To all the Zone Alarm 'victims' out there...

Based on loosely recorded statistics in regards to many of the online connectivity troubleshooting I do at Relay. It has come to my attention that indeed 85-90% of all connectivity problems are caused by that crippleware package called Zone Alarm. I really don't like this program for a long list of reasons (technical, fundamental, and logistical), but I can certainly understand why it is so popular. I guess the fact that it "locks your system down from outsiders" and does so in a Lite Version that is available for free is incentive enough. Although, in the process it locks the outside world out for you too, with limited control over what can and can't be accessed (both directions), and packaged in a fumbling and limited popup-dialog-based Interface. I'm not going to get into the "Finer Details of Firewall Logistics" with you. Rather, I wish to point you to a package that resembles Zone Alarm in a number of ways, but simply outperforms Zone Alarm hands down. If the "Zone Alarm type" is your cup of tea, you might be wise to investigate Tiny Software's Firewall Software called "Personal Firewall". You can get a fully functional (with no "buy me for more necessary features" traps), and how it is laid out is similar in design to ZA. Basically it is Zone Alarm Pro for free (and a few more *necessary* features to boot). You will then be able to quickly, efficiently, and intuitively open/close ports on your firewall in any manner you choose. You can even "pause it" at will with the click of a button, and actually have it pause/suspend (unlike ZA). It will also popup alerts/auth-requests just like ZA if you happened to miss a few, or the other prog has some backend requesting going on. I am confident that you will find it outperforms and outclasses even Zone Alarm Pro. You might also want to check out Tiny's Winroute if you connect through a proxy server and currently using Sygate or <GASP> Win ICS. That package also outclasses the others in its field. No I don't work for the company or have any relationship with them. They just build good/intuitive/functional software, which is something I can appreciate. The price isn't bad neither! Cheers, Schumi

On Fri, 23 Nov 2001 09:02:10 GMT, "Schumi" <[email hidden]> wrote: >Alarm type" is your cup of tea, you might be wise to investigate Tiny >Software's Firewall Software called "Personal Firewall". You can get a fully >functional (with no "buy me for more necessary features" traps), and how it i second the above suggestion 100%. Tiny also make an excellent webserver for debugging cgi's, but thats another story. good firewall. especially since symantec bought @tguard and messed it up. Regards all, istoff

Agreed. Tiny Firewall is great. One of the few f/w's behind which you can host a VROC race, NP. "Schumi" <[email hidden]> wrote in message news:mgoL7.59781$[email hidden]... > Based on loosely recorded statistics in regards to many of the online > connectivity troubleshooting I do at Relay. It has come to my attentionthat

Quoted text (8 lines)

> indeed 85-90% of all connectivity problems are caused by that crippleware > package called Zone Alarm. > > I really don't like this program for a long list of reasons (technical, > fundamental, and logistical), but I can certainly understand why it is so > popular. > > I guess the fact that it "locks your system down from outsiders" and does

so > in a Lite Version that is available for free is incentive enough.Although, > in the process it locks the outside world out for you too, with limited > control over what can and can't be accessed (both directions), andpackaged > in a fumbling and limited popup-dialog-based Interface. > > I'm not going to get into the "Finer Details of Firewall Logistics" with > you. Rather, I wish to point you to a package that resembles Zone Alarm ina > number of ways, but simply outperforms Zone Alarm hands down. If the "Zone > Alarm type" is your cup of tea, you might be wise to investigate Tiny > Software's Firewall Software called "Personal Firewall". You can get afully > functional (with no "buy me for more necessary features" traps), and howit > is laid out is similar in design to ZA. Basically it is Zone Alarm Pro for > free (and a few more *necessary* features to boot). > > You will then be able to quickly, efficiently, and intuitively open/close > ports on your firewall in any manner you choose. You can even "pause it"at > will with the click of a button, and actually have it pause/suspend(unlike > ZA). It will also popup alerts/auth-requests just like ZA if you happenedto

Quoted text (7 lines)

> miss a few, or the other prog has some backend requesting going on. > > I am confident that you will find it outperforms and outclasses even Zone > Alarm Pro. > > You might also want to check out Tiny's Winroute if you connect through a > proxy server and currently using Sygate or <GASP> Win ICS. That package

also

Quoted text (10 lines)

> outclasses the others in its field. > > No I don't work for the company or have any relationship with them. They > just build good/intuitive/functional software, which is something I can > appreciate. The price isn't bad neither! > > Cheers, > Schumi > >

"istoff" <[email hidden]> wrote in message news:[email hidden]... > >Alarm type" is your cup of tea, you might be wise to investigate Tiny > >Software's Firewall Software called "Personal Firewall". You can get afully > >functional (with no "buy me for more necessary features" traps), and howit > good firewall. especially since symantec bought @tguard and messed it > up. Well, when I last checked( it can have changed since) it didn't support Internet connection Sharing, and that makes it pretty useless for me. I have ZoneAlarm at present, but don't like it very much, and i have to shut it down, when I play oon vroc, since it often freezes GPL when I go to the pits via the escape button. :(. Any suggestions velcome, but they have to support ICS, and of course GPL and Vroc. But Zoen Alarm comes highly recommended in almost all test of free firewalls for personal use. I have consider buying EZArmor, with both anti virus and personal Firewall, any comments/recomendations on that one? Joakim

OK. I'm interested. But, where do I find/download this little gem? Schumi wrote:

Quoted text (43 lines)

> Based on loosely recorded statistics in regards to many of the online > connectivity troubleshooting I do at Relay. It has come to my attention that > indeed 85-90% of all connectivity problems are caused by that crippleware > package called Zone Alarm. > > I really don't like this program for a long list of reasons (technical, > fundamental, and logistical), but I can certainly understand why it is so > popular. > > I guess the fact that it "locks your system down from outsiders" and does so > in a Lite Version that is available for free is incentive enough. Although, > in the process it locks the outside world out for you too, with limited > control over what can and can't be accessed (both directions), and packaged > in a fumbling and limited popup-dialog-based Interface. > > I'm not going to get into the "Finer Details of Firewall Logistics" with > you. Rather, I wish to point you to a package that resembles Zone Alarm in a > number of ways, but simply outperforms Zone Alarm hands down. If the "Zone > Alarm type" is your cup of tea, you might be wise to investigate Tiny > Software's Firewall Software called "Personal Firewall". You can get a fully > functional (with no "buy me for more necessary features" traps), and how it > is laid out is similar in design to ZA. Basically it is Zone Alarm Pro for > free (and a few more *necessary* features to boot). > > You will then be able to quickly, efficiently, and intuitively open/close > ports on your firewall in any manner you choose. You can even "pause it" at > will with the click of a button, and actually have it pause/suspend (unlike > ZA). It will also popup alerts/auth-requests just like ZA if you happened to > miss a few, or the other prog has some backend requesting going on. > > I am confident that you will find it outperforms and outclasses even Zone > Alarm Pro. > > You might also want to check out Tiny's Winroute if you connect through a > proxy server and currently using Sygate or <GASP> Win ICS. That package also > outclasses the others in its field. > > No I don't work for the company or have any relationship with them. They > just build good/intuitive/functional software, which is something I can > appreciate. The price isn't bad neither! > > Cheers, > Schumi

-- Bert

"Joakim Lauridsen" wrote ... > Well, when I last checked( it can have changed since) it didn't support > Internet connection Sharing, and that makes it pretty useless for me. Are we talking about Tiny here? And when you say "didn't support Internet connection Sharing", what does that mean?

"Schumi" <[email hidden]> wrote in message news:mgoL7.59781$[email hidden]... > Based on loosely recorded statistics in regards to many of the online > connectivity troubleshooting I do at Relay. It has come to my attentionthat > indeed 85-90% of all connectivity problems are caused by that crippleware > package called Zone Alarm. As a computer security consultant, I can completely agree with this. I used to run Zone Alarm, but given the number of problems I had trying to get it to run WITH games, I dropped it. That, and the fact that recent developments in the comp security world has proved that Zone Alarm is not invulnerable to attack, either...in fact, they've kind've been the target since so many people touted them so highly. The problem with Zone Alarm is that is does NOT do what you want it to...if you tell it to leave open port for access, it does not leave them open. As well, you can perform a scan on a computer running Zone Alarm, and it will still have ports open. I've had a computer that was running Zone Alarm, and it would not allow it to access the network because the netbios ports were hindered, yet I issued it a remote shutdown from a remote access utility. Tiny does exactly what you tell it to do, and I think it's a better product for gamers. Cheers! Jan Kohl The Pits - http://www.theuspits.com

http://www.tinysoftware.com Sorry, I missed that :) Cheers, Schumi

For cable or DSL connections, the little NAT firewall appliances are getting very cheap these days (for what you get.) I've seen them for 70.00 or less. It's kind of nice not to install additional software for security and I can play and host games behind the firewall with no problems...... "Schumi" <[email hidden]> wrote in message news:mgoL7.59781$[email hidden]... > Based on loosely recorded statistics in regards to many of the online > connectivity troubleshooting I do at Relay. It has come to my attentionthat

Quoted text (8 lines)

> indeed 85-90% of all connectivity problems are caused by that crippleware > package called Zone Alarm. > > I really don't like this program for a long list of reasons (technical, > fundamental, and logistical), but I can certainly understand why it is so > popular. > > I guess the fact that it "locks your system down from outsiders" and does

so > in a Lite Version that is available for free is incentive enough.Although, > in the process it locks the outside world out for you too, with limited > control over what can and can't be accessed (both directions), andpackaged > in a fumbling and limited popup-dialog-based Interface. > > I'm not going to get into the "Finer Details of Firewall Logistics" with > you. Rather, I wish to point you to a package that resembles Zone Alarm ina > number of ways, but simply outperforms Zone Alarm hands down. If the "Zone > Alarm type" is your cup of tea, you might be wise to investigate Tiny > Software's Firewall Software called "Personal Firewall". You can get afully > functional (with no "buy me for more necessary features" traps), and howit > is laid out is similar in design to ZA. Basically it is Zone Alarm Pro for > free (and a few more *necessary* features to boot). > > You will then be able to quickly, efficiently, and intuitively open/close > ports on your firewall in any manner you choose. You can even "pause it"at > will with the click of a button, and actually have it pause/suspend(unlike > ZA). It will also popup alerts/auth-requests just like ZA if you happenedto

Quoted text (7 lines)

> miss a few, or the other prog has some backend requesting going on. > > I am confident that you will find it outperforms and outclasses even Zone > Alarm Pro. > > You might also want to check out Tiny's Winroute if you connect through a > proxy server and currently using Sygate or <GASP> Win ICS. That package

also

Quoted text (10 lines)

> outclasses the others in its field. > > No I don't work for the company or have any relationship with them. They > just build good/intuitive/functional software, which is something I can > appreciate. The price isn't bad neither! > > Cheers, > Schumi > >

Do you mean "NAT Routers". Like Linksys, etc.? If so... they have limited memory capabilities, so mapping ports will reach a maximum. Which is something to be concerned about if you play more than 1 game on different ports, or the game uses a broad-spectrum port range. The only alternative left with many of them is to assign your Gamebox as the DMZ... which basically forwards all ports not listed in the Port Mapping table to your gamebox... which in turn means that your NAT security (which is of little consolation) is null & void. But we may be talking about different things. Cheers, Schumi "JoeZ" <[email hidden]> wrote in message news:yEwL7.53$[email hidden]... > For cable or DSL connections, the little NAT firewall appliances aregetting > very cheap these days (for what you get.) I've seen them for 70.00 orless. > > It's kind of nice not to install additional software for security and Ican

Quoted text (9 lines)

> play and > host games behind the firewall with no problems...... > > "Schumi" <[email hidden]> wrote in message > news:mgoL7.59781$[email hidden]... > > Based on loosely recorded statistics in regards to many of the online > > connectivity troubleshooting I do at Relay. It has come to my attention > that > > indeed 85-90% of all connectivity problems are caused by that

crippleware > > package called Zone Alarm. > > > > I really don't like this program for a long list of reasons (technical, > > fundamental, and logistical), but I can certainly understand why it isso > > popular. > > > > I guess the fact that it "locks your system down from outsiders" anddoes

Quoted text (10 lines)

> so > > in a Lite Version that is available for free is incentive enough. > Although, > > in the process it locks the outside world out for you too, with limited > > control over what can and can't be accessed (both directions), and > packaged > > in a fumbling and limited popup-dialog-based Interface. > > > > I'm not going to get into the "Finer Details of Firewall Logistics" with > > you. Rather, I wish to point you to a package that resembles Zone Alarm

in > a > > number of ways, but simply outperforms Zone Alarm hands down. If the"Zone > > Alarm type" is your cup of tea, you might be wise to investigate Tiny > > Software's Firewall Software called "Personal Firewall". You can get a > fully > > functional (with no "buy me for more necessary features" traps), and how > it > > is laid out is similar in design to ZA. Basically it is Zone Alarm Profor > > free (and a few more *necessary* features to boot). > > > > You will then be able to quickly, efficiently, and intuitivelyopen/close > > ports on your firewall in any manner you choose. You can even "pause it" > at > > will with the click of a button, and actually have it pause/suspend > (unlike > > ZA). It will also popup alerts/auth-requests just like ZA if youhappened > to > > miss a few, or the other prog has some backend requesting going on. > > > > I am confident that you will find it outperforms and outclasses evenZone > > Alarm Pro. > > > > You might also want to check out Tiny's Winroute if you connect througha

Quoted text (14 lines)

> > proxy server and currently using Sygate or <GASP> Win ICS. That package > also > > outclasses the others in its field. > > > > No I don't work for the company or have any relationship with them. They > > just build good/intuitive/functional software, which is something I can > > appreciate. The price isn't bad neither! > > > > Cheers, > > Schumi > > > > > >

OK, I downloaded it, installed it, and set it all up. Seems nice an easy, and I guess that the popups will stop eventually. I am routing through it using AnalogX Proxy software, so, how do I tell it to open a port and let me play a game (say, NFS PU) through it? Tsunami

How do you open the ports on the firewall, or forward them on the Proxy? Which one are you talking about? If it is firewall... click on "Advanced" Button next to the "Security level slider". There will be a list of all your rules (which prog can access in/out through which ports unhindered). Add a new one... xselect "Any Program" fromt he program selection, and map both UDP/TCP ports UP/DOWN that NFSPU or whatever game you're planning to play, uses. Then you have opened the ports, and Bob's your uncle. If you are asking about your Proxy Soft. I would suggest looking at your documentation (I don't know about that soft). Look for "Port Mapping" and "forward" those same ports as above for firewall... and forward them TCP/UDP UP/DOWN to your gamebox. Hope that helps. Cheers, Schumi

[email hidden] (Schumi) wrote in <Q5zL7.60870$[email hidden]>:

Quoted text (12 lines)

>Do you mean "NAT Routers". Like Linksys, etc.? > >If so... they have limited memory capabilities, so mapping ports will reach >a maximum. Which is something to be concerned about if you play more than 1 >game on different ports, or the game uses a broad-spectrum port range. > >The only alternative left with many of them is to assign your Gamebox as the >DMZ... which basically forwards all ports not listed in the Port Mapping >table to your gamebox... which in turn means that your NAT security (which >is of little consolation) is null & void. > >But we may be talking about different things.

Hey Jason. Glad we're on this subject. I just bought a D-Link DI-704(combo switch,router,NAT firewall)to network two home computers. I have yet to get the fricking thing to work with my @HOme cable connection. But assuming I one day figure it out, it seems highly configurable. Your suggesting it won't have enough flexability? Whats the way to go without buying additional IP address? -- Don Scurlock Vancouver,B.C. GPLRank -15.27 MonsterRank 91.34 Come see how you rank, at the GPLRank site http://newgplrank.schuerkamp.de/

On Sat, 24 Nov 2001 02:20:03 GMT, [email hidden] (Don Scurlock) wrote: >Hey Jason. Glad we're on this subject. I just bought a D-Link DI-704(combo >switch,router,NAT firewall)to network two home computers. I have yet to get the >fricking thing to work with my @HOme cable connection. But assuming I one day >figure it out, it seems highly configurable. Your suggesting it won't have >enough flexability? Whats the way to go without buying additional IP address? I initially used ZoneAlarm, but now I'm using a Linksys 4 port router/firewall with @Home, and it was a breeze to set up. I just set my IP's in the router to my @Home IP's, let both PC's obtain IP's automatically, and had both online in no time. I've played games no problem, but one thing I haven't done is played net games from both machines at the same time. I actually set out to get a Netgear router, but got the Linksys because the store didn't have the Netgear I wanted. I read the Netgear firewall was more robust, but I'm happy with the Linksys. As a test, I left Zonealarm on one of the machines to see how many attempted accesses there were on my IP. I went from about 50 per day (sometimes 50 over a weekend) with just ZoneAlarm to absolutely none in a whole week with the router. Tim

On Sat, 24 Nov 2001 02:52:38 GMT, Tim O <[email hidden]> wrote: >As a test, I left Zonealarm on one of the machines to see how many >attempted accesses there were on my IP. I went from about 50 per day >(sometimes 50 over a weekend) with just ZoneAlarm to absolutely none >in a whole week with the router. Tim, Just FYI -- the router will take care of 99.9% of all illicit activity from outside your home network, but will do nothing for you if a trojan makes its way onto your PC. If the router sees a packet originating from within your network, it will let it through, as well as letting through any packets that are sent back to you in response. Todd Walker GPLRank: +72.27 (Held back by the @#$% Ring) twalker at jam dot rr dot com http://twalker.d2g.com/gpl

Hi Don, Its not that you router will not have enough "flexibility" per-se as the issue is how many ports you can have "mapped" based on a small amount of memory those routers contain. Meaning... you are basically running a mini-DHCP server on those routers. That DHCP capability requires memory (to hold the algorithms to even perform such a task) as well as memory for holding the "customizations" you desire. Those customizations traditionally are "Port Mapping Tables". If you play only a couple of games, that use limited ports, you'll be fine. However, if your games/apps require a large number of ports (and port ranges)... you'll reach a critical plateau of what you can do... since you are now limited int he total number of ports you can map. This plateau is the sole reason why the DMZ (short for DeMilitarized Zone) concept exists on those routers. The concept is simple... we have limited memory to house/store the port mapping tables... so we assign a small portion of the memory for a "master rule" which basically tells the router "If it isn't in the port mapping table... forward it to the DMZ for processing/handling". However, this can have grave security issues... since the DMZ is a "High Level Rule" that basically renders your "NAT firewall properties" null & Void. The reason behind this is simple.... your NAT "Firewall" isn't really a firewall at all. In fact... all it does is rely on the fundamentals of how a hacker would enter your system. Meaning: For a person to enter your system.. he needs to be "let in". This means he has to first find a "Port" that is open. If the port is open, and there is a process handling/listening for requests on that port... it will send back a "return handshake". After the handshake is established... the hacker can pass data to the process that is listening (he now has a process that is willing to listen to him), and if the hacker knows a specific vulnerability in that particular process... he can exploit the system. So... all the NAT is doing is basically not replying, unless it is in the port mapping table. No reply = no entry possibilities. The funnier thing is... your computer already functions this way! This is also why I find it somewhat comical that Zone Alarm even tells people about outside requests on ports. I mean... @Home itself (the ISP) is known to scan certain ports on its own customers to ensure that they are not hosting servers (like FTP servers) which is a violation of their Licensing Agreement. You can scan a computer until the cows come home, and even pound on the door as hard as possible (regardless of OS)... it has no effect unless something on your puter REPLIES, and then (only then) the hacker must now hope that the replying program has a vulnerability that he is aware of. All Zone Alarm does is rely on the ignorance of its users to form a false sense of security and need. I mean... how many times in here have I heard guys say "Oh thank goodness I have Zone Alarm... I had 50 attempts to get into my system just last week... Zone Alarm told me so!". It is simply purposely invoked hysteria by Zone Alarm to try to up their value/need in the end user's eyes. Zone Alarm is about as useful as an Ice Salesman at the North Pole. If you have given Zone Alarm permission to allow programs to listen on ports, and those programs have vulnerabilities.... Zone Alarm is 100% useless. Think about it... you give access to ICQ to listen on ports (because Zone Alarm prompted you, identified it as ICQ as the requesting program to open the port for, and you said YES)... Say now that ICQ has a vulnerability... THAT is where the hacker attacks... the PROGRAM. Its the same thing with email... you open ports 25 and 110 for email. After that.. anything that comes through those ports is allowed (directed to email prog), if the email prog has a vulnerability... Zone Alarm is useless... and the attacker gets in. Basically, a hacker can beat on the door all day long, and not get anywhere, since he is not getting a "return handshake" since nothing is listening on that port. COMPUTERS are not vulnerable to attack... PROCESSES/PROGRAMS are. So... knowing this.. the moment you set up a DMZ (because of the memory limitations inherit in 99% of the Home Based Routers on the market)... is the moment that you tell the router to "ship it off to the afore-told computer for processing" (or lack thereof). This is also why it is called a "DeMilitarized Zone"... since that is exactly the effect it has on security.... it is a security detour of sorts. This is why I all hardware home routers "limited". They don't really do much, except allow basic functionability. A software proxy on another machine is far more robust, and still posesses all of the security features (and more) than hardware routers. Cheers, Schumi "Don Scurlock" <[email hidden]> wrote in message news:9162BA881dscurlock@news... > [email hidden] (Schumi) wrote in > <Q5zL7.60870$[email hidden]>: > > >Do you mean "NAT Routers". Like Linksys, etc.? > > > >If so... they have limited memory capabilities, so mapping ports willreach > >a maximum. Which is something to be concerned about if you play more than1 > >game on different ports, or the game uses a broad-spectrum port range. > > > >The only alternative left with many of them is to assign your Gamebox asthe > >DMZ... which basically forwards all ports not listed in the Port Mapping > >table to your gamebox... which in turn means that your NAT security(which

Quoted text (7 lines)

> >is of little consolation) is null & void. > > > >But we may be talking about different things. > > > Hey Jason. Glad we're on this subject. I just bought a D-Link DI-704(combo > switch,router,NAT firewall)to network two home computers. I have yet to

get the > fricking thing to work with my @HOme cable connection. But assuming I oneday > figure it out, it seems highly configurable. Your suggesting it won't have > enough flexability? Whats the way to go without buying additional IPaddress?

Quoted text (10 lines)

> > -- > Don Scurlock > Vancouver,B.C. > > GPLRank -15.27 > MonsterRank 91.34 > > Come see how you rank, at the GPLRank site > http://newgplrank.schuerkamp.de/

> As a test, I left Zonealarm on one of the machines to see how many > attempted accesses there were on my IP. I went from about 50 per day > (sometimes 50 over a weekend) with just ZoneAlarm to absolutely none > in a whole week with the router. The router is basically just not replying to the requester. Your computer does the exact same thing mate... even without a firewall prog installed. I wouldn't use Zone Alarm's "outside access request!" as a gauge for "hackers". It simply isn't correct. You are no more/less safe behind that router mate... trust me on this. In fact... I lean towards the "less safe" side of the stick, if you have been lulled into a false sense of security and removed your virus/firewall progs.. That router doesn't have a firewall... it simply relies on the fundamentals of NAT and Proxy logistics/protocol. The moment you forward a port on that router, is the moment those alerts will come back... In most cases it (request) is a *wild* virus on the net, and it is looking for certain programs on certain ports, with certain vulnerabilities in those certain programs. Doesn't mean that had you not had that firewall/router up and running, that you'd be infected/compromised. Not an attack or condescending in intent... just don't reply on that router to protect you under certain circumstances, or ANY firewall prog for that matter. Cheers, Schumi

On Sat, 24 Nov 2001 09:01:02 GMT, "Schumi" <[email hidden]> wrote: >Not an attack or condescending in intent... just don't reply on that router >to protect you under certain circumstances, or ANY firewall prog for that >matter. [snip] No problem... From what you and Todd are saying though, the concerns really seem more trojan related than anything. To me, that says "know what you're downloading" more than it says make sure you have your system secured from the outside. Tim

I use a 5 port hub right now, since I get an ip everytime I plug a computer in (I have ethernet right to wall where I live). I have a Linux server running DMS and Web (and hopefully mail one day if I can get it to work :-), and then 3 windows boxes behind it. Except right now, they're not 'behind' it, they're all side by side, if that makes any sense. I was going to get a second nic and setup my linux box as the frontal computer and as a router and 'hide' my other computers behind it. Then I heard that people are buying routers that seem to do this for you. But it seems as though you're saying the linux router/firewall is the better way to go... So, in my situation it makes more sense to buy a nic and spend a weekend setting it up, rather than get a router, right? And last question, will I see an increase in puter-puter performance between my windows boxes since I'm not getting all the 'noise' traffic of the rest of the people in my building? or would that only be with a router/switch (hardware)? thanx, Curtis "Schumi" <[email hidden]> wrote in message news:aeJL7.62464$[email hidden]... > Hi Don, > > Its not that you router will not have enough "flexibility" per-se as the > issue is how many ports you can have "mapped" based on a small amount of > memory those routers contain. Meaning... you are basically running a > mini-DHCP server on those routers. That DHCP capability requires memory(to > hold the algorithms to even perform such a task) as well as memory for > holding the "customizations" you desire. Those customizationstraditionally > are "Port Mapping Tables". > > If you play only a couple of games, that use limited ports, you'll befine.

Quoted text (14 lines)

> However, if your games/apps require a large number of ports (and port > ranges)... you'll reach a critical plateau of what you can do... since you > are now limited int he total number of ports you can map. > > This plateau is the sole reason why the DMZ (short for DeMilitarized Zone) > concept exists on those routers. The concept is simple... we have limited > memory to house/store the port mapping tables... so we assign a small > portion of the memory for a "master rule" which basically tells the router > "If it isn't in the port mapping table... forward it to the DMZ for > processing/handling". > > However, this can have grave security issues... since the DMZ is a "High > Level Rule" that basically renders your "NAT firewall properties" null & > Void. The reason behind this is simple.... your NAT "Firewall" isn't

really > a firewall at all. In fact... all it does is rely on the fundamentals ofhow > a hacker would enter your system. > > Meaning: > > For a person to enter your system.. he needs to be "let in". This means he > has to first find a "Port" that is open. If the port is open, and there isa > process handling/listening for requests on that port... it will send backa > "return handshake". After the handshake is established... the hacker can > pass data to the process that is listening (he now has a process that is > willing to listen to him), and if the hacker knows a specificvulnerability

Quoted text (8 lines)

> in that particular process... he can exploit the system. > > So... all the NAT is doing is basically not replying, unless it is in the > port mapping table. No reply = no entry possibilities. The funnier thing > is... your computer already functions this way! > > This is also why I find it somewhat comical that Zone Alarm even tells > people about outside requests on ports. I mean... @Home itself (the ISP)

is > known to scan certain ports on its own customers to ensure that they arenot > hosting servers (like FTP servers) which is a violation of their Licensing > Agreement. You can scan a computer until the cows come home, and evenpound > on the door as hard as possible (regardless of OS)... it has no effect > unless something on your puter REPLIES, and then (only then) the hackermust > now hope that the replying program has a vulnerability that he is awareof.

Quoted text (7 lines)

> > All Zone Alarm does is rely on the ignorance of its users to form a false > sense of security and need. I mean... how many times in here have I heard > guys say "Oh thank goodness I have Zone Alarm... I had 50 attempts to get > into my system just last week... Zone Alarm told me so!". It is simply > purposely invoked hysteria by Zone Alarm to try to up their value/need in > the end user's eyes. Zone Alarm is about as useful as an Ice Salesman at

the

Quoted text (10 lines)

> North Pole. If you have given Zone Alarm permission to allow programs to > listen on ports, and those programs have vulnerabilities.... Zone Alarm is > 100% useless. > > Think about it... you give access to ICQ to listen on ports (because Zone > Alarm prompted you, identified it as ICQ as the requesting program to open > the port for, and you said YES)... Say now that ICQ has a vulnerability... > THAT is where the hacker attacks... the PROGRAM. Its the same thing with > email... you open ports 25 and 110 for email. After that.. anything that > comes through those ports is allowed (directed to email prog), if the

email > prog has a vulnerability... Zone Alarm is useless... and the attacker gets > in. > > Basically, a hacker can beat on the door all day long, and not getanywhere, > since he is not getting a "return handshake" since nothing is listening on > that port. COMPUTERS are not vulnerable to attack... PROCESSES/PROGRAMSare. > > So... knowing this.. the moment you set up a DMZ (because of the memory > limitations inherit in 99% of the Home Based Routers on the market)... is > the moment that you tell the router to "ship it off to the afore-told > computer for processing" (or lack thereof). This is also why it is calleda > "DeMilitarized Zone"... since that is exactly the effect it has on > security.... it is a security detour of sorts. > > This is why I all hardware home routers "limited". They don't really do > much, except allow basic functionability. A software proxy on another > machine is far more robust, and still posesses all of the securityfeatures

Quoted text (16 lines)

> (and more) than hardware routers. > > Cheers, > Schumi > > > "Don Scurlock" <[email hidden]> wrote in message > news:9162BA881dscurlock@news... > > [email hidden] (Schumi) wrote in > > <Q5zL7.60870$[email hidden]>: > > > > >Do you mean "NAT Routers". Like Linksys, etc.? > > > > > >If so... they have limited memory capabilities, so mapping ports will > reach > > >a maximum. Which is something to be concerned about if you play more

than > 1 > > >game on different ports, or the game uses a broad-spectrum port range. > > > > > >The only alternative left with many of them is to assign your Gameboxas > the > > >DMZ... which basically forwards all ports not listed in the PortMapping

Quoted text (8 lines)

> > >table to your gamebox... which in turn means that your NAT security > (which > > >is of little consolation) is null & void. > > > > > >But we may be talking about different things. > > > > > > Hey Jason. Glad we're on this subject. I just bought a D-Link

DI-704(combo > > switch,router,NAT firewall)to network two home computers. I have yet to > get the > > fricking thing to work with my @HOme cable connection. But assuming Ione > day > > figure it out, it seems highly configurable. Your suggesting it won'thave

Quoted text (14 lines)

> > enough flexability? Whats the way to go without buying additional IP > address? > > > > -- > > Don Scurlock > > Vancouver,B.C. > > > > GPLRank -15.27 > > MonsterRank 91.34 > > > > Come see how you rank, at the GPLRank site > > http://newgplrank.schuerkamp.de/ > >

And an excellent FAQ for Tiny (get a cup of coffee and put more paper in your printer - it's long): http://www.tpffaq.com/cgi-bin/faqmanager.cgi "Schumi" <[email hidden]> skrev i en meddelelse news:PBwL7.60252$[email hidden]...

Quoted text (9 lines)

> http://www.tinysoftware.com > > Sorry, I missed that :) > > Cheers, > Schumi > > >

uh, my linux server is running DNS, not DMS ;-) "imaswinger" <[email hidden]> wrote in message news:9FPL7.13105$[email hidden]... > I use a 5 port hub right now, since I get an ip everytime I plug acomputer > in (I have ethernet right to wall where I live). I have a Linux server > running DMS and Web (and hopefully mail one day if I can get it to work:-), > and then 3 windows boxes behind it. Except right now, they're not'behind' > it, they're all side by side, if that makes any sense. I was going to geta > second nic and setup my linux box as the frontal computer and as a router > and 'hide' my other computers behind it. Then I heard that people are > buying routers that seem to do this for you. > But it seems as though you're saying the linux router/firewall is thebetter

Quoted text (27 lines)

> way to go... > So, in my situation it makes more sense to buy a nic and spend a weekend > setting it up, rather than get a router, right? And last question, will I > see an increase in puter-puter performance between my windows boxes since > I'm not getting all the 'noise' traffic of the rest of the people in my > building? or would that only be with a router/switch (hardware)? > thanx, > Curtis > > "Schumi" <[email hidden]> wrote in message > news:aeJL7.62464$[email hidden]... > > Hi Don, > > > > Its not that you router will not have enough "flexibility" per-se as the > > issue is how many ports you can have "mapped" based on a small amount of > > memory those routers contain. Meaning... you are basically running a > > mini-DHCP server on those routers. That DHCP capability requires memory > (to > > hold the algorithms to even perform such a task) as well as memory for > > holding the "customizations" you desire. Those customizations > traditionally > > are "Port Mapping Tables". > > > > If you play only a couple of games, that use limited ports, you'll be > fine. > > However, if your games/apps require a large number of ports (and port > > ranges)... you'll reach a critical plateau of what you can do... since

you > > are now limited int he total number of ports you can map. > > > > This plateau is the sole reason why the DMZ (short for DeMilitarizedZone) > > concept exists on those routers. The concept is simple... we havelimited > > memory to house/store the port mapping tables... so we assign a small > > portion of the memory for a "master rule" which basically tells therouter

Quoted text (14 lines)

> > "If it isn't in the port mapping table... forward it to the DMZ for > > processing/handling". > > > > However, this can have grave security issues... since the DMZ is a "High > > Level Rule" that basically renders your "NAT firewall properties" null & > > Void. The reason behind this is simple.... your NAT "Firewall" isn't > really > > a firewall at all. In fact... all it does is rely on the fundamentals of > how > > a hacker would enter your system. > > > > Meaning: > > > > For a person to enter your system.. he needs to be "let in". This means

he > > has to first find a "Port" that is open. If the port is open, and thereis > a > > process handling/listening for requests on that port... it will sendback

Quoted text (8 lines)

> a > > "return handshake". After the handshake is established... the hacker can > > pass data to the process that is listening (he now has a process that is > > willing to listen to him), and if the hacker knows a specific > vulnerability > > in that particular process... he can exploit the system. > > > > So... all the NAT is doing is basically not replying, unless it is in

the

Quoted text (9 lines)

> > port mapping table. No reply = no entry possibilities. The funnier thing > > is... your computer already functions this way! > > > > This is also why I find it somewhat comical that Zone Alarm even tells > > people about outside requests on ports. I mean... @Home itself (the ISP) > is > > known to scan certain ports on its own customers to ensure that they are > not > > hosting servers (like FTP servers) which is a violation of their

Licensing

Quoted text (9 lines)

> > Agreement. You can scan a computer until the cows come home, and even > pound > > on the door as hard as possible (regardless of OS)... it has no effect > > unless something on your puter REPLIES, and then (only then) the hacker > must > > now hope that the replying program has a vulnerability that he is aware > of. > > > > All Zone Alarm does is rely on the ignorance of its users to form a

false > > sense of security and need. I mean... how many times in here have Iheard > > guys say "Oh thank goodness I have Zone Alarm... I had 50 attempts toget > > into my system just last week... Zone Alarm told me so!". It is simply > > purposely invoked hysteria by Zone Alarm to try to up their value/needin > > the end user's eyes. Zone Alarm is about as useful as an Ice Salesman at > the > > North Pole. If you have given Zone Alarm permission to allow programs to > > listen on ports, and those programs have vulnerabilities.... Zone Alarmis > > 100% useless. > > > > Think about it... you give access to ICQ to listen on ports (becauseZone > > Alarm prompted you, identified it as ICQ as the requesting program toopen > > the port for, and you said YES)... Say now that ICQ has avulnerability... > > THAT is where the hacker attacks... the PROGRAM. Its the same thing with > > email... you open ports 25 and 110 for email. After that.. anything that > > comes through those ports is allowed (directed to email prog), if the > email > > prog has a vulnerability... Zone Alarm is useless... and the attackergets > > in. > > > > Basically, a hacker can beat on the door all day long, and not get > anywhere, > > since he is not getting a "return handshake" since nothing is listeningon > > that port. COMPUTERS are not vulnerable to attack... PROCESSES/PROGRAMS > are. > > > > So... knowing this.. the moment you set up a DMZ (because of the memory > > limitations inherit in 99% of the Home Based Routers on the market)...is > > the moment that you tell the router to "ship it off to the afore-told > > computer for processing" (or lack thereof). This is also why it iscalled

Quoted text (27 lines)

> a > > "DeMilitarized Zone"... since that is exactly the effect it has on > > security.... it is a security detour of sorts. > > > > This is why I all hardware home routers "limited". They don't really do > > much, except allow basic functionability. A software proxy on another > > machine is far more robust, and still posesses all of the security > features > > (and more) than hardware routers. > > > > Cheers, > > Schumi > > > > > > "Don Scurlock" <[email hidden]> wrote in message > > news:9162BA881dscurlock@news... > > > [email hidden] (Schumi) wrote in > > > <Q5zL7.60870$[email hidden]>: > > > > > > >Do you mean "NAT Routers". Like Linksys, etc.? > > > > > > > >If so... they have limited memory capabilities, so mapping ports will > > reach > > > >a maximum. Which is something to be concerned about if you play more > than > > 1 > > > >game on different ports, or the game uses a broad-spectrum port

range.

Quoted text (16 lines)

> > > > > > > >The only alternative left with many of them is to assign your Gamebox > as > > the > > > >DMZ... which basically forwards all ports not listed in the Port > Mapping > > > >table to your gamebox... which in turn means that your NAT security > > (which > > > >is of little consolation) is null & void. > > > > > > > >But we may be talking about different things. > > > > > > > > > Hey Jason. Glad we're on this subject. I just bought a D-Link > DI-704(combo > > > switch,router,NAT firewall)to network two home computers. I have yet

to

Quoted text (22 lines)

> > get the > > > fricking thing to work with my @HOme cable connection. But assuming I > one > > day > > > figure it out, it seems highly configurable. Your suggesting it won't > have > > > enough flexability? Whats the way to go without buying additional IP > > address? > > > > > > -- > > > Don Scurlock > > > Vancouver,B.C. > > > > > > GPLRank -15.27 > > > MonsterRank 91.34 > > > > > > Come see how you rank, at the GPLRank site > > > http://newgplrank.schuerkamp.de/ > > > > > >

"Don Jennings" <[email hidden]> wrote in message news:X6vL7.724$[email hidden]... > "Joakim Lauridsen" wrote ... > > Well, when I last checked( it can have changed since) it didn't support > > Internet connection Sharing, and that makes it pretty useless for me. > > Are we talking about Tiny here? And when you say "didn't support Internet > connection Sharing", what does that mean? Yes I was Talking about Tiny, and it means that I use one computer to connect to my ISP, and connect to the Internet Through that connection via a Lan network. When I looked into frewalls, Tiny said they didn+t support that, so i picked ZA at that time. I'm not not satisfied, but I would like something better. Joakim

"Joakim Lauridsen" wrote ... > I use one computer to > connect to my ISP, and connect to the Internet Through that connection viaa > Lan network. When I looked into frewalls, Tiny said they didn+t support > that, so i picked ZA at that time. I'm not not satisfied, but I would like > something better. Then let me ask another question, does Tiny protect your main unit and not protect the 2nd, or does it prevent protection of both?

I would suggest the second NIC on your Linux box... plug the existing one into the wall... then the second NIC to the hub... match the IPs on all Windoze puters to the "192.168.0.xxx" subnet, and set the Linux Box's IP as the gateway for your other machines. Meaning: Box 1 (Linux Server) NIC #1: ISP assigned IP -- Plugged into wall Box 1 (Linux Server) NIC #2: 192.168.0.1 -- Plugged into Hub Box 2 (Windoze) NIC #1: 192.168.0.2 -- Gateway: 192.168.0.1 -- Plugged into Hub Box 3 (Windoze) NIC #1: 192.168.0.3 -- Gateway: 192.168.0.1 -- Plugged into Hub Etc. Then setup the Linux box to Masquerade IPs. This will allow you to pass through the Linux box (on your Windoze machines), and the ISP will think that just 1 box is requesting info. Your Linux box will then allow you infinitely more flexibility and security than any router out there. BTW... I ALWAYS suggest a Switch as opposed to a Hub. You can get the home versions (D-Link has a half decent 8 port one for a nice price). The Switch will always perform better, and if you tend to use those other computers at the same time, the Switch is certainly the way to go. Cheers, Schumi "imaswinger" <[email hidden]> wrote in message news:9FPL7.13105$[email hidden]... > I use a 5 port hub right now, since I get an ip everytime I plug acomputer > in (I have ethernet right to wall where I live). I have a Linux server > running DMS and Web (and hopefully mail one day if I can get it to work:-), > and then 3 windows boxes behind it. Except right now, they're not'behind' > it, they're all side by side, if that makes any sense. I was going to geta > second nic and setup my linux box as the frontal computer and as a router > and 'hide' my other computers behind it. Then I heard that people are > buying routers that seem to do this for you. > But it seems as though you're saying the linux router/firewall is thebetter

Quoted text (27 lines)

> way to go... > So, in my situation it makes more sense to buy a nic and spend a weekend > setting it up, rather than get a router, right? And last question, will I > see an increase in puter-puter performance between my windows boxes since > I'm not getting all the 'noise' traffic of the rest of the people in my > building? or would that only be with a router/switch (hardware)? > thanx, > Curtis > > "Schumi" <[email hidden]> wrote in message > news:aeJL7.62464$[email hidden]... > > Hi Don, > > > > Its not that you router will not have enough "flexibility" per-se as the > > issue is how many ports you can have "mapped" based on a small amount of > > memory those routers contain. Meaning... you are basically running a > > mini-DHCP server on those routers. That DHCP capability requires memory > (to > > hold the algorithms to even perform such a task) as well as memory for > > holding the "customizations" you desire. Those customizations > traditionally > > are "Port Mapping Tables". > > > > If you play only a couple of games, that use limited ports, you'll be > fine. > > However, if your games/apps require a large number of ports (and port > > ranges)... you'll reach a critical plateau of what you can do... since

you > > are now limited int he total number of ports you can map. > > > > This plateau is the sole reason why the DMZ (short for DeMilitarizedZone) > > concept exists on those routers. The concept is simple... we havelimited > > memory to house/store the port mapping tables... so we assign a small > > portion of the memory for a "master rule" which basically tells therouter

Quoted text (14 lines)

> > "If it isn't in the port mapping table... forward it to the DMZ for > > processing/handling". > > > > However, this can have grave security issues... since the DMZ is a "High > > Level Rule" that basically renders your "NAT firewall properties" null & > > Void. The reason behind this is simple.... your NAT "Firewall" isn't > really > > a firewall at all. In fact... all it does is rely on the fundamentals of > how > > a hacker would enter your system. > > > > Meaning: > > > > For a person to enter your system.. he needs to be "let in". This means

he > > has to first find a "Port" that is open. If the port is open, and thereis > a > > process handling/listening for requests on that port... it will sendback

Quoted text (8 lines)

> a > > "return handshake". After the handshake is established... the hacker can > > pass data to the process that is listening (he now has a process that is > > willing to listen to him), and if the hacker knows a specific > vulnerability > > in that particular process... he can exploit the system. > > > > So... all the NAT is doing is basically not replying, unless it is in

the

Quoted text (9 lines)

> > port mapping table. No reply = no entry possibilities. The funnier thing > > is... your computer already functions this way! > > > > This is also why I find it somewhat comical that Zone Alarm even tells > > people about outside requests on ports. I mean... @Home itself (the ISP) > is > > known to scan certain ports on its own customers to ensure that they are > not > > hosting servers (like FTP servers) which is a violation of their

Licensing

Quoted text (9 lines)

> > Agreement. You can scan a computer until the cows come home, and even > pound > > on the door as hard as possible (regardless of OS)... it has no effect > > unless something on your puter REPLIES, and then (only then) the hacker > must > > now hope that the replying program has a vulnerability that he is aware > of. > > > > All Zone Alarm does is rely on the ignorance of its users to form a

false > > sense of security and need. I mean... how many times in here have Iheard > > guys say "Oh thank goodness I have Zone Alarm... I had 50 attempts toget > > into my system just last week... Zone Alarm told me so!". It is simply > > purposely invoked hysteria by Zone Alarm to try to up their value/needin > > the end user's eyes. Zone Alarm is about as useful as an Ice Salesman at > the > > North Pole. If you have given Zone Alarm permission to allow programs to > > listen on ports, and those programs have vulnerabilities.... Zone Alarmis > > 100% useless. > > > > Think about it... you give access to ICQ to listen on ports (becauseZone > > Alarm prompted you, identified it as ICQ as the requesting program toopen > > the port for, and you said YES)... Say now that ICQ has avulnerability... > > THAT is where the hacker attacks... the PROGRAM. Its the same thing with > > email... you open ports 25 and 110 for email. After that.. anything that > > comes through those ports is allowed (directed to email prog), if the > email > > prog has a vulnerability... Zone Alarm is useless... and the attackergets > > in. > > > > Basically, a hacker can beat on the door all day long, and not get > anywhere, > > since he is not getting a "return handshake" since nothing is listeningon > > that port. COMPUTERS are not vulnerable to attack... PROCESSES/PROGRAMS > are. > > > > So... knowing this.. the moment you set up a DMZ (because of the memory > > limitations inherit in 99% of the Home Based Routers on the market)...is > > the moment that you tell the router to "ship it off to the afore-told > > computer for processing" (or lack thereof). This is also why it iscalled

Quoted text (27 lines)

> a > > "DeMilitarized Zone"... since that is exactly the effect it has on > > security.... it is a security detour of sorts. > > > > This is why I all hardware home routers "limited". They don't really do > > much, except allow basic functionability. A software proxy on another > > machine is far more robust, and still posesses all of the security > features > > (and more) than hardware routers. > > > > Cheers, > > Schumi > > > > > > "Don Scurlock" <[email hidden]> wrote in message > > news:9162BA881dscurlock@news... > > > [email hidden] (Schumi) wrote in > > > <Q5zL7.60870$[email hidden]>: > > > > > > >Do you mean "NAT Routers". Like Linksys, etc.? > > > > > > > >If so... they have limited memory capabilities, so mapping ports will > > reach > > > >a maximum. Which is something to be concerned about if you play more > than > > 1 > > > >game on different ports, or the game uses a broad-spectrum port

range.

Quoted text (16 lines)

> > > > > > > >The only alternative left with many of them is to assign your Gamebox > as > > the > > > >DMZ... which basically forwards all ports not listed in the Port > Mapping > > > >table to your gamebox... which in turn means that your NAT security > > (which > > > >is of little consolation) is null & void. > > > > > > > >But we may be talking about different things. > > > > > > > > > Hey Jason. Glad we're on this subject. I just bought a D-Link > DI-704(combo > > > switch,router,NAT firewall)to network two home computers. I have yet

to

Quoted text (22 lines)

> > get the > > > fricking thing to work with my @HOme cable connection. But assuming I > one > > day > > > figure it out, it seems highly configurable. Your suggesting it won't > have > > > enough flexability? Whats the way to go without buying additional IP > > address? > > > > > > -- > > > Don Scurlock > > > Vancouver,B.C. > > > > > > GPLRank -15.27 > > > MonsterRank 91.34 > > > > > > Come see how you rank, at the GPLRank site > > > http://newgplrank.schuerkamp.de/ > > > > > >

That is basically it Tim. In fact I'll share something I do on all my Windoze boxes during "post-installation" setup. Open Windows Explorer (not Internet Explorer)... and select: Tools>Folder Options. Basically, Windoze has changed this menu selection around a bit since Windows 98 -through- XP. What you are trying to find is "File Types". This is where you map a program as the owner-of-sorts to a certain file extension. (example: you'll have ".doc" assigned to MS Word.) You want to find the ".vbs" file extension. It will be mapped to "wscript.exe". Change that mapping to something like "notepad.exe". That will then force any file that is executed (by any means) with the .vbs file extension, to be opened by NotePad. Which is harmless, since notepad cannot properly execute a Visual Basic Script file. You have just removed the ability to launch a VAST number of viruses on your system (even if they get in), and unless you are a Visual Basic Programmer lacking 3rd party tools to test such files, it will not affect your system in anyway. Cheers, Schumi "Tim O" <[email hidden]> wrote in message news:[email hidden]... > On Sat, 24 Nov 2001 09:01:02 GMT, "Schumi" <[email hidden]> > wrote: > > >Not an attack or condescending in intent... just don't reply on thatrouter

Quoted text (12 lines)

> >to protect you under certain circumstances, or ANY firewall prog for that > >matter. > > [snip] > > No problem... From what you and Todd are saying though, the concerns > really seem more trojan related than anything. To me, that says "know > what you're downloading" more than it says make sure you have your > system secured from the outside. > > Tim >

"Don Jennings" <[email hidden]> wrote in message news:wYBM7.4247$[email hidden]... > Then let me ask another question, does Tiny protect your main unit and not > protect the 2nd, or does it prevent protection of both? I don�t know. When I read thdt Tiny didn't support it, I moved on. But as I understand it, the second unit is not vulnerable to attacks from the outside as long as it doesn't have it's own IP, so unless it gets a trojan, it's safe. And a good Virus checker I guess will check for that. I use ZA and InnoculateITon the unit that is directly connected, and only InnoculateIT on the second one. But as I said, ZA has to be shut down when driving online via Vroc, so it's not Ideal. Joakim

In article <xorL7.12815$[email hidden]>, "Stephen Smith" <[email hidden]> writes: >Agreed. Tiny Firewall is great. One of the few f/w's behind which you can >host a VROC race, NP. > I couldn't use it and connect to a VROC race. I tried to connect - it wouldn't let me, which I expected. But, I couldn't back out of the connection gracefully. It locked my system, and I had to reset it. I couldn't alt-tab to the Tiny Firewall window to tell it to allow the connection. And, I haven't found where to "add" GPL in the TF configuration. What's up with that?? Eldred -- Dale Earnhardt, Sr. R.I.P. 1951-2001 Homepage - http://www.umich.edu/~epickett GPLRank - under construction... Never argue with an idiot. He brings you down to his level, then beats you with experience... Remove SPAM-OFF to reply.

"EldredP" <[email hidden]> skrev i en meddelelse news:[email hidden]... > In article <xorL7.12815$[email hidden]>, "StephenSmith" > <[email hidden]> writes: > > >Agreed. Tiny Firewall is great. One of the few f/w's behind whichyou can > >host a VROC race, NP. > > > > I couldn't use it and connect to a VROC race. I tried to connect - itwouldn't > let me, which I expected. But, I couldn't back out of the connection > gracefully. It locked my system, and I had to reset it. I couldn'talt-tab to > the Tiny Firewall window to tell it to allow the connection. And, Ihaven't > found where to "add" GPL in the TF configuration. What's up withthat?? >Firewall Administration -> Advanced -> Add These settings work for me: http://www.simracing.dk/kruuse/tiny.gif Could possibly be trimmed a bit? /Jens

The uspits.com had a page on setting up firewalls and featured Tiny I thought. check out there, Jan may have mentioned this....(didn't read it so I don't know...)<<chocko CHING another plug for the Pits=more virtual cash>> dave henrie "EldredP" <[email hidden]> wrote in message news:[email hidden]... > In article <xorL7.12815$[email hidden]>, "Stephen Smith" > <[email hidden]> writes: > > >Agreed. Tiny Firewall is great. One of the few f/w's behind which youcan > >host a VROC race, NP. > > > > I couldn't use it and connect to a VROC race. I tried to connect - itwouldn't > let me, which I expected. But, I couldn't back out of the connection > gracefully. It locked my system, and I had to reset it. I couldn'talt-tab to > the Tiny Firewall window to tell it to allow the connection. And, Ihaven't

Quoted text (9 lines)

> found where to "add" GPL in the TF configuration. What's up with that?? > > Eldred > -- > Dale Earnhardt, Sr. R.I.P. 1951-2001 > Homepage - http://www.umich.edu/~epickett > GPLRank - under construction... > > Never argue with an idiot. He brings you down to his level, then beats

you > with experience... > Remove SPAM-OFF to reply.

Thanx! that doesn't sound so bad at all... Curtis "Schumi" <[email hidden]> wrote in message news:sYGM7.70130$[email hidden]... > I would suggest the second NIC on your Linux box... plug the existing one > into the wall... then the second NIC to the hub... match the IPs on all > Windoze puters to the "192.168.0.xxx" subnet, and set the Linux Box's IPas

Quoted text (7 lines)

> the gateway for your other machines. > > Meaning: > > Box 1 (Linux Server) NIC #1: ISP assigned IP -- Plugged into wall > Box 1 (Linux Server) NIC #2: 192.168.0.1 -- Plugged into Hub > Box 2 (Windoze) NIC #1: 192.168.0.2 -- Gateway: 192.168.0.1 -- Plugged

into > Hub > Box 3 (Windoze) NIC #1: 192.168.0.3 -- Gateway: 192.168.0.1 -- Pluggedinto

Quoted text (8 lines)

> Hub > Etc. > > Then setup the Linux box to Masquerade IPs. This will allow you to pass > through the Linux box (on your Windoze machines), and the ISP will think > that just 1 box is requesting info. > > Your Linux box will then allow you infinitely more flexibility and

security > than any router out there. > > BTW... I ALWAYS suggest a Switch as opposed to a Hub. You can get the home > versions (D-Link has a half decent 8 port one for a nice price). TheSwitch > will always perform better, and if you tend to use those other computersat

Quoted text (16 lines)

> the same time, the Switch is certainly the way to go. > > Cheers, > Schumi > > > "imaswinger" <[email hidden]> wrote in message > news:9FPL7.13105$[email hidden]... > > I use a 5 port hub right now, since I get an ip everytime I plug a > computer > > in (I have ethernet right to wall where I live). I have a Linux server > > running DMS and Web (and hopefully mail one day if I can get it to work > :-), > > and then 3 windows boxes behind it. Except right now, they're not > 'behind' > > it, they're all side by side, if that makes any sense. I was going to

get > a > > second nic and setup my linux box as the frontal computer and as arouter

Quoted text (7 lines)

> > and 'hide' my other computers behind it. Then I heard that people are > > buying routers that seem to do this for you. > > But it seems as though you're saying the linux router/firewall is the > better > > way to go... > > So, in my situation it makes more sense to buy a nic and spend a weekend > > setting it up, rather than get a router, right? And last question, will

I > > see an increase in puter-puter performance between my windows boxessince

Quoted text (10 lines)

> > I'm not getting all the 'noise' traffic of the rest of the people in my > > building? or would that only be with a router/switch (hardware)? > > thanx, > > Curtis > > > > "Schumi" <[email hidden]> wrote in message > > news:aeJL7.62464$[email hidden]... > > > Hi Don, > > > > > > Its not that you router will not have enough "flexibility" per-se as

the > > > issue is how many ports you can have "mapped" based on a small amountof > > > memory those routers contain. Meaning... you are basically running a > > > mini-DHCP server on those routers. That DHCP capability requiresmemory

Quoted text (24 lines)

> > (to > > > hold the algorithms to even perform such a task) as well as memory for > > > holding the "customizations" you desire. Those customizations > > traditionally > > > are "Port Mapping Tables". > > > > > > If you play only a couple of games, that use limited ports, you'll be > > fine. > > > However, if your games/apps require a large number of ports (and port > > > ranges)... you'll reach a critical plateau of what you can do... since > you > > > are now limited int he total number of ports you can map. > > > > > > This plateau is the sole reason why the DMZ (short for DeMilitarized > Zone) > > > concept exists on those routers. The concept is simple... we have > limited > > > memory to house/store the port mapping tables... so we assign a small > > > portion of the memory for a "master rule" which basically tells the > router > > > "If it isn't in the port mapping table... forward it to the DMZ for > > > processing/handling". > > > > > > However, this can have grave security issues... since the DMZ is a

"High > > > Level Rule" that basically renders your "NAT firewall properties" null& > > > Void. The reason behind this is simple.... your NAT "Firewall" isn't > > really > > > a firewall at all. In fact... all it does is rely on the fundamentalsof > > how > > > a hacker would enter your system. > > > > > > Meaning: > > > > > > For a person to enter your system.. he needs to be "let in". Thismeans > he > > > has to first find a "Port" that is open. If the port is open, andthere > is > > a > > > process handling/listening for requests on that port... it will send > back > > a > > > "return handshake". After the handshake is established... the hackercan > > > pass data to the process that is listening (he now has a process thatis

Quoted text (7 lines)

> > > willing to listen to him), and if the hacker knows a specific > > vulnerability > > > in that particular process... he can exploit the system. > > > > > > So... all the NAT is doing is basically not replying, unless it is in > the > > > port mapping table. No reply = no entry possibilities. The funnier

thing > > > is... your computer already functions this way! > > > > > > This is also why I find it somewhat comical that Zone Alarm even tells > > > people about outside requests on ports. I mean... @Home itself (theISP) > > is > > > known to scan certain ports on its own customers to ensure that theyare

Quoted text (7 lines)

> > not > > > hosting servers (like FTP servers) which is a violation of their > Licensing > > > Agreement. You can scan a computer until the cows come home, and even > > pound > > > on the door as hard as possible (regardless of OS)... it has no effect > > > unless something on your puter REPLIES, and then (only then) the

hacker > > must > > > now hope that the replying program has a vulnerability that he isaware

Quoted text (12 lines)

> > of. > > > > > > All Zone Alarm does is rely on the ignorance of its users to form a > false > > > sense of security and need. I mean... how many times in here have I > heard > > > guys say "Oh thank goodness I have Zone Alarm... I had 50 attempts to > get > > > into my system just last week... Zone Alarm told me so!". It is simply > > > purposely invoked hysteria by Zone Alarm to try to up their value/need > in > > > the end user's eyes. Zone Alarm is about as useful as an Ice Salesman

at > > the > > > North Pole. If you have given Zone Alarm permission to allow programsto > > > listen on ports, and those programs have vulnerabilities.... ZoneAlarm

Quoted text (10 lines)

> is > > > 100% useless. > > > > > > Think about it... you give access to ICQ to listen on ports (because > Zone > > > Alarm prompted you, identified it as ICQ as the requesting program to > open > > > the port for, and you said YES)... Say now that ICQ has a > vulnerability... > > > THAT is where the hacker attacks... the PROGRAM. Its the same thing

with > > > email... you open ports 25 and 110 for email. After that.. anythingthat

Quoted text (9 lines)

> > > comes through those ports is allowed (directed to email prog), if the > > email > > > prog has a vulnerability... Zone Alarm is useless... and the attacker > gets > > > in. > > > > > > Basically, a hacker can beat on the door all day long, and not get > > anywhere, > > > since he is not getting a "return handshake" since nothing is

listening > on > > > that port. COMPUTERS are not vulnerable to attack...PROCESSES/PROGRAMS > > are. > > > > > > So... knowing this.. the moment you set up a DMZ (because of thememory

Quoted text (10 lines)

> > > limitations inherit in 99% of the Home Based Routers on the market)... > is > > > the moment that you tell the router to "ship it off to the afore-told > > > computer for processing" (or lack thereof). This is also why it is > called > > a > > > "DeMilitarized Zone"... since that is exactly the effect it has on > > > security.... it is a security detour of sorts. > > > > > > This is why I all hardware home routers "limited". They don't really

do

Quoted text (17 lines)

> > > much, except allow basic functionability. A software proxy on another > > > machine is far more robust, and still posesses all of the security > > features > > > (and more) than hardware routers. > > > > > > Cheers, > > > Schumi > > > > > > > > > "Don Scurlock" <[email hidden]> wrote in message > > > news:9162BA881dscurlock@news... > > > > [email hidden] (Schumi) wrote in > > > > <Q5zL7.60870$[email hidden]>: > > > > > > > > >Do you mean "NAT Routers". Like Linksys, etc.? > > > > > > > > > >If so... they have limited memory capabilities, so mapping ports

will > > > reach > > > > >a maximum. Which is something to be concerned about if you playmore > > than > > > 1 > > > > >game on different ports, or the game uses a broad-spectrum port > range. > > > > > > > > > >The only alternative left with many of them is to assign yourGamebox

Quoted text (17 lines)

> > as > > > the > > > > >DMZ... which basically forwards all ports not listed in the Port > > Mapping > > > > >table to your gamebox... which in turn means that your NAT security > > > (which > > > > >is of little consolation) is null & void. > > > > > > > > > >But we may be talking about different things. > > > > > > > > > > > > Hey Jason. Glad we're on this subject. I just bought a D-Link > > DI-704(combo > > > > switch,router,NAT firewall)to network two home computers. I have yet > to > > > get the > > > > fricking thing to work with my @HOme cable connection. But assuming

I > > one > > > day > > > > figure it out, it seems highly configurable. Your suggesting itwon't

Quoted text (19 lines)

> > have > > > > enough flexability? Whats the way to go without buying additional IP > > > address? > > > > > > > > -- > > > > Don Scurlock > > > > Vancouver,B.C. > > > > > > > > GPLRank -15.27 > > > > MonsterRank 91.34 > > > > > > > > Come see how you rank, at the GPLRank site > > > > http://newgplrank.schuerkamp.de/ > > > > > > > > > > > >

In Win98, you do it from View->Folder Options->File Types. That's a cool tip. I'm careful about my system, but used this trick. Tim On Tue, 27 Nov 2001 07:15:57 GMT, "Schumi" <[email hidden]> wrote:

Quoted text (31 lines)

>That is basically it Tim. > >In fact I'll share something I do on all my Windoze boxes during >"post-installation" setup. > >Open Windows Explorer (not Internet Explorer)... and select: > >Tools>Folder Options. > >Basically, Windoze has changed this menu selection around a bit since >Windows 98 -through- XP. > >What you are trying to find is "File Types". > >This is where you map a program as the owner-of-sorts to a certain file >extension. (example: you'll have ".doc" assigned to MS Word.) > >You want to find the ".vbs" file extension. It will be mapped to >"wscript.exe". Change that mapping to something like "notepad.exe". > >That will then force any file that is executed (by any means) with the .vbs >file extension, to be opened by NotePad. Which is harmless, since notepad >cannot properly execute a Visual Basic Script file. > >You have just removed the ability to launch a VAST number of viruses on your >system (even if they get in), and unless you are a Visual Basic Programmer >lacking 3rd party tools to test such files, it will not affect your system >in anyway. > >Cheers, >Schumi

"Schumi" <[email hidden]> wrote in message news:N4HM7.70159$[email hidden]...

Quoted text (21 lines)

> That is basically it Tim. > > In fact I'll share something I do on all my Windoze boxes during > "post-installation" setup. > > Open Windows Explorer (not Internet Explorer)... and select: > > Tools>Folder Options. > > Basically, Windoze has changed this menu selection around a bit since > Windows 98 -through- XP. > > What you are trying to find is "File Types". > > This is where you map a program as the owner-of-sorts to a certain file > extension. (example: you'll have ".doc" assigned to MS Word.) > > You want to find the ".vbs" file extension. It will be mapped to > "wscript.exe". Change that mapping to something like "notepad.exe". > > That will then force any file that is executed (by any means) with the

.vbs > file extension, to be opened by NotePad. Which is harmless, since notepad > cannot properly execute a Visual Basic Script file. > > You have just removed the ability to launch a VAST number of viruses onyour > system (even if they get in), and unless you are a Visual Basic Programmer > lacking 3rd party tools to test such files, it will not affect your system > in anyway. > > Cheers, > Schumi I have a registry tweaker called Xteq Systems and it has an option to do what you suggest above, but you can select it to do it for the following file types also. *.vbs/*.vbe *.js/*.jse *.wsh/*.wsf All those file types could run a potentially damging script.