresses

Add/Edit Member Based on IP Subnet

Add/Edit Member Based on Site or Host

Add by selecting from a list of networked computers


Program Controls - Overview

Click the IntelliDefense Settings link on the top of the application. When the Settings window opens, clear the Enable IntelliDefense check box.

To disable this option, you select the other option (one or the other must be set): On the Settings window > General tab, select the Do not show prompts - automatically use default program permissions option.

On the Settings window > General tab, select the Do not show prompts - automatically use default program permissions option.

Overview of Program Controls

This topic describes how iolo Personal Firewall controls the access of programs and applications, and describes how the following controls work together:

  • Program Policies

  • IntelliDefense

  • Default Program Permissions

When a program attempts incoming or outgoing communication, the firewall checks if the Zone allows access. If it does, the firewall then checks for the following program controls, in this order:

1. Program Policies

Program policies are controls that you create and configure.

  • Default: As a default, no program policies exist – all policies are created by you, either explicitly or through selections you make on prompt windows.

  • If a policy exists: The firewall performs the action you set in the program policy, which is one of the following:

– Allow: The program is allowed access. The communication is complete and the firewall takes no further action.

– Block: The program is not allowed access. The communication is blocked and the firewall takes no further action.

– Prompt: A prompt is generated and the firewall checks to see which option is set for generated prompts. See #3 below.

  • If no policy exists: If no policy exists for the program, then the firewall checks to see if IntelliDefense is enabled. See #2 below.

2. IntelliDefense

IntelliDefense controls the programs that you don't create a policy for.

  • Default: As a default, IntelliDefense is enabled. To disable:

  • If enabled: The firewall performs the action determined by the program's Trusted Publisher status or IntelliDefense classification; the action is one of the following:

– Allow: The program is allowed access. The communication is complete and the firewall takes no further action.

– Block: The program is not allowed access. The communication is blocked and the firewall takes no further action.

– Prompt: A prompt is generated and the firewall checks to see which option is set for generated prompts. See #3 below.

  • If disabled: If IntelliDefense is disabled, then neither a program policy nor IntelliDefense control is in place. To provide a final line of defense against possibly malicious communications, a prompt is generated. The firewall then checks to see which option is set for generated prompts. See #3 below.

3. Handling Generated Prompts

At this stage, either a prompt will display allowing you to decide access OR the default program permissions will apply. Once a prompt is generated, the firewall checks to see which of the two following options is set:

  • Show prompts - only use default program permissions after [X] seconds. See #3.a below.

  • Do not show prompts - automatically use default program permissions. See #3.b below.

(One of these two options must be set on the Settings window.)

3.a Show prompts - only use default program permissions after [X] seconds

If this option is selected (this is the default), an Allow Access? prompt window will display, allowing you to make a decision on access.

  • Default: As a default, this option is enabled. To disable:

  • If enabled: The Allow Access? prompt displays and the firewall performs the action that you click:

– Allow once: The program is allowed access this time. The prompt will display the next time this program attempts access in the given Zone and direction.

– Allow always: The program is allowed access and will be allowed moving forward (in the given Zone and direction); you will no longer see a prompt for this program.

– Block once: The program is not allowed access this time. The prompt will display the next time this program attempts access.

– Block always: The program is not allowed access and will be blocked moving forward (in the given Zone and direction); you will no longer see a prompt for this program.

However, if you do not respond to the prompt in the specified time, the firewall performs the action your set as the default program permissions for the Zone. The action is one of the following:

– Allow: The program is allowed access this time. The prompt will display the next time this program attempts access.

– Block: The program is not allowed access this time. The prompt will display the next time this program attempts access.

  • If disabled: If disabled, then the "Do not show prompts - automatically use default program permissions" option is enabled and prompts won't display. See #3.b below.

3.b Do not show prompts - automatically use default program permissions

If this option is selected, a prompt window will not display. The firewall automatically "answers" prompts that are generated, using the default program permissions.

  • Default: As a default, this option is disabled. To enable:

  • If enabled: The firewall performs the action you set as the default program permission for the Zone. The action is one of the following:

– Allow. The program is allowed access.

– Block. The program is not allowed access.

  • If disabled: If disabled, then the "Show prompts - only use default program permissions after [X] seconds" option is enabled and prompts will display. See #3.a above.

Related topics:

Flowchart of iolo Personal Firewall process

Managing Program Policies

IntelliDefense

Manage Trusted Publishers window

Settings window


Program Policies

To access:

See the Program Policies pane on the bottom, left side of the Home page.

What it does:

A program policy is a security control that applies to a specific program or application. Program policies let you give individual programs their own set of instructions on how they can communicate over the Internet or a network.

If the associated Zone allows access, then iolo Personal Firewall checks to see if an applicable program policy exists. This means that one program can have different permissions depending on whether a Trusted Zone or an Internet Zone location is involved.

Using program policies, you can:

  • Set up the firewall to allow, block, or prompt for the following communication attempts by a program:

– Outgoing attempt from your computer to a remote location that is in the Internet Zone.

– Outgoing attempt from your computer to a remote location that is in the Trusted Zone.

– Incoming attempt from a remote location in the Internet Zone to your computer.

– Incoming attempt from a remote location in the Trusted Zone to your computer.

  • Have an alert display when a program attempting access has been altered. This provides a defense against malware that attempts to mimic trusted applications.

  • Have the program policy apply even if the Zone is locked.

See also: How program policies work with other program controls

Instructions:

The Program Policies pane shows the number of policies that you have and contains the Manage policies button.

As a default, no program policies exist. All policies are created and configured by you, either on the Manage Program Policies window or through selections made on Allow Access? prompt windows.

To get started, click Manage policies to open the Manage Program Policies window. You can create, view, and edit policies from this window.

Related topics:

How program policies work with other program controls

Managing program policies

Creating new program policies

Program policies automatically created from prompts


Manage Program Policies Window

Click on the action. A drop-down list appears that allows you to select a different action. Your choices are:

  6. Block. Block the communication attempt.

  7. Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

  8. Allow. Allow the communication attempt.

Select or clear the Prompt me if this program is modified check box. If the check box is:

  3. Selected: A Keep Program Policy? window will display when a program has been altered. The window lets you decide whether you want to update the policy with the revised program characteristics. See Keep Program Policy? for details.

  4. Cleared: No messages will display. As a default, the program policy for a changed program will be updated with the new program characteristics. (You can change this default action on the Settings window, Default action when a program with a program policy is modified field.)

If you want the program policy to apply even if the Zone is locked, select the Bypass Locked Zone check box.

If you want a locked Zone to block all access, clear the check box.

Manage Program Policies Window

To access:

In the Program Policies pane, click Manage policies.

What it does:

The Manage Program Policies window allows you to create and manage the program policies that control specific applications. (More on program policies.)

Instructions:

Use the window to create new program policies, and view, edit, and delete existing program policies.

Creating a new program policy

Initially, no program policies exist – all policies are created by you in one of two ways:

  • Explicitly created from this window. Click Create new policy to open the Add Program Policy window. Click for instructions.

  • Created based on selections you make on an "Allow Access?" prompt window. Click for an explanation.

Viewing/editing existing program policies

Existing program policies display on the right side of the window. Each policy has its own row that displays the settings you configured when you created the policy.

Except for the filename, you can edit all of the options set when the policy was created.

To edit the action (Allow, Block, or Prompt):

To change whether a prompt displays when the program properties change:

To change whether the policy will bypass a locked Zone:

Deleting a program policy

  1. Click on an existing program policy from the list. The row is selected.

  2. Click Delete policy. A confirmation message displays; click OK to continue. The policy will no longer exist or display on the Manage Program Policies window.

Related topics:

How Program Policies work with other program controls

Creating new program policies

Program policies automatically created from prompts

Allow Access? program access prompt

Keep Permissions? program modified prompt


New Program Policies Window

Add Program Policy Window - Explicitly Create Program Policies

To access:

From the Manage Program Policies window, click Create new policy.

What it does:

Use the Add Program Policy window to create a program policy. (More on program policies.)

Instructions:

  1. In the Filename field, enter the name and location of the program's executable file. You can enter a program in one of the three following ways:

  2. Type in the name and location.

  3. Click Choose and then click Browse for a program. A standard Browse window opens. Navigate to the program executable and click OK. The program's name and location will be entered in the field.

  4. Click Choose and then click Select from a list of installed programs. The Select Installed Program window opens. Click on the desired program and click OK. The program's name and location will be entered in the field.

  2. To be alerted if a change occurs in a program properties (such as a signature or version information), select the Prompt me if this program is modified check box. If the check box is:

  3. Selected: A prompt window will display if this program is accessed and it has been altered. The window lets you decide whether or not you want to update the policy with the revised program characteristics. See Keep Program Policy? for details.

  4. Cleared: No messages will display; the firewall will make a decision. The default decision is to update the new program characteristics. (You can change this default action on the Settings window, Default action when a program with a program policy is modified field.)

  3. For the Internet Zone / Incoming communication options, set how the program handles incoming communication from a remote location in the Internet Zone to your computer. One of the following selections is required:

  4. Block. Block the communication attempt.

  5. Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

  6. Allow. Allow the communication attempt.

  4. For the Internet Zone / Outgoing communication options, set how the program handles outgoing communication from your computer to a remote location that is in the Internet Zone. One of the following selections is required:

  5. Block. Block the communication attempt.

  6. Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

  7. Allow. Allow the communication attempt.

  5. If you want the program policy to apply even if the Internet Zone is locked, select the Allow program to bypass locked Internet Zone check box.

The following steps 6-8 repeat the same steps, but for the Trusted Zone:

  6. For the Trusted Zone / Incoming communication options, set how the program handles incoming communication from a remote location in the Trusted Zone to your computer. One of the following selections is required:

  7. Block. Block the communication attempt.

  8. Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

  9. Allow. Allow the communication attempt.

  7. For the Trusted Zone / Outgoing communication options, set how the program handles outgoing communication from your computer to a remote location that is in the Trusted Zone. One of the following selections is required:

  8. Block. Block the communication attempt.

  9. Prompt. Generate a prompt. (More on how the firewall handles generated prompts.)

  10. Allow. Allow the communication attempt.

  8. If you want the program policy to apply even if the Trusted Zone is locked, select the Allow program to bypass locked Trusted Zone check box.

  9. When you are finished, click OK. The newly added policy will display on the Manage Program Policies window.

All the parameters for program policies can be viewed and edited from the Manage Program Policies window.

Related topics:

How Program Policies work with other program controls

Allow Access? program access prompt

Keep Permissions? program modified prompt

Program policies automatically created from prompts


Select Installed Program

Select Installed Program Window

To access:

From the Add Program Policy window, click Choose and then click Select from a list of installed programs.

What it does:

The Select Installed Program window allows you to select from a list of all your installed programs.

Each entry displays the program name, the location of the program's executable file, and a brief description of the program.

Instructions:

For the program that you want to create a program policy for, either:

  • Double-click on the program entry; or

  • Select the program entry and click OK.

The program's name and location will be entered in the Filename field of the Add Program Policy window.


Program Policies Created from Prompts

Assume you opened an online game application and an "Allow Outgoing Access?" prompt displayed. The prompt informed you that the program was attempting outgoing communication to the game server, which is in the Internet Zone. You clicked Allow always.

  • A program policy will be automatically created.

  • For outgoing communication in the Internet Zone, the action in the policy will be Allow.

  • For incoming communication in both Zones, and the outgoing communication for the Trusted Zone, the action in the policy will be Prompt.

Program Policies Automatically Created from Prompts

A program policy is automatically created if a program without a policy attempted communication and you clicked Allow always or Block always on the Allow Access? prompt window. (More on program policies.)

All program polices can be edited or removed on the Manage Program Policies window.

Initial Settings

Program policies control four different types of communication:

– Outgoing attempts from your computer to a remote location that is in the Internet Zone.

– Outgoing attempts from your computer to a remote location that is in the Trusted Zone.

– Incoming attempts from a remote location in the Internet Zone to your computer.

– Incoming attempts from a remote location in the Trusted Zone to your computer.

Depending on what Zone the program was in (Internet Zone or Trusted Zone) and what direction the communication was in (incoming or outgoing), the firewall will create the program policy and enter the action that you chose on the "Allow Access?" prompt.

  • If you clicked Allow always, the action for the given Zone and direction is Allow. All other parameters are Prompt.

  • If you clicked Block always, the action for the given Zone and direction is Block. All other parameters are Prompt.

Click for an example:

Other initial settings:

  • The Bypass locked Zone option is cleared. The program policy will not override a locked Zone.

  • The Prompt me if this program is modified option is selected. A prompt will display if you ever open this program and it's been altered. See Keep Program Policy? for details.

Changing initial settings

All the parameters for program policies can be viewed and edited from the Manage Program Policies window.

Related topics:

Manage Program Policies

Allow Access? prompt

New Program Policy window - Explicitly create program policies


For lsass.exe:

Necessary. This file is a component of the Windows Operating System. The process supports pass-through authentication of account logon events for computers in a domain.

Msiexec.exe is "System". This file is part of the Windows operating system and is used for processing Windows Installer packages.

Windows Explorer is "Necessary". This application (explorer.exe) is part of Windows operating systems. It displays a hierarchical view of the drives, folders, and files on your computer.

Windows Media Player is "Optional". This application (wmplayer.exe) is a safe program that allows you to play audio files, but it does not perform a core function that is fundamental to the computer's operation.

IntelliDefense

IntelliDefense™ provides another layer of protection against malicious or unknown programs, while reducing "false alarms" for the programs that are trusted. IntelliDefense:

  • Uses threat-assessment technology to detect risks and provide smarter control of program communication.

  • Provides descriptions of programs attempting communication, giving you the facts you need to make informed decisions.

Note: When enabled, IntelliDefense applies to all of the programs that do not have a program policy.

This topic covers the following:

  • How IntelliDefense Works

  • IntelliDefense Descriptions

  • IntelliDefense Classifications/Categories

  • Associating a Firewall Action with an IntelliDefense Classification

  • Enabling or Disabling IntelliDefense

How IntelliDefense Works

IntelliDefense analyzes programs attempting incoming or outgoing communication and evaluates their threat. iolo Personal Firewall then uses this information to make decisions about how to process the communication. The procedure is as follows:

  1. iolo maintains a regularly updated database of information about thousands of programs and program components, including descriptions of their purpose. (See below for more on descriptions.)

  2. When a program attempts communication, IntelliDefense first checks to see if a program attempting communication is signed by a publisher you have designated as trusted. You control which publishers are trusted on the Manage Trusted Publishers window.

  3. If the program is not automatically allowed access due to its trusted publisher status, IntelliDefense then uses the database and its threat-evaluation process to determine a classification for the program, such as "Necessary" or "Dangerous". (See below for more on classifications.)

  4. Based on that classification, iolo Personal Firewall will then take the associated action, which is either to block access, allow access, or generate a prompt. (See below for more on associating actions with a classification.)

For example, Windows system files can be set up to automatically allow access, while unknown programs can be set up to display a prompt window.

See also: How IntelliDefense works with other program controls.

Go back to the top of the topic

IntelliDefense Descriptions

IntelliDefense displays informative descriptions of programs that attempt communication. This gives you information on what attempts are being made and helps you make decisions on whether to give certain programs access.

IntelliDefense descriptions display on:

  • Allow Access? (Program Access Prompt) windows

  • Communication Blocked (Port closed) windows

  • The Recent Firewall Events window

Click to view a sample description:

Go back to the top of the topic

IntelliDefense Classifications/Categories

IntelliDefense classifies programs into one of these five categories:

  • System. Core components of the Windows operating system. Example:

  • Necessary. Installed, safe applications that perform core functionality. Example:

  • Optional. Installed, safe applications (or components of such applications) that may be desired but are not required to perform core functionality. Example:

  • Dangerous. Spyware, viruses, and other software that has been identified as malicious and dangerous by iolo's research team.

  • Unknown. Programs and components that are not in the IntelliDefense database.*

* For programs classified as "Unknown", you can have the firewall anonymously send iolo information about the program. The information will be reviewed to keep the database as current as possible.

To utilize this feature, select the Automatically send details about unknown programs to iolo for research check box on the Settings window (it is selected as a default). Information about the programs will be automatically sent.

Note: Enabling this feature does not send any personal or identifying information to iolo. All information sent is confidential and used solely for program research by iolo's research team.

Go back to the top of the topic

Associating a Firewall Action with an IntelliDefense Classification

Within each Zone, you can determine the actions you want to apply to each IntelliDefense classification. For example, "System" files can be set up to automatically allow access, while "Unknown" programs can be set up to generate a prompt.

The incoming and outgoing actions that apply for each IntelliDefense classification depend on how you've designated the Zone security. If you:

  • Selected a preset security level, the actions for each IntelliDefense classification are fixed and display on the IntelliDefense tab. Click a link to view the IntelliDefense settings for each level: Low, Medium, and High.

  • Used the Custom security level, you can set the actions for each IntelliDefense classification on the IntelliDefense tab: see Custom.

  • Allowed all incoming/outgoing access for the Zone, IntelliDefense controls will not apply to programs as all communications are allowed. However, IntelliDefense descriptions will still display on the Recent Firewall Events window.

  • Blocked all incoming/outgoing access for the Zone, IntelliDefense controls will not apply to programs as no communications are allowed. However, IntelliDefense descriptions will still display on the Recent Firewall Events window.

Go back to the top of the topic

Enabling or Disabling IntelliDefense

IntelliDefense is enabled as a default.

You can turn the feature on and off from the General tab of the Settings window: Select the Enable IntelliDefense check box to enable IntelliDefense; clear the check box to disable IntelliDefense.

Related topics:

How IntelliDefense works with other program controls

Settings window – IntelliDefense options

Manage Trusted Publishers window

Low security level – IntelliDefense tab

Medium security level – IntelliDefense tab

High security level – IntelliDefense tab

Custom security level – IntelliDefense tab


Default Program Permissions

What it does:

A default program permission is the final control for a program attempting Internet communication. It provides a default, "fall-back" position so that the firewall knows how to handle a program when other firewall controls are not in place.

Default program permissions come into play when the applicable Zone is open and:

  • The Do not show prompts - automatically use default program permissions feature is turned on; OR

  • You do respond to a prompt within the time period specified in the Show prompts - only use default program permissions after [X] seconds option (default is 15 seconds).

Within a specific Zone, a default program permission is set to allow or block communication for a given direction.

For example, as the default for your Trusted Zone locations, you might want to allow both incoming and outgoing communication. As the default for Internet Zone locations, you might want to allow only the outgoing communications and block the incoming.

Remember, this is the fall-back; program policies and IntelliDefense provide the first layers of defense. Read more on how default program permissions work with other program controls.

View or change default program permissions:

The default program permissions that are assigned for incoming and outgoing communication depend on how you have designated the Zone security. If you:

  • Selected a preset security level, the default program permission are fixed and display on the General tab in Zone security. Click a link to view the default program permissions for each level: Low, Medium, and High.

  • Used the Custom security level, you can set the default program permissions on the General tab: see Custom.

  • Allowed all incoming/outgoing access for the Zone, default program permissions will not apply to programs as all communications are allowed.

  • Blocked all incoming/outgoing access for the Zone, default program permissions will not apply to programs as the Zone is blocked and no communications are allowed.

Related topics:

How default program permissions work with other program controls

Settings window - "Action when program access prompts are generated" options

Flowchart of iolo Personal Firewall process


Settings Window Overview

Settings Window

To access:

Click Settings from the menu bar on top of the application.

What it does:

While the default settings provide the recommended level of security, the Settings window allows you to change options to suit your preferences. You can also change settings for how your computer communicates with iolo for software updates.

These settings apply to the entire firewall and are not Zone-specific.

Jump to descriptions of each tab:

  • General

  • Updates

Buttons on the window:

  • Click Save to save and apply your changes and close the window. If you close the window without clicking Save, any changes you made will not apply.

  • Click Cancel to disregard any changes made and close the window.

  • Click Help to open this Help system.

  • Click Reset defaults to restore all of the default settings. This applies to both tabs.

The below list shows some of the more common settings that people may wish to change; refer to the General Tab and Updates Tab topics for a full list of options.

I want to...

Go to this tab > section

  • Turn off/on iolo Personal Firewall.

General > Firewall Settings

  • Turn off/on "Allow Access?" prompts.

General > Prompts and Notices

  • Turn off/on "Communication Blocked" notices.

General > Prompts and Notices

  • Turn off/on IntelliDefense.

General > IntelliDefense

  • Turn off/on the display of Network Activity.

General > Firewall Settings

  • Change which events and how many display on the Recent Firewall Events window.

General > Recent Firewall Events

  • Change the default action for modified programs with a program policy.

General > Program Policy Modification

  • Control ICMP communication and PINGs.

General > ICMP and Stealth

  • Allow AOL connections.

General > Advanced

  • Allow passive FTP connections.

General > Advanced

  • For software updates: Turn on/off the automatic check for updates at startup.

Updates

  • For software updates: Set up a connection to iolo's Internet server through a proxy server.

Updates


Settings Window - General Tab

As a default, the Enable firewall check box is selected and the firewall is enabled.

  • To disable the firewall, clear the check box. When disabled, there are no restrictions of incoming and outgoing communications to and from your computer.

Note: Disabling the firewall makes your computer vulnerable to attack.

  • To enable the firewall, select the check box.

As a default, the Start firewall when computer starts check box is selected and iolo Personal Firewall automatically starts when you start or restart your computer.

  • To have the firewall not start automatically, clear the check box. The next time you start your computer, the firewall will remain shut down.

Note: Not running the firewall makes your computer vulnerable to attack.

  • To automatically start the firewall after a start or restart, select the check box.

As a default, the Display network activity on homepage check box is selected, and when network activity is enabled, the bars in the Network Activity image indicate the activity of Internet traffic.

  • To turn off the display, clear the check box. No bars will display:

  • To turn on the display, select the check box. Bars of varying length will display to indicate activity:

As a default, the Show icon in tray when firewall is active check box is selected and the iolo Personal Firewall displays in your system tray when the firewall is enabled.

  • To remove the icon from system tray, clear the check box.

  • To display the icon in your system tray, select the check box.

Firewall notices are messages that display to give you information, but do not require a decision like the prompt windows do. See Communication Blocked (Port Closed Notice) for an example of a firewall activity notice.

As a default, the Display informational firewall notices check box is selected and these notices display.

  • To stop showing firewall activity notices, clear the check box.

  • To show firewall activity notices, select the check box.

The Maximum number of notices to display at one time option limits the total number of concurrent notices that can be displayed at once. (Several can show for a single communication attempt.)

If this maximum has been reached and another notice is generated, the oldest notice is closed and the newer one displays.

The default value is 25. You can enter from 2 to 50.

As a default, the Show prompts - only use default program permissions after [X] seconds option is selected and the default time for "X" is 15 seconds.

With this option selected, prompts will display. Then if the prompt window is idle for 15 seconds, the default program permission will apply.

  • If you do not want to see prompts, select the Do not show prompts - automatically use default program permissions option.

This option will answer prompts that are generated (prompts can be generated in several different ways) and prompts will never display to you.

The action taken is either allow or block, depending on the default program permission.

  • If you do want to see prompts, select the Show prompts - only use default program permissions after [X] seconds option.

Prompts will display.

If the window is idle for more than the specified time, the firewall responds using the default program permission, which is either block or allow.

Note: To change the time from 15 seconds, enter a different value in the field. You can enter from 2 to 33 seconds.

See Overview of Program Controls for more information on how these options work with other program controls.

- meaning, you do not hover over the window with your mouse

As a default, the Show events for Internet Zone check box is selected and Internet Zone activity is logged on the Recent Firewall Events window and the Firewall Odometer.

  • To stop showing the Internet Zone activity, clear the check box.

  • To show the Internet Zone activity, select the check box.

As a default, the Show events for Trusted Zone check box is selected and Trusted Zone activity is logged on the Recent Firewall Events window and the Firewall Odometer.

  • To stop showing the Trusted Zone activity, clear the check box.

  • To show the Trusted Zone activity, select the check box.

As a default, the Show ICMP events check box is cleared and ICMP activity is not logged on the Recent Firewall Events window or the Firewall Odometer.

  • To start tracking ICMP activity, select the check box.

  • To stop tracking ICMP activity, clear the check box.

This option controls how many events display on the Recent Firewall Events window.

The default value is 25. You can enter from 2 to 100.

Click Clear All to remove all the events that are currently displaying on the Recent Firewall Events window.

This functions like a "Reset": all the events that currently display are cleared, but moving forward, events will still display.

IntelliDefense classifies a program attempting communication into one of five classifications, then the firewall takes a set action depending on that classification. (More on IntelliDefense).

As a default, the Enable IntelliDefense check box is selected and IntelliDefense is enabled.

  • To disable IntelliDefense, clear the check box.

  • To enable IntelliDefense, select the check box.

For programs classified as "Unknown" by IntelliDefense, you can have the firewall anonymously send iolo information about the program. The information will be reviewed to keep the database as current as possible.

As a default, the Automatically send details about unknown programs to iolo for research check box is selected and this feature is enabled.

  • To turn off this feature, clear the check box.

  • To turn on the feature, select the check box. Information about the programs will be automatically sent.

Note: Enabling this feature does not send any personal or identifying information to iolo. All information sent is confidential and used solely for program research by iolo's research team.

As a default, the Enable Stealth Mode check box is selected and Stealth Mode is enabled. To disable Stealth Mode, clear the check box.

When Stealth Mode is enabled:

  • The firewall configures your PC to ignore incoming PINGs. The result is that your IP address will still be considered valid, but your computer will appear to be absent from the network.

  • Incoming ICMP communication must be blocked. (See also Allow ICMP communication below.)

When Stealth Mode is disabled:

  • Your PC does not ignore incoming PINGs.

  • Incoming ICMP communication must be allowed (See also Allow ICMP communication below.)

The ICMP (Internet Control Message Protocol) sends informational and error messages between hosts that are attempting to communicate.

As a default, the Outgoing check box is selected and ICMP outgoing messages are allowed; the Incoming check box is cleared to block incoming messages.

  • For Outgoing, you can clear (block messages) or select (allow messages) the check box as desired.

  • For Incoming, what you have selected for the "Enable Stealth Mode" check box controls what you can select here (and vice versa).

When Stealth Mode:

  • Is enabled, incoming ICMP communication must be blocked.

  • Is disabled, incoming ICMP communication must be allowed.

If a program changes characteristics (such as a signature or version information) and it has a program policy, either the same program policy can be used for the modified program or the policy can be discarded.

You can make this decision on the Keep Program Policy? prompt, or the firewall can make a decision using the default action set here. The firewall will make a decision if:

  • The Prompt me if this program is modified check box for the policy is cleared.

  • The Prompt me if this program is modified check box for the policy is selected, but the prompt has been idle for 15 seconds.

The default is Keep existing permissions; program policies for modified programs will be updated with new program characteristics. To set the default, select an option (one or the other must be selected).

  • Select Discard existing permissions and delete the program policy to have the default action be a deletion of the existing program policy. No program policies will exist for the given program.

In this case, the firewall will treat modified programs the same way it treats programs without a program policy. (See Overview of Program Controls for a description of the flow of program controls.)

  • Select Keep existing permissions and update the program policy to have the default action be an updating of the program policy with the new program characteristics.

In this case, the firewall will follow whatever actions you have set in the policy (block, prompt, or allow).

- meaning, you do not hover over the window with your mouse

The Windows operating system uses an important set of internal programs to send and receive communication. Communication from and received by these core programs is generally considered safe.

As a default, the Allow Windows system process communication (recommended) check box is selected and the firewall allows any communication originating from these system processes.

  • To allow these communications, select the check box.

  • To not explicitly allow these communications, clear the check box. Other firewall configurations related to these processes (for example, through a program policy) will apply.

If you use America Online (AOL) to connect to the Internet, select this check box.

Select this option if you use Apple's iTunes to purchase media or view streaming media. Selecting this option allows the access required by certain functionality in the iTunes program.

Note: This option does not control port access.

Skype is a software program that allows for Internet phone calls over a peer-to-peer network. Select this check box if you use Skype to make and/or receive phone calls.

World of Warcraft is a role-playing game in which a large number of players interact over the Internet. Select this check box if you play World of Warcraft.

The firewall recognizes the Microsoft Exchange connections that are used to send and receive email messages. This option allows you to open communication for programs that connect to Exchange (such as Microsoft Outlook).

As a default, the Allow Microsoft Exchange connections (recommended) check box is selected and communications are open.

  • To explicitly allow communications, select the check box. Communication will be allowed as long as the port is open.

  • To not explicitly allow these communications, clear the check box. Other firewall configurations related to these processes (for example, through a program policy) will apply.

This option controls incoming and outgoing communication for the Internet Explorer browser application (iexplore.exe).

As a default, the Allow Microsoft Internet Explorer® connections check box is selected and the firewall allows incoming and outgoing communication for Internet Explorer.

  • To allow Internet Explorer communications, select the check box. Incoming and outgoing communication for Internet Explorer will be allowed, as long as the port is open.

Note: You can override this setting, for a Zone or for a direction, by creating your own program policy for iexplore.exe.

  • To not explicitly allow Internet Explorer communications, clear the check box. Other firewall configurations related to Internet Explorer (for example, through a program policy) will apply.

A passive FTP connection is where the flow of data is set up and initiated by the FTP client rather than the FTP server. Passive FTP was created to address the problem of having the client wait for server contact.

As a default, the Allow passive FTP connections check box is cleared and passive FTP connections are not allowed.

To allow passive FTP connections, select the check box. The TCP ports used for passive FTP connections (typically between 1024 and 65535) will be open to traffic that is identified as passive FTP communication.

Note: Passive FTP connections pose a security risk by allowing applications to connect through a variety of ports.

These check boxes control whether Remote Desktop connections are allowed through the firewall. In addition to controlling the port for the Remote Desktop Protocol (TCP port 3389), the check boxes control other system settings that are part of this functionality.

As a default, the Outgoing check box is selected to automatically allow outgoing connections; the Incoming check box is cleared so that incoming connections are not automatically allowed.

  • Select the Outgoing check box to automatically allow outgoing Remote Desktop connections from the computer with iolo Personal Firewall installed. Clear the check to not automatically allow the outgoing connections; other firewall configurations related to these processes (for example, through a Custom port setting) will apply.

  • Select the Incoming check box to automatically allow incoming Remote Desktop connections to the computer with iolo Personal Firewall installed. Clear the check box to block the incoming connections; other firewall configurations related to these processes (for example, through a Custom port setting) will apply.

For Remote Desktop communications, the settings made here will override the Zone port settings for the defined port 3389; however, for other types of communication that may attempt access through port 3389, the Zone settings will still apply.

In other words, by allowing Remote Desktop connections here, you are opening port 3389 to Remote Desktop communication. But for other types of communication, whatever you have set for port 3389 in the applicable Zone will apply, whether that is to block or allow traffic.

When the firewall blocks an attack, all communication from the remote IP address that originated the attack will be blocked for [X] hours.

If your PC is being persistently attacked, this feature denies the communication at the root rather than processing it as potentially legitimate and then blocking it. This reduces the amount of processing overhead for both the operating system and the firewall.

The default time is 3 hours. You can enter from 2 to 99 hours.

You cannot enter increments of an hour (for example, 2.7 hours is not a valid entry).

  • Select this option to turn off Internet Explorer's Protected Mode and allow iolo Personal Firewall to process all browser communication using its security policies.

  • Clear the option to leave Protected Mode on, allowing certain communication to pass without scrutiny by the firewall.

Settings Window

General Tab

Overview of the Settings window

The General tab on the Settings window allows you to enable and disable tools, change default settings for firewall messages, control event logging, control ICMP communication, and more.

Unlike other configurations that are Zone-specific, these settings apply across the entire firewall.

The following fields display on the General tab; click on a field name to view detailed instruction.

Firewall Settings

Enable firewall

Start firewall when computer starts

Display network activity on homepage

Show icon in tray when firewall is active

Prompts and Notices

The Display informational firewall notices option control the display of informational notices (such as the Communication Blocked window).

Maximum number of notices to display at one time

The options shown under Action when program access prompts are generated control the display of the Allow Access? prompts and the usage of default program permissions.

Recent Firewall Events

These options control what displays on the Recent Firewall Events window and the Firewall Odometer pane:

Show events for Internet Zone

Show events for Trusted Zone

Show ICMP events

These options further control what displays of the Recent Firewall Events window:

Keep the last [X] most recent events Clear All

IntelliDefense

These options control IntelliDefense:

Enable IntelliDefense

Automatically send details about unknown programs to iolo for research

ICMP and Stealth

These options controls the access of PINGs and other ICMP messages.

Enable Stealth Mode

Allow ICMP communication

Program Policy Modification

This option applies to programs with a program policy:

Default action when a program with a program policy is modified:

Advanced

Allow Windows system process communication (recommended)

Allow America Online® connections

Allow iTunes® connections

Allow Skype® connections

Allow World of Warcraft® connections

Allow Microsoft Exchange® connections (recommended)

Allow Microsoft Internet Explorer® connections

Allow passive FTP connections

Allow Remote Desktop connections: Outgoing / Incoming

Block remote attacker IP addresses for [X] hours

Displays for Windows Vista users only:

Allow firewall to process all Internet Explorer® communication

Related topics:

Settings window - Updates tab


Settings Window - Updates Tab

  • Proxy server. Enter the IP address or domain address of the proxy server. An entry is required.

  • Port. Enter the port number of the proxy server. An entry is required.

  • Proxy requires authentication. Select the check box if the proxy server requires authentication. Once selected, the User Name and Password fields appear. Type in the appropriate user name and password.

Settings Window

Updates Tab

Overview of the Settings window

Note: This tab can be accessed in one of two ways: From the Updates pane, click Settings; or from the menu bar, click Settings and then select the Updates tab.

The Updates tab on the Settings window allows you to change the default settings for how you connect to iolo's Internet server. This includes the ability to set up connections for a proxy server.

Enable automatic updates (recommended) check box

As a default, the Enable automatic updates (recommended) check box is selected. When selected, the firewall periodically (approximately once an hour) checks for updates. If an update is found, you will see a prompt to install it.

  • To turn off the automatic checking, clear the check box. You can still check for updates when you wish, by clicking Check for updates in the Updates pane of the Home page.

  • To return to having iolo Personal Firewall automatically check for updates, select the check box.

Edit connection settings link

The Edit connection settings link displays if you have the Enable automatic updates (recommended) check box selected.

Click the link to display additional options:

  • Automatically detect proxy server settings (default). This is the default selection. If you connect to the Internet through a proxy server, you can select this option. The firewall will detect settings for the primary proxy server and will automatically use other proxies if the primary proxy is unavailable.

  • Do not use a proxy server to connect to the Internet. If you do not connect to the Internet through a proxy server, select this option.

  • Use specific proxy server settings. If you connect to the Internet through a proxy server, you can select this option if you need to configure its settings. With this check box selected, the following fields appear, allowing you to enter information about the proxy server.

When you are finished making your changes, click Done.

Related topics:

Updates pane

Settings window - General tab


Firewall Odometer

To access:

See the Firewall Odometer pane on the top, right side of the Home page.

What it does:

The Firewall Odometer pane shows the communication attempts that iolo Personal Firewall has blocked. These attempts are categorized by various date groupings and by types (ports, programs, and attacks blocked).

This can be useful for quick analysis and troubleshooting: you can see prior activity for the past day, past week, or past minute, or go back as far as the day you installed the firewall.

The pane also contains the View event history link; click the link to view a more detailed history of Internet communication.

Instructions:

The following information displays in the pane:

  • Threats Blocked. Shows the number of ports, programs, and attacks that have been blocked on the current day (Today), in the current week (This week), and in the current month (This month).

  • Since Date and time of last reset. Shows the threats that have been blocked since the day and time you last reset the count. The threats are listed by the number of ports, programs, and attacks blocked.

Initially, the date and time shown in the header are the same as the installation date/time, but once you click Reset, the heading shows the current date and time.

Click Reset to restart the count from zero.

Note: Clicking Reset also resets the "Today" count in the Threats Blocked section (described above) and the "Since Date and time of last reset" statistics on the Recent Firewall Events window.

  • Since install (Date of install). Shows the threats that have been blocked since you installed iolo Personal Firewall. The threats are listed by the number of ports, programs, and attacks blocked.

To view detailed logs of all communication to and from your computer, click View event history to open the Recent Firewall Events window.

Note: On startup, the pane initially displays expanded and shows all the detail. You can toggle between hiding and showing this detail.

  • To hide/collapse the details in the pane:

  • To show/expand the details in the pane:

Related topics:

Recent Firewall Events window

Settings window - Firewall Events options


- Point to the divider between the column headers until you see a double arrow, and then drag the divider right or left

- Click on a column header once to sort the column in ascending order; click again to sort in descending order

- You can change the order of how the columns display. Click on the column header, hold the mouse down, drag the column to the new position, then release the mouse

If you are using one of the set security levels for the Zone (Low, Medium, or High), the firewall will need to change the security to the Custom level, so that it can include these customized port settings.

A Confirm window will display giving you the option of making this update; click OK to continue. The firewall will change the security of the Zone to Custom and will add the port setting, but all other settings will be the same as the security level you had previously: Low, Medium, or High.

Recent Firewall Events Window

To access:

In the Firewall Odometer pane, click View event history.

What it does:

The Recent Firewall Events window provides real-time monitoring of Internet communications and shows all the recent Internet activity. The window also has a section for detailed historical statistics.

Viewing event history is useful to analyze possible security breaches and reveal suspicious patterns. For example, unusually high traffic on a rarely used port could indicate malware is on your computer. Analyzing the filtering done by the firewall can also help you perfect your configurations.

Instructions:

You can view a list of recent events, filter the list of events, read details for a selected event, open or close related ports, and view detailed historical statistics.

To clear all the events that are displaying, click Clear all events; all the events that currently display are cleared, but moving forward, events will still display.

Viewing events

The recent communication attempts display on the right side of the window. Columns are resizable, sortable, and movable.

The following displays:

  • Date. The date and time of the attempted or successful communication.

  • Action. Indicates whether the communication was Blocked or Allowed.

  • Local Program. The location and program on your computer that was involved in the attempted or successful communication. Click on the link to open the Windows Properties window for the file.

For an ICMP event, the field will display [System:ICMP / Type], where Type is the ICMP type, such as Echo or Source Quench.

  • Remote Address. The remote computer or Web site that was involved in the attempted or successful communication. Click on the link to attempt access to this outside location.

  • Direction. The direction of the attempted or successful communication: Incoming or Outgoing.

  • Port. The port number and protocol for the applicable port.

  • Zone. The Zone that the communication was attempted or completed in: Trusted Zone or Internet Zone.

  • Attack. Indicates whether the attempt was an attack: Yes or No.

  • IntelliDefense. Indicates whether the IntelliDefense controls were used in blocking or allowing access: Yes or No.

Note: As a default, 25 events display. You can change this number on the Settings window, Keep the last [X] most recent events field.

Go back to the top of the topic

Filtering events

To filter the events that display on the window, click the Filter link on the bottom of the window. A menu opens with the following filtering options:

  • "Show incoming communication" or "Hide incoming communication"

  • "Show outgoing communication" or "Hide outgoing communication"

  • "Show allowed communication" or "Hide allowed communication"

  • "Show blocked communication" or "Hide blocked communication"

Go back to the top of the topic

Viewing details for a selected event

To view details for a selected event, click on the desired row on the right side of the window. The following information displays in the Selected Event section on the top, left side of the window:

  • Local Program. The program on your computer that was involved in the attempted or successful communication.

  • Click on the location to open a Windows Explorer window for the file's folder.

  • Click on the program name to open the Windows Properties window for the file.

Note: For an ICMP event, there are no hyperlinks; the field will display [System:ICMP / Type], where Type is the ICMP type, such as Echo or Source Quench.

  • IntelliDefense Category. The classification and description of the program. (More on IntelliDefense.)

  • Remote Address. The remote computer or Web site that was involved in the attempted or successful communication.

  • Direction. The direction of the communication attempt: Incoming or Outgoing.

  • Port. The port number and protocol for the applicable port.

You can click the "Allow" or "Block" link in this section to open or close the port. The port settings for the Zone will update for the current direction and protocol. See below for more information.

  • Zone. The Zone that the communication was attempted or completed in: Trusted Zone or Internet Zone.

Go back to the top of the topic

Opening or closing the port to communication

To open or close a port to communication, click on the desired row. In the Port section of the Selected Event section, click the link to allow or block access to that port. The text of the link has the direction and the protocol; for example, "Block Outgoing UDP access" or "Allow Incoming TCP access".

If a communication attempt was blocked, the link will let you open the port (if the port isn't open already; if it is open, no link displays). If the communication was allowed, the link will let you close the port (if the port isn't closed already; if it is closed, no link displays).

  • If the port is defined, the Defined Port settings will be updated to allow access (in the current direction and Zone).

  • If the port is not defined, a Custom Port rule will be created to allow access (in the current direction, protocol, and Zone).

I see a "Confirm" window:

Go back to the top of the topic

Viewing historical statistics

The Firewall Historical Statistics section displays the same information that shows on the Firewall Odometer pane, plus it also:

  • Shows the number of ports and programs that have been allowed communication.

  • Further categorizes statistics into incoming and outgoing communication.

This section is on the bottom, left side of the window and is divided into two subsections:

Since Install (Date of install)

Since you installed iolo Personal Firewall, shows:

  • The number of ports and programs that have been allowed and blocked, separated into incoming and outgoing communication.

  • The number of attacks that have been blocked, separated into incoming and outgoing communication.

Since Date and time of last reset

Since the day and time you last clicked Reset (which you can click to restart the count from zero), shows:

  • The number of ports and programs that have been allowed and blocked, separated into incoming and outgoing communication.

  • The number of attacks that have been blocked, separated into incoming and outgoing communication.

Note: Clicking Reset also resets the "Threats Blocked Today" and the "Since Date and time of last reset" statistics on the Firewall Odometer pane.

Related topics:

Firewall Odometer

Settings window - Firewall Events options

IntelliDefense


Updates

To access:

See the Updates pane on the middle, right side of the Home page.

What it does:

The Updates pane allows you to download free software updates for the iolo Personal Firewall. Software updates can include product improvements, revisions, and patches. (These differ from product upgrades, which are newer versions of the product.)

Note: An open Internet connection is required; to check for updates and then download them, you must connect to iolo's Internet server.

You can also view your version and licensing information and customize settings for how you connect to iolo's Internet server.

Instructions:

To follow are descriptions of the links in the pane and the status messages that display on the top of the pane.

Links

  • Click Version Info to view your licensing information and the version of iolo Personal Firewall you're running. With an Internet connection, you can also open iolo's Web site from this window.

  • Click Settings to open the Updates tab of the Settings window, which allows you to customize settings for how you connect to iolo's Internet server.

One of the following links will also display, depending on the status of your software:

  • Check for updates

  1. Click Check for updates to have the system connect to iolo's Internet server and check for any software updates.

  2. A progress window displays.

  3. The check is complete when the window closes. If any updates are available, the Download now link displays.

  • Download now

Click Download now to begin downloading the updates. The link displays only when updates are available.

  • Retry

The Retry link displays if you tried to connect to the iolo's Internet server and the connection failed.

You can click Retry to try to connect to again.

Go back to the top of the topic

Status Messages

One of the following messages will display on the top of the Updates pane. These messages indicate the status of your software and whether any checks have been made for updates.

  • Up-to-date

The Up-to-date message indicates that you are running the latest version of iolo Personal Firewall.

You can click Check for updates at any time.

  • May not be up-to-date

The May not be up-to-date message displays if you turned off the automatic check for updates on the Update Settings window, and you have not yet checked for updates in your current session of iolo Personal Firewall.

Updates may or may not be available. You can click Check for updates to check.

  • Update available

The Update available message indicates that software updates are available.

Click Download now to begin downloading the updates.

  • Could not connect

The Could not connect message displays if you attempted to connect to the Internet and the connection failed.

Common connectivity issues include the Internet connection is not on, incorrect proxy settings, or you clicked Cancel on the Checking for updates window.

Click Retry to try to connect to iolo's Internet server again.

Note: On startup, the pane initially displays expanded and shows all the detail. You can toggle between hiding and showing this detail.

  • To hide/collapse the details in the pane:

  • To show/expand the details in the pane:

Related topics:

Settings window - Updates tab


Web Support

Customer Care / Web Support

To access:

Open www.iolo.com/customercare in your Web browser.

What it does:

The Customer Care page on iolo's Web site offers a wide range of support and service options, including:

  • A Knowledge Base with technical articles, tutorials, frequently asked questions, and troubleshooting tips.

  • Contact forms to email specific questions to the Technical Support and Sales/Customer Service departments. (All support is free and unlimited.)

  • Access to other services such as product downloads, product registration, and the online license retrieval system.

Read Online Knowledge Base

The searchable Knowledge Base has answers to frequently asked questions, technical articles, tutorials, tips, and more.

You can quickly get to the information you need in three different ways:

  • Quick Solutions provides fast access to common customer issues.

  • Use Find Answers to find solutions based on keywords.

  • Browse through articles by topic in Browse for Solutions.

Online Knowledge Base: www.iolo.com/customercare

Contact Technical Support

The Technical Support department handles technical, product-related questions. All technical support is free and unlimited.

Simply enter your contact information, select the iolo Personal Firewall product, and then type in the details of your question.

A valid email address is required to submit the form. Please add support-crm@iolo.com to your email program's "safe senders" before submitting the form.

Technical Support Online Submission Form: www.iolo.com/customercare/technicalsupport.aspx

Contact Sales/Customer Service

The Customer Service department handles general and sales-related questions. All customer service support is free and unlimited.

Simply enter your contact information and then type in the details of your question.

A valid email address is required to submit the form. Please add support-crm@iolo.com to your email program's "safe senders" before submitting the form.

Customer Service Online Submission Form: www.iolo.com/customercare/customerservice.aspx

Other Services

From the Customer Care page, you can also:

  • Download current and prior releases of iolo software.

  • Register your iolo software.

  • Use the licensing retrieval system to get your User ID and Serial Number if it's ever misplaced (available if you purchased the product directly from iolo or registered your software).

Related topics:

Contact iolo

Technical support


Online Assistance

To access:

See the Online Assistance pane on the lower, right side of the Home page.

What it does:

The Online Assistance pane provides quick access to the "Find Answers" page of iolo's Customer Care Web site. This page allows you to read the Knowledge Base articles that contain the keywords you enter.

An open Internet connection is required.

Instructions:

  1. Type in the text you want to search for.

  2. Click the green arrow. The Customer Care page opens in your Web browser, displaying links to all the Knowledge Base articles, FAQs, and tutorials that contain the text you entered.

  3. Click on a link to view the detailed information.

Note: On startup, the pane initially displays the Search for field. You can toggle between hiding and showing this detail.

  • To hide/collapse the details in the pane:

  • To show/expand the details in the pane:

Related topics:

Customer Care page

Technical support


How to Use the Help

  1. Select the Contents tab.

  2. Click on a folder to display the topics within that folder.

  3. Click on a topic to display it in the main viewer.

You can navigate through the contents by clicking on the desired folder/topic or pressing the Up arrow and Down arrow on your keyboard.

  1. Select the Index tab.

  2. You can:

  3. Browse the index. Select a term from the keyword list, and click Display; OR simply double-click on the term. The selected topic displays in the main viewer.

  4. Search the index. In the Type in the keyword to find field, type in your keyword. Select a term from the keyword list and click Display; OR simply double-click on the term. The selected topic displays in the main viewer.

Note: If more than one topic is associated with the term, the Topics Found dialog box appears. Select the desired topic and click Display; OR simply double-click on the topic name.

Tip: If you do not see your keyword in the index, try a full-text Search, which is described below.

  1. Select the Search tab.

  2. Type the keyword in the Type in the keyword to find field, and then click List Topics. The results appear in the Select Topic to display pane.

Tip: Type "and" between each search term to only find topics that include all the search terms. Type "or" between each search term to find topics that include one term or the other, but not both.

  3. Select the topic name and click Display; OR simply double-click on the topic name. The selected topic displays in the main viewer, with your entered keywords highlighted.

This is an example of drop-down text, which provides additional information on the selected word or phrase.

Click inside a topic in the main viewer (not in the Contents tab), and then press the right mouse button. From the shortcut menu that appears, click Back or Forward.

Either click inside a topic or click on a folder/topic in the Contents tab, and then press the right mouse button. From the shortcut menu that appears, click Print.

Minimize. Click the dash (—) to reduce the Help window to a button on your taskbar.

Maximize/Restore. Click the single square to fill the screen with the Help window. Click the double square to restore the Help window to its previous size.

Exit. Click the X to close the Help window.

Note: The Help system icon (?) on the top, left side of the title bar offers the same options. Click the icon and choose the desired option from the drop-down menu.

  • To resize the window: Place your mouse pointer over a border of the Help window. When the pointer becomes a double-headed arrow, press and hold the left mouse button and move your mouse in the direction you want the border to move. When the border is at the desired location, release the mouse button.

  • To move the window: Place your mouse pointer in the title bar ("Help for iolo Personal Firewall"). Press and hold the left mouse button and move your mouse in the direction you want the Help window to move. When the window is at the desired location, release the mouse button.

Note: The Help system icon on the left side of the title bar offers the same options. Click the icon and choose the desired option from the drop-down menu.

Using the iolo Personal Firewall Help System

To access:

Click Help from the menu bar on top of the application.

- OR-

Click the Help button or icon on any of the windows.

What it does:

This Help system is a resource for learning how to use and configure iolo Personal Firewall. It includes how-to instructions and detailed information about each feature.

Instructions:

This topic describes how to use and navigate the Help system and covers the following:

  • Finding a topic through the Contents, Index, and Search tabs.

  • Saving and accessing frequently used topics on the Favorites tab.

  • Using hyperlinks and drop-down keywords in topics.

  • Navigating between previously-viewed topics with the Back and Forward buttons.

  • Printing topics.

  • Moving, resizing, and closing the Help window.

Find a help topic

To help you quickly get to the information you need, the Help window provides three tabs on the left side of the window: Contents, Index, and Search.

  • Contents – browse through the organized categories and find a topic. Click to view instructions:

  • Index – search by keyword. The index is an alphabetical list of words and phrases that are related to a given topic, but the actual text may or may not be included in the topic. Click to view instructions:

  • Search – search by keyword. The full-text search allows you to search topics for every occurrence of a specific word or phrase. Click to view instructions:

Go back to the top of the topic

Store favorite topics

For help topics that you often refer to, you can save and then quickly access them on the Favorites tab.

  • To add a topic as a favorite: Open the desired topic so that it is displaying in the main viewer. Select the Favorites tab and click Add. The topic's name will display in the Topics pane and is now a favorite.

  • To view a favorite topic: Select it from the Topics pane and click Display or double-click on the topic name to display it in the main viewer.

  • To remove a topic as a favorite: Select it from the Topics pane and click Remove. The topic name will no longer display on the Favorites tab, but the topic is still accessible from the Contents, Index, and Search tabs.

Go back to the top of the topic

Use links in help topics

  • Hyperlinks inside of topics connect related topics together. When you click a hyperlink, you view the related topic. Hyperlinks are indicated with a blue underline (they change color to dark red after you have viewed them).

Some hyperlinks will open pop-up windows, small windows that display in front of the main window. To close a pop-up window, simply click anywhere within the main topic or pop-up window.

  • Drop-down keywords are words or phrases that you click to display additional information below. Click the phrase again to hide the information. Drop-down keywords are indicated in topics with a green underline.

Move between previously-viewed help topics

To navigate between previously-viewed Help topics, click Back or Forward. Click Home to return to the introductory page of this Help system.

Note: You can also move back and forward from the right-click menu.

Go back to the top of the topic

Print help topics

You can print a topic or print all topics within a folder.

  1. Select a topic or a folder.

  • To select a folder, click on it in the Contents pane.

  • To select a topic, either click on it in the Contents pane or click inside the topic in the main viewer.

  2. Click Print. On the Print Topics window, you have two printing options:

  • To print the current topic, select Print the selected topic.

  • To print all of the topics within the selected folder (or all of the topics that are in the same folder as the selected topic), select Print the selected heading and all subtopics.

Note: You can also print from the right-click menu.

Move, resize, and close the Help window

  • The title bar offers the standard Windows buttons: Minimize, Maximize/Restore, and Exit. More information:

  • You can also move and resize the Help window with standard dragging operations.

Go back to the top of the topic

Related topics:

Get more help on the Web

Contact Technical Support


Glossary

A

adware

Adware (ADvertising-supported softWARE) is software that generates advertisements, usually as banner ads or pop-up windows.

Adware is usually bundled with other software and installed without your knowledge. While usually not physically damaging or outright malicious, the intrusive behavior of adware can be annoying and waste system resources.

Go back to the top of the topic

B

buffer

A buffer is used to temporarily hold data before transmitting it. A buffer helps compensate for differences in transfer or processing rates between two systems.

A buffer overflow, or buffer overrun, occurs when more data is put into the buffer than it can handle. This is a common result of Denial of Service attacks.

C

cookie

A cookie is a small text file that some Web sites save to your local, hard drive while you are browsing the site. Cookies contain identifying information, such as log in and shopping cart information.

Cookies are useful for loading Web site preferences and login settings, but they can also contain information that can be passed to others without your knowledge, usually for advertising purposes.

cracking

See hacking/cracking.

Go back to the top of the topic

D

Denial of Service (DoS) attack

A denial of service (DoS) attack is a type of attack that is designed to crash or disable a system by flooding it with useless traffic. A DoS attack can also destroy files.

Common forms of denial of service attacks are buffer overflow attacks and SYN attacks.

digital signature

A digital signature is an electronic stamp of authentication that is often included in distributed software.

The publishers of software use digital signatures to guarantee authenticity and assure recipients that the software comes from them. The cryptographic technology used by a digital signature ensures that the signature cannot be altered.

domain name

A domain name is the text name corresponding to the numeric IP address of a computer on the Internet. Like the IP address, a domain name must be unique. Unlike the IP address, every computer on the Internet does not have to have a domain name.

A domain name has 2 or more parts, separated by dots.

drive-by download

A drive-by download is the automatic downloading of software when you visit a Web site, done without your consent and often without any notice. Drive-by-downloads typically exploit security holes or lowered security settings.

Go back to the top of the topic

E

No glossary terms begin with this letter.

F

firewall

A firewall controls the information passing through an Internet connection. Firewalls keep a computer secure from unauthorized intruders by inspecting traffic and only allowing desired communication through.

A firewall can be software, hardware, or a combination of the two.

FTP

FTP (File Transfer Protocol) is used for exchanging files over the Internet.

Go back to the top of the topic

G

No glossary terms begin with this letter.

H

hacking/cracking

Hacking is an attempt to gain unauthorized access into a computer or network. A person who makes such attempts is a hacker.

While "hacker" was originally used to describe a person highly skilled in computing, it is now more often used to describe a person who uses that skill for illegal or destructive purposes. Some instead use the term "cracking" for the act of breaching computer security with malicious intent.

HTTP (HyperText Transfer Protocol)

HTTP (HyperText Transfer Protocol) is a method used to transfer or convey information on the World Wide Web.

Go back to the top of the topic

I

ICMP (Internet Control Message Protocol)

The Internet Control Message Protocol (ICMP) is used to confirm that two hosts can communicate with each other. It sends informational and error messages between the hosts that are attempting to communicate. This protocol is often used by network administrators for troubleshooting.

IGMP (Internet Group Management Protocol)

The Internet Group Management Protocol (IGMP) support multicasting, which allows one computer on the Internet to send content to multiple other computers. IGMP messages are used by the multicast routers to track group memberships on each of its networks.

Internet

The Internet is a vast network that comprises an immense number of networks using TCP/IP protocols.

Note that the Internet is not synonymous with the World Wide Web. The Web is one of several means (examples of others are FTP and Telnet) for accessing information via the Internet.

Internet Explorer (IE)

Internet Explorer (also "IE") is the Web browser developed by Microsoft. Combined with an Internet connection, it allows you to search for and view information on the World Wide Web. Internet Explorer comes with Windows operating systems and can also be downloaded from Microsoft's Web site.

iolo

The word iolo is not an acronym, as some may believe. "Iolo" is an archaic Welsh name that is actually pronounced "YO-low." However, many people (including us) pronounce it "eye-OH-low." We've also been told that the word iolo means "to vibrate" in the native Hawaiian language.

IP address

An IP (Internet Protocol) address is a unique number that identifies a computer or network on the Internet. Every computer or server connected to the Internet has its own IP address, and each Web site has an IP address.

The IP address is four numbers divided by periods, where each number can range from 0 to 255; for example: 216.239.51.100

See also: domain name

IP subnet mask

An IP subnet mask is a unique number that identifies a portion of a single, host network. The host network has one IP address and each of its subnetworks, or subnets, has its own IP subnet mask.

Like the IP address, the IP subnet number is four numbers divided by periods, where each number can range from 0 to 255.

Example:

IP address: 187.199.127.5

IP subnet mask: 255.255.240.0

Go back to the top of the topic

J

No glossary terms begin with this letter.

K

keylogger

A keylogger, or keystroke logger, is a Trojan that captures all keystrokes and then records that information to a log file.

With a keylogger, a hacker can capture your logins, passwords, credit card numbers, and any other confidential information that you type. Once collected, this information can be silently transmitted to the Trojan’s creator for malicious purposes, such as credit card or bank fraud.

Note: A keylogger can also be a legitimate program that is intentionally and knowingly installed, such as by an employer tracking staff activity.

L

No glossary terms begin with this letter.

Go back to the top of the topic

M

malware

Malware (MALicious softWARE) is a generic term covering a range of software programs that are designed to damage computers or to obtain unauthorized information from computers.

Specific types of malware include viruses, worms, and Trojans.

MB (megabyte)

A megabyte (MB) is a standard unit used to measure the storage capacity of a disk and the amount of computer memory. A megabyte (colloquially, "meg") is equal to approximately one million bytes.

MHz (megahertz)

Megahertz (MHz) is the common measure of the operating speed of a computer's processor. One MHz is equal to one million cycles per second.

The higher the MHz, the better the performance.

Go back to the top of the topic

N

network

A network is a group of computers (two or more) and other devices connected by a communications link. A network enables the computers and devices to interact with each other.

Networks can be small or large, permanently connected through wires or cables, or temporarily connected through phone lines or wireless transmissions.

The largest network is the Internet, which is a worldwide group of networks.

O

operating system

An operating system is the software that controls and manages computer hardware and basic system operations. The operating system loads programs into the computer’s memory, runs these programs, and manages peripherals like disks and printers.

Go back to the top of the topic

P

packet

Information is transmitted across the Internet in packets. A packet bundles information so that it can be routed.

A packet consists of a header (which has information on the source, the destination, and how the packet should be handled) and the actual data being transmitted.

PING

A PING (Packet Internet Groper) is used to test whether a system is reachable on an IP network. It is formally called an ICMP Echo.

The computer making an incoming connection attempt sends an ICMP Echo Request packet to the target computer and waits for a response. If the target system responds with an Echo Reply, then the original system knows that computer is reachable.

port (hardware)

A port is a connection point on a computer that allows you to connect devices that pass data into and out of the computer.

For example, a printer and a modem are connected to a computer through a port. Sample types of ports are parallel, serial, and USB.

port (networking)

A port is an address associated with a program or process on a computer; different applications listen and transmit on different ports. The port number directs packets to the appropriate application.

Ports are assigned to standard protocols such as HTTP and SMTP so that programs know which port to use for a connection. The most well-known port is 80, which transmits HTTP traffic over the World Wide Web.

See Ports for information on designating port settings in iolo Personal Firewall.

protocol

A protocol is a set of standard rules that establish how data is transmitted between computers.

proxy server

A proxy server is a server located on a network between client software and another server.

A proxy server can be used to regulate Internet communications, by inspecting traffic and determining if anything should be denied transmission.

Q

No glossary terms begin with this letter.

Go back to the top of the topic

R

RAM (random access memory)

Random access memory is the working memory of a computer where data is temporarily stored for various processes.

A higher amount of RAM means there is more space available for temporary data storage, which can speed processing.

RAT (remote access Trojan)

A remote access Trojan (RAT) is a malicious software program that gives someone remote access to and control of a computer.

A RAT can capture screen, sound, and video content, and often includes keylogging capabilities. With a RAT, imposters can send e-mail messages that will appear to be from you, modify your documents, and use your PC to attack other computers.

registry

The registry is a database repository that holds configuration files used by your Windows operating system. The registry stores settings about user profiles and preferences; installed software, hardware and drivers; and other data required by the operating system.

Remote Desktop

A Remote Desktop connection gives you access to a computer while you are at another, remote computer (for example, you could connect to your work computer from home). Working remotely, you have mouse and keyboard control over the computer and can access all of the computer's applications, files, and networks.

At a minimum, Remote Desktop functionality requires the proper software and access through the firewall.

router

A router is a networking device that forwards packets across a network to their destinations. A router acts as a junction between two or more networks to transfer data packets among them.

Go back to the top of the topic

S

server

A server is a computer that delivers information and software to other computers linked by a network.

Servers come in many forms; for example: application servers, Web servers, database servers, and mail servers.

spyware

Spyware is tracking software that is installed on your computer without your notice or consent. It sends information about your computing activities back to its source, usually for advertising purposes, but sometimes for more dangerous purposes such as identity theft or credit card fraud.

The effect of spyware varies depending on what its creator's intentions are and can include consumption of valuable system resources, random lockups, crashes, or slowdowns; Web browser Home page or search page redirection; unwanted software installation; and incessant pop-up ads.

SYN

SYN is a packet used to synchronize sequence numbers on two connecting computers. A SYN packet is sent when a computer is attempting to connect to a remote computer; the SYN is acknowledged by a SYN/ACK packet sent by the responding computer.

system tray

The system tray is located in the Windows taskbar (usually at the bottom of the screen, next to the clock) and contains icons that allow easy access to system functions.

Go back to the top of the topic

T

taskbar

The taskbar contains the Windows Start button, buttons for every open application, and the system tray.

The taskbar generally appears on the bottom of your computer screen, but it can be dragged to either side of the screen or the top of the screen.

TCP

The TCP (Transmission Control Protocol) converts data messages generated by an application into packets that can be sent over the IP protocol.

Unlike UDP, TCP is a connection-oriented protocol. TCP guarantees delivery of data and also guarantees that packets are delivered in the same order in which they were sent.

TCP/IP

TCP/IP (Transmission Control Protocol/Internet Protocol) is a suite of protocols that form the foundation of Internet communication. It is a standard for transmitting data over networks and enabling communication between a variety of systems.

Trojan/Trojan horse

A Trojan, or Trojan horse, is a software program that appears to be desirable or useful, but intentionally does something you do not expect.

The effects of Trojans can range from simply displaying pop-up ads to destroying files or enabling the theft of data.

Trojans are distributed in executable files, such as through email attachments, CDs, and Internet downloads. People can be lured into installing a Trojan because it appears that it will serve a legitimate purpose. Unlike viruses and worms, a Trojan is not designed to make automatic copies of itself. However, Trojans can carry viruses and other malicious software within them.

Some specific types of Trojans include keyloggers and RATs.

trusted publisher

A trusted publisher is a software manufacturer or distributor that you have designated as trusted on the Manage Trusted Publishers window.

When adding a trusted publisher, you can choose from any of the publishers that have digitally-signed programs and files on your computer.

Go back to the top of the topic

U

UDP

The UDP (User Datagram Protocol) converts data messages generated by an application into packets that can be sent over networks.

Unlike TCP, UDP is a connection-less protocol. It does not verify that a connection has been established with the receiving system.

UDP is often used for streaming video and audio.

Go back to the top of the topic

V

virus

A computer virus is a software program designed to alter the operation of a computer.

Most viruses are malicious and intended to cause damage, but even a benign virus can harm a system. Viruses can damage files, software programs, the registry, and hardware.

Viruses are distributed in executable files, such as through email attachments, CDs, and Internet downloads. A virus infection occurs when the infected file is run. A virus also automatically replicates, or makes copies of itself, by secretly embedding its programming code into other programs.

The term "virus" is often used as a generic, collective reference that includes other types of malicious programs, such as worms and Trojans.

Go back to the top of the topic

W

Windows Explorer

Windows Explorer (also "Explorer") displays a hierarchical view of the drives, folders, and files on your computer. Using Windows Explorer, you can open, copy, move, rename, and search for files and folders. Windows Explorer is an application that is part of Windows operating systems.

World Wide Web (Web)

The World Wide Web, or simply "Web", is the largest and most commonly used network on the Internet. The Web uses the HTTP protocol to transmit Web pages and other information.

Note that the World Wide Web is not synonymous with the Internet. The Web is one of several means for accessing information via the Internet.

worm

A computer worm is a software program designed to reproduce and spread among computers.

Most worms are malicious and intended to overwhelm system memory or network bandwidth. Worms can crash an entire network of computers or an individual computer.

Worms are generally distributed in email attachments or through unprotected Internet activity. A worm spreads very rapidly because it is self-contained. It replicates itself and, unlike viruses, a worm does not need to infect another program to spread.

Go back to the top of the topic

X

No glossary terms begin with this letter.

Y

No glossary terms begin with this letter.

Z

zombie

A zombie is computer that has had its security compromised and is remotely controlled, such as by a RAT.


FAQs

When you first install iolo Personal Firewall, you may see several prompts as you access programs that involve Internet communication.

If you trust the program, simply click Allow always and you will no longer see a prompt for that particular communication.

The selections you make on the "Allow Access?" prompts give the firewall information on your Internet preferences and allow you to easily configure the firewall on demand.

As you configure the firewall, you will see less and less messages for the programs that you use and trust, while still remaining protected from unknown or malicious software.

More on Allow Access? prompts.

You can turn off prompts in one of two ways:

  • The next time the Allow Access? prompt displays, select the Activate default program permissions check box.

  • On the iolo Personal Firewall Home page, click Settings from the menu bar to open the Settings window. Under the Firewall options section, select the Do not show prompts - automatically use default program permissions option.

Prompts will no longer display for any programs. Programs will either be blocked or allowed, as set up in default program permissions.

Note: To turn prompts back on, select the Show prompts - only use default program permission after [X] seconds option on the Settings window.

Read more information about program controls.

You can turn off informational notices in one of two ways:

  • The next time the Communication Blocked window displays, select the Don't show these messages anymore check box and click OK.

  • On the iolo Personal Firewall Home page, click Settings from the menu bar to open the Settings window. Clear the Display informational firewall notices check box.

Note: To turn notices back on, select the Display informational firewall notices check box on the Settings window.

  1. From the Program Policies pane, click Manage policies to open the Manage Program Policies window.

  2. For the applicable program policy, clear the Prompt me if this program is modified check box.

To designate a computer or Web site as trusted, add it to the Trusted Zone.

  1. Go to the Zone Security pane.

  2. Toward the bottom of the pane is a Manage Trusted Zone members button. Click this button to open the Manage Zone Members window.

From this window, you can add computers and sites to the Trusted Zone in several ways: by IP address, by domain name, by recently visited Web sites, and more.

Refer to Designating Zone Membership for detailed instructions.

Certain ports must be open for routine Internet communication, but an open port can be a potential entrance for an attacker.

The dangers posed by an open port could range anywhere from leaking information about your computer to a Denial of Service attack that crashes your system.

It is recommended you open only the ports you need.

See Ports - Overview for more information on opening and closing ports.

The control of ports is part of Zone Security, so is specific to a given Zone.

See Ports - Overview for more information on opening and closing ports.

The following applications typically use these TCP ports:

  • MSN Messenger - port 1863

  • AOL Instant Messenger - port range 5190-5193

  • Yahoo! Instant Messenger - port 5050

  • Internet Relay Chat (IRC) - port range 6665-6669

The Real Time Streaming Protocol (RTSP) is used by applications like RealAudio and Windows Media Player to deliver audio-visual content.

RTSP typically uses these TCP ports: 554 and 7070.

For downloading and sharing music in Apple's iTunes, the following ports are typically used:

  • TCP port 3689

  • UDP port 5353

To automatically allow connectivity for iTunes, you can select the I use Apple iTunes to purchase or manage music and video check box on the Setup Wizard's PC Usage tab.

NetMeeting uses several ports to allow communication with meeting participants.

  • The following TCP ports: 522, 389, 1503, 1720 and 1731

  • UDP port range 1024-65536

Source: http://support.microsoft.com/kb/q158623/

Do one of the following:

  • From the Setup Wizard's PC Usage tab, select the I use America Online when connecting to the Internet check box; or

  • From the Setting window's General tab, select the Allow America Online® connections check box.

Do one of the following:

  • From the Setup Wizard's PC Usage tab, select the I use Apple iTunes to purchase or manage music and video check box; or

  • From the Setting window's General tab, select the Allow iTunes® connections check box.

Do one of the following:

  • From the Setup Wizard's PC Usage tab, select the I use Skype to make Internet phone calls check box.

  • From the Setting window's General tab, select the Allow Skype® connections check box.

Do one of the following:

  • From the Setup Wizard's PC Usage tab, select the I play World of Warcraft online check box.

  • From the Setting window's General tab, select the Allow World of Warcraft® connections check box.

Do one of the following:

  • From the Setup Wizard's PC Usage tab, select the I connect to a Microsoft Exchange server for mail or other services check box.

  • From the Setting window's General tab, select the Allow Microsoft Exchange® connections check box.

Remote Desktop controls are provided on both the Setup Wizard's PC Usage tab and the Setting window's General tab.

These controls determine whether Remote Desktop connections are allowed through the firewall. In addition to controlling the port for the Remote Desktop Protocol (TCP port 3389), the check boxes control other system settings that are part of this functionality.

Do one of the following:

From the Setup Wizards PC Usage tab...

Select one or both of the following check boxes:

  • Select I connect to this computer using Remote Desktop software to automatically allow a Remote desktop connection to this computer.

  • Select I connect to other computers using Remote Desktop software to automatically allow a Remote desktop connection from this computer to another, remote computer (for example, you connect to your work computer from home).

From the Settings window's General tab...

Select one of both of the following check boxes:

  • Select the Allow Incoming check box to automatically allow incoming Remote Desktop connections to this computer.

  • Select the Allow Outgoing check box to automatically allow outgoing Remote Desktop connections from this computer to another, remote computer.

As a default, the Allow Outgoing check box is selected.

Click here for more information on how Remote Desktop communications work with Zone port settings.

For Remote Desktop communications, the settings made here will override the Zone port settings for the defined port 3389; however, for other types of communication that may attempt access through port 3389, the Zone settings will still apply. In other words:

  • By allowing Remote Desktop connections here, you are opening port 3389 to Remote Desktop communication. But for other types of communication, whatever you have set for port 3389 in the applicable Zone will apply, whether that is to block or allow traffic.

  • By blocking Remote Desktop connections here, you are closing port 3389 to Remote Desktop communication. But for other types of communication, whatever you have set for port 3389 in the applicable Zone will apply, whether that is to block or allow traffic.

For example, assume that you have the Allow Incoming check box cleared to block incoming Remote Desktop connections. If you have a Zone set to open port 3389 to incoming communication, the port will be blocked to incoming Remote Desktop communication, but will be open to other types of incoming communication.

From the Setup Wizard's PC Usage tab, select the I use this computer to share files, folders, or printers with other computers in a network check box.

If you had previously blocked Network Activity and then re-enabled it, a currently open Web browser will still have its access blocked.

To access the Web, close the Web browser and then re-open it.

There is no cost. Email support, telephone support, and Web support are all unlimited and free.

Frequently Asked Questions

Firewall Messages

Why do I keep seeing "Allow Access?" prompts?

How do I turn off "Allow Access?" prompts?

How do I turn off "Communication Blocked" notices?

How do I turn off "Keep Program Policy?" prompts?

Zone Security - Basics

How do I designate a computer or Web site as trusted?

Why should I close some ports?

How do I close or open ports?

Zone Security - Custom Ports

If you are designating custom port settings, the following show the ports used by some popular applications.

What ports are used for...

Instant messaging/IRC?

Streaming media, like Windows Media Player?

iTunes?

Microsoft NetMeeting?

Note: The most reliable way to determine the ports used by a program is to contact the product vendor or refer to that product's documentation.

Communication for Specific Features and Programs

The PC Usage tab of the Setup Wizard and the General tab of the Settings window allow you to enable communications for certain features and third party tools you may use on your computer.

How can I enable communications for...

America Online® (AOL)

iTunes?

Skype?

World of Warcraft?

Microsoft Exchange server?

Remote Desktop?

Sharing of files, folders, or printers over a network?

Network Activity

I just enabled Network Activity. Why is my Web access not enabled?

General Product Questions

What is the cost of technical support?


Flowchart of iolo Personal Firewall

See also: Basic Steps for Configuring the Firewall

The below diagram shows the process that iolo Personal Firewall follows to control Internet communication.

(Maximize this Help window to view the entire graphic.)

Note: The graphic can be viewed within the application by clicking the How does a firewall work? link on the bottom, right side of the Home page. To return to the Home page, click the Home icon on the left side of the menu bar.

Within the below diagram, you can click on an image to jump to a related Help topic.


Computer Security Tips

  • Install a firewall

A firewall provides a barrier against hacking and other unauthorized access, while still allowing desired communication to pass through.

When choosing a firewall, some features to look for include ease-of-use, flexible configurations, monitoring features, and product support.

  • Install antivirus software

Antivirus software blocks viruses, and detects and removes existing viruses that are on your computer.

When choosing an antivirus tool, some features to consider include the frequency of virus definition updates, the amount of system resources used by the software, and the availability and cost of product support.

  • Keep security patches up to date

Many malicious applications exploit known security holes in operating systems and browsers. Install the latest security patches for your operating system and browser.

Software vendors often also provide security patches for their products. Regularly check with the manufacturers of your software to see if security patches are available.

  • Create strong passwords

Create passwords that are difficult for others to guess or to decode using cracking tools.

– Use 8 or more characters.

– Mix letters (uppercase and lowercase), numbers, and symbols.

– Avoid sequences of numbers or repeated characters.

– Use different passwords for every program and Web site.

– Change passwords regularly.

  • Keep your passwords secret

Safeguard your passwords.

– Do not reveal your passwords to anyone.

– Do not respond to an e-mail message that requests your password or requests verification of your password. Responsible companies don't use e-mail to ask customers for this information.

– On public computers that you don't control, such as in Internet cafes and airport lounges, do not access information that requires a password.

  • Only download trusted programs

Only download programs from trusted Web sites, or refer to a trusted source for information prior to downloading. Do not install software if you are unsure about it.

  • Be cautious of free applications

Some free programs (such as screen savers, games, customized toolbars, and peer-to-peer file sharing software) are often bundled with spyware and adware. Be sure you understand all of the software packaged with an application.

  • Read the fine print

Prior to installation, read any disclosures, such as a license agreement or privacy statement. Sometimes indication of the inclusion of unwanted software is concealed in the fine print of these documents.

  • Backup important files

Have a backup of your drives available, before disaster strikes. Establish a schedule for regular backups and keep them in a safe place.


iolo Contact Information

Mailing Address

iolo technologies, LLC

7470 North Figueroa Street

Los Angeles, CA 90041

(Our offices are not equipped to process walk-in sales or support.)

Web site

www.iolo.com

Technical Support

Email Submission Form: www.iolo.com/customercare/technicalsupport.aspx

Customer Service (General Inquiries/Sales)

Email Submission Form: www.iolo.com/customercare/customerservice.aspx

Phone/Fax

Refer to iolo's contact page for phone and fax information.

Related topics:

Online resources


Technical Support

The Technical Support department handles technical, product-related inquiries. Please also feel free to browse the online Knowledge Base for the fastest answers to your questions.

All technical support is free and unlimited.

Online Contact: www.iolo.com/customercare/technicalsupport.aspx

Related topics:

Other contact information

Web support


Register with iolo

Register iolo Personal Firewall

To access:

Click here to open the Registration page in your Web browser, and then follow the on-screen instructions.

What it does:

Online registration of your software:

  • Puts your licensing information on file. This can expedite technical support inquiries, and if your licensing information is ever misplaced, we can retrieve it for you.

  • Entitles you to notifications about product upgrades.

  • Entitles you to discount promotional offers for all iolo products.

Note: During registration, you can opt out of receiving email announcements.

Related topics:

Customer Care/Web support


About iolo

About Us

iolo technologies, LLC produces award-winning utility software that optimizes and protects computers running Microsoft Windows.

Located in Los Angeles, iolo is recognized around the globe for providing comprehensive and effective solutions that meet a wide range of computer maintenance needs.

iolo has established itself as a leader in the competitive utility software market, receiving awards from industry analysts and media, year after year. Today, millions of people trust iolo’s products to diagnose and repair computer problems, boost PC speed and performance, safeguard and recover critical data, protect against viruses and identity theft, and more.

iolo's products are carried in over 13,000 retail stores, including Wal-Mart, Target, Staples, Office Depot, and Best Buy. Our software can also be purchased from major online retailers, by mail order, and from a multitude of resellers in the U.S. and abroad.

Related topics:

Contact iolo

Purchase iolo Products


iolo products have earned recognition from Consumer Digest (Best Buy), PC World, PC Magazine, ZDNet, CNet, Computer Shopper, Download.com, PC Upgrade, Home Office Computing, SnapFiles, and Windows Magazine (WinMag).

Purchase iolo Products

iolo offers a range of solutions to optimize and protect computers running Microsoft Windows. The iolo product line includes System Mechanic, System Mechanic Professional, System Shield, iolo Personal Firewall, iolo AntiVirus, Search and Recover, DriveScrubber, and Macro Magic.

iolo is a leader in the competitive utility software market, receiving "Editor’s Choice" and "Best of the Year" awards from industry analysts and media, year after year.

In addition to the many retailers that carry iolo's products, you can purchase products through our Web site or by phone:

  • Visit www.iolo.com/purchase.cfm to purchase iolo products over a secure online ordering system. You can also view detailed product information on this page.

  • To purchase products by phone, call 1-877-239-4656 or 323-257-8888. (Hours: 8 A.M. - 5 P.M. Pacific Time, Monday through Friday)

Overview of Product Line

System Mechanic Professional. System Mechanic Professional has all the tools you need to defend against Internet threats, diagnose PC health, fix errors, boost performance, eliminate crashes, and much more. This award-winning suite incorporates 5 products into one integrated package that will keep your PC safe and running in peak condition. In addition to offering over 30 repairs and optimizations, it has built-in Internet security, secure data deletion, and data recovery.

System Mechanic. System Mechanic breathes new life into old PCs and keeps new ones running as they should. System clutter, performance drains, insufficient security, and corrupted settings can all degrade a PC's operation. Instead of buying dozens of individual products, use System Mechanic to remedy all these issues and more. Over 30 tools work together to diagnose PC health, optimize settings, repair problems, clean out clutter, and protect against Web threats.

System Shield. System Shield™ 3 Internet Security provides complete Web security from one interface. This security suite includes: iolo AntiVirus, iolo Personal Firewall, Spython™ to eradicate spyware, System Guard™ to stop malicious programs from changing system settings, and a Security Optimizer to repair security flaws.

iolo Personal Firewall. iolo Personal Firewall™ puts up a barrier to block hackers, identity thieves, system attacks, and other Internet hazards. The IntelliDefense™ feature uses threat-assessment technology to make informed decisions and display fewer messages.

iolo AntiVirus. iolo AntiVirus™ detects, blocks, and removes computer viruses and other malicious infections. With continual real-time protection and hourly updates, you can guard your PC, shield your critical data from theft and damage, and protect your privacy.

Search and Recover. With Search and Recover™, you can reclaim deleted documents, pictures, email messages, and more, from your hard drive, digital camera, music player, USB flash drive, or any other device. Bonus security tools include drive imaging, a powerful solution to creating complete backups of your data.

DriveScrubber. Use DriveScrubber® to securely wipe away data left on your hard drives or floppy disks before donating, reselling, or recycling your computer. As an added benefit, DriveScrubber can also wipe just the free space of your drive, permanently removing remnants of deleted files while keeping existing files intact.

Macro Magic. How many of the same, repetitive tasks do you do each day on your PC? Use Macro Magic to record those procedures once and run them instantly whenever you want.

What do I get when I purchase?

  • Free, unlimited access to technical support.

  • Free Web updates, which include minor upgrades and patches.

  • Notifications and discounts on all major upgrades.

  • Great software created by people dedicated to providing quality products.


Purchase Firewall - For Subscription Users

Purchase iolo Personal Firewall

If you are using the evaluation version, you can buy a licensed copy of iolo Personal Firewall and have unlimited use in minutes.

Click Purchase Now from the Evaluation toolbar or from any Evaluation notification window. You can view price and product information and then securely purchase online or by phone.

After purchase, you will receive license information that will change your current evaluation copy into a licensed version. Click Enter License and then enter your User ID and Serial number.

You can also purchase a license by:

  • Visiting www.iolo.com/purchase.cfm

  • Calling 1-877-239-4656 or 323-257-8888 (Hours: 8 AM - 5 PM Pacific Time, Monday to Friday)

What do I get when I purchase?

  • Free and unlimited email support, telephone support, and Web support.

  • Free Web updates, which include minor upgrades and patches.

  • Notifications and discounts on all major upgrades.

  • Great software created by people dedicated to providing quality products.

Related topics:

Purchase other iolo products


For the desired Zone, select the Turn on security and block all inbound and outbound access option. All the computers in the Zone will have neither incoming nor outgoing access.

The status box at the top of the pane will display a Block All message:

The security for the X Zone is Block All

...where X Zone is either the Internet Zone or the Trusted Zone.

Locked Zone

A Zone is locked if:

  • You have blocked all incoming and outgoing access for computers in the Zone.

  • Idle lock is enabled and you have not moved the mouse/pointing device or used the keyboard for more than 30 minutes (or another time, if you changed the default).

Note: To enable Idle lock, you must be using the Custom security level for the Zone.

A locked Zone does not allow any communication in or out – unless the program attempting communication has a program policy with the "Bypass locked zone" option enabled.

Any use of the keyboard or mouse/pointing device immediately unlocks a locked Zone.

When one or both Zones are locked, the iolo Personal Firewall icon is yellow [image].

Related topics:

Overview of Zones

Designating security for a Zone

Enable Idle Lock or change specified time

Firewall icon


Sample Pop-up Window

Sample Hyperlink

This is an example of a hyperlinked topic.


Ports

Ports - Overview

Certain ports must be open for routine Internet communication, but an open port can also be a potential entrance for an attacker. It is recommended you open only the ports you need.

The control of ports is part of Zone security, so is specific to a given Zone.

The Defined Ports tab in Zone security controls which standard ports are open to incoming and outgoing traffic. Any port not defined on the Defined Ports is closed. To define additional ports, use Custom level security and then create your own port rules on the Custom Ports tab.

Click a link below to view the port settings for each Zone security level:

  • Low level - Defined Ports Tab

  • Medium level - Defined Ports Tab

  • High level - Defined Ports Tab

  • Custom level - Defined Ports Tab

  • You can define additional ports in Custom level - Custom Ports.

Related topics:

Zone Security - Overview

Security Level - Low

Security Level - Medium

Security Level - High

Security Level - Custom