Results 1 to 5 of 5

Thread: Expert Rules..

  1. #1
    zraider Guest

    Default Expert Rules..



    Let me pose an example and see if I understand the basics of the expert rules. I have a router/firewall that broadcasts to syslog on UDP 514; I have created a rule calledSYSLOG that allows my PC IP of 168.202.22.3 to communicate with 168.202.22.4 (default gateway). I have also created a second rule called BLOCK that blocks any source and any destination for UDP 514. Am I correctly interpreting the rules ? Everything seems to be working fine.

    TIA

    Operating System:Windows XP Pro
    Product Name:ZoneAlarm Pro
    Software Version:4.0

  2. #2

    Default Re: Expert Rules..



    Is this a Firewall rule, Firewall panel>Expert tab? I think you understand basic idea of the rules, however here's somethings to consider. For anything that starts or ends at your PC use the setting My Computer you don't need to provide the IP address for your computer, after all the rule only affects the computer that is running ZAP. If your "default gateway" is listed as trusted on the Zones tab then the destination could be set to the Trusted Zone.

    The best way I have found to tell if you rule is working as desired is to go to the Alerts & Logs panel>Main tab,and set the Alert Events Shown to high. Thenon the same panel click on the advanced button, on the Alert Events tab and check Alert for all events. This will give you an Alertpopup for every Allowed and Blocked event. Then put your rule through it's paces and literally see what alerts pop up, use the arrow buttons on the popup to navigate through the alerts. This gives you a visual notice of when something is workingor not.

    Let us know if you run into any problems.

  3. #3
    zraider Guest

    Default Re: Expert Rules..



    Thanks for the info. One thing I wanted to be sure on though; I thought that in the short 'tutorial' on rules, it was stated that anytime a rule is created to allow access, a corresponding rule should be created to block access to everything else regarding the first rule. By the way, what is Team Z ? That's not Camaro Z-28, is it ? Just curious. I see you post quite a bit on the grc newsgroup too. I really like your Biblical verse: how so very true it is !

    TIA

  4. #4
    Join Date
    Dec 2002
    Location
    Mikado Michigan
    Posts
    2,596

    Default Re: Expert Rules..

    When creating an expert PROGRAM rule the last rule should be one to block everything, because program rules are ALL aplied to the traffic, so if the last rule doen't bock evgerything, then you are basically opening up the firewall for that program. Now this doesn't Apply for ZONE exper rules. They are applied until there is a single match then then rest are ignored.

    Forgot to mention, Tema Z is a group of users that help out ZoneAlarm users in forums around the net. For this we get a few perks. http://www.zonelabs.com/store/content/company/teamz.jsp

    Message Edited by Hoov on 07-06-2003 11:17 PM
    My homes are SpywareHammer.com and DonHoover.net and BleepingComputer.com


    Consumer Security - 2011 & 2012

    Tilting at windmills hurts you more than the windmills.
    -From the Notebooks of Lazarus Long
    Senior of the Howard Families

  5. #5

    Default Re: Expert Rules..

    Thanks for the sig comment, that means a lot. Also Team Z, are an even more select group of ZA users that have the inside edge with ZoneLabs. They get to do a lot of the "dirty" beta testing, and like Hoov said they answer ZA questions across the many newsgroups on the web. Their insight has really helped me from time to time, not to slight the other gurus here they really are a great bunch of people.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •