*I use Norton Personal Firewall

When you install Firewall, it comes with a set of defaults that lets it start protecting your computer. Its default protection level is Allow Most. Firewall has other protection levels that you can set, but before changing to a level other than the default, you must first configure Firewall. Firewall's Configuration Assistant takes you through the process.

To configure Firewall:

1. Display the Firewall window by clicking Show Firewall in the Firewall tab in Software Station.
2. In the Firewall window, select Firewall > Configuration Assistant.
   The Configuration Assistant window appears.
3. Click Next to continue.
4. Select your internet connection type (in most cases, use the default: Both dial-up and LAN) and click Next.
5. Select the protection level that Applications Inspector will provide and click Next.
   Note: Applications Inspector checks for changes in applications that can access the internet and can help detect trojan horse viruses.
6. Select the network settings you need:
   • Enable NetBIOS communications: If your computer is part of a LAN (local area network) using NetBIOS, click this checkbox.
   • Disable distributed RPC: Disables remote procedure calls to your computer. Checking this box will improve network security for your computer.
   • Include Local Area Networks into "Trusted" zone: Checking this box allows (trusts) all activities associated with computers on your LAN. Firewall applies different rules (policies) to different zones. The trusted zone allows the greatest accessibility to your computer and its resources over the LAN.
7. Click Next to continue.
8. Specify the drives that Configuration Assistant will search to find well known applications.
   By default, Configuration Assistant searches all hard drives, but you can add other drives and directories using the Add directory button.
9. Click Next.
   A window appears listing the well known applications identified, with checkboxes beside them. If a predefined rule exists for an application, the application's checkbox is checked. (An existing rule could be either to allow access or block access to the internet.)
10. Either:
    • Check the boxes next to applications that you want to use predefined rules for.
    • Uncheck the boxes next to applications that you do not want to use predefined rules for.
11. Click Next.
12. Ensure the checkbox for Attack Detector is checked to enable this extension plug-in to work with Firewall to recognize and prevent some types of network attacks.
13. Click Finish to complete the configuration and close Configuration Assistant.

How do I change the protection level?

When you first install Firewall, the default protection level is Allow Most. A useful setting to use when you are becoming familiar with Firewall is Learning Mode, which you set by selecting Firewall > Learning Mode in the Firewall window.

In Learning Mode, when Firewall detects network activity it has no defined rule for, it displays a message describing the activity and asks if you want to allow or block it. Firewall makes recommendations about whether to allow or block activity.

What are network events?

Network events are any type of activity that goes across the network. They could be programs from your computer sending out information, or other computers trying to receive information from your computer.

When there is activity on your network - either outgoing or incoming - Firewall can alert you of this activity by displaying a Network Event window, depending on the protection level and alert level you have set. An example of a Network Event window that Firewall displays is shown below.

• Block an event once by unchecking the Always take this action setting and clicking Block. If the same event occurs again, Firewall again prompts you to take action on it.
• Allow an event once by unchecking the Always take this action setting and clicking Allow. If the same event occurs again, Firewall again prompts you to take action on it.
• Create a rule to either block or allow an event if the same event occurs in the future. Do this by checking the Always take this action setting and clicking either Block or Allow. The next time the event occurs, Firewall will take the required action on the event - block or allow it, based on this rule - and not alert you about the event.
• Display advanced block or allow options by clicking the down arrow next to the Block or Allow buttons, or clicking Advanced.

What are alert levels and how do I change them?

The alert level determines how often Firewall displays alerts about network events:

• Never
• Only for defined events (default)
• For all events

An example of an alert is shown below.

1. Select Options > Settings to display the Settings window.
2. In the General tab, click the drop-down menu in the Alert Level field and select an option:
   • No Alerts
   • Show defined alerts
   • Show alerts for all events
3. Set the time for the alert window timeout (how long the window is displayed before automatically closing). (Default: 30 seconds)
4. Set the appearance of the alert window:
   • Remember last visited snap-in (displays alert windows at the same onscreen position as the previous alert window)
   • Always on top (puts the alert on top of open windows)
5. Click OK to save your settings.

What are plug-ins?

A plug-in is an extra program, or extension, that works with Firewall. Firewall has a plug-in called Attack Detector that works with Firewall to recognize and prevent some types of network attacks, such as floods (a large number of data packets sent from a remote host) and port scanning (repeated connection requests from a remote host).

 Top

What should I do when I see a program trying to send or receive data?

When Firewall displays a Network Event window, prompting you to allow or block the activity, you have several choices:

• If the network event is from a known safe program, ensure the Always take this action checkbox is checked and click Allow.
• If you see many events for the same program, click the down arrow next to Allow and select Allow all for this application.
• If the network event is from a known harmful program, block this activity by ensuring the Always take this action checkbox is checked, click the down arrow next to Block, and select Block all for this application.
• If the network event is from a program you are unfamiliar with, ensure the Always take this action checkbox is NOT checked and click Block. Check the common programs you use to determine what the program is. If the Network Event window displays again for this activity and you are still unsure what the program is, block the activity and click I'm not sure (send report) for technical assistance about the activity.

What should I do if Firewall is blocking a program I want to use?

If Firewall blocks a program you want to use, you can either:

• Change your protection level to Learning Mode, which lets you choose which activities to block or allow.
• Use Firewall's Log to select and unblock the application.

To change your protection level:

1. Open eAcceleration Software Station by selecting Start > Programs > eAcceleration > eAcceleration Software Station.
2. Click the StopSign icon.
3. Click the Firewall tab.
4. In the Firewall tab, click Show Firewall to display the Firewall window.
5. In the Firewall window, select Firewall > Learning Mode.
   Firewall will now prompt you when it detects activity it does not recognize, letting you allow or block the activity.

To use the Firewall Log to unblock an application you want to use:

1. In Firewall's navigation area, click Log to display the network event log.
   Note: By default, the log constantly updates and scrolls.
2. To temporarily stop the log from scrolling, click the Pause button in the log's toolbar.
3. Click the Action header to sort events by action and make your search easier.
4. Use the scrollbar to move down the list of events and search for the application you want to unblock.
5. Click the application to select it.
6. Either:
   • Click the Allow All Activity button in the toolbar.
   • Right-click the selected application and select Allow All Activity from the popup menu.
7. Click the Pause button to enable the log to update and scroll again.
8. If you sorted by Action, click the Date Time header to return to the log's default sorting method.

To block a site you do not want accessed from your computer:

1. From the Firewall tab in Software Station, click Show Firewall to display the Firewall window.
2. Click Network Zones.
3. Double-click the Blocked zone to display the Blocked Properties window.
4. Click the Hosts tab.
5. Click the Create new item button or right-click in the Blocked Properties window and select Create New to display the Host window.
6. In the Enter IP address or host name field, enter the address of the site you want to block, in the format www..com and click OK. Firewall retrieves the host address and adds it to the list.
7. Click OK in the Blocked Properties window to close it. Firewall displays a message telling you that the change you have made does not have influence on established connections, only on new connections.
8. Click OK to close the message window.