Advanced filtering options

The Firewall and Network attack protection sections allow you to configure advanced filtering options to detect several types of attacks and vulnerabilities that can be carried out against your computer.

note

Notifications and logging

In some cases you will not receive a threat notification about blocked communications. Please consult the Logging and creating rules or exceptions from log section for instructions to view all blocked communications in the firewall log.

important

Availability of particular options in this help page

The availability of particular options in Advanced setup (F5) > Network Protection > Firewall and Advanced setup (F5) > Network Protection > Network attack protection may vary depending on the type or version of your firewall module, as well as the version of your operating system.

icon_section Allowed services

Settings in this group are meant to simplify the configuration of access to this computer´s services from the trusted zone. Many of them enable/disable predefined firewall rules.

Allow file and printer sharing in the Trusted zone – Allows remote computers in the Trusted zone to access your shared files and printers.

Allow UPNP for system services in the Trusted zone – Allows incoming and outgoing requests of UPnP protocols for system services. UPnP (Universal Plug and Play also known as Microsoft Network Discovery)  is used in Windows Vista and later operating systems.

Allow incoming RPC communication in the Trusted zone – Enables TCP connections from the Trusted zone allowing access to the MS RPC Portmapper and RPC/DCOM services.

Allow remote desktop in the Trusted zone – Enables connections via Microsoft Remote Desktop Protocol (RDP) and allows computers in the Trusted zone to access your computer using a program that uses RDP (for example, "Remote Desktop Connection"). See also how to allow RDP connections outside Trusted zone.

Enable logging into multicast groups through IGMP – Allows incoming/outgoing IGMP and incoming UDP multicast streams, for example video streams generated by applications using the IGMP protocol (Internet Group Management Protocol).

Allow communication for bridged connections – Select this option to avoid terminating bridged connections. Bridged networking connects a virtual machine to a network using the host computer's Ethernet adapter. If you use bridged networking, the virtual machine can access other devices on the network, and vice versa as if it were a physical computer on the network.

Allow Metro applications – Communication of Windows Store applications that are running in the Metro environment is allowed according to the Metro application manifest. This option will override all rules and exceptions for Metro applications regardless of whether you have selected Interactive mode or Policy-based mode in ESET Firewall settings.

Allow automatic Web Services Discovery (WSD) for system services in the Trusted zone – Allows incoming Web Services Discovery requests from Trusted zones through the firewall. WSD is the protocol used to locate services on a local network.

Allow multicast addresses resolution in the Trusted zone (LLMNR) – The LLMNR (Link-local Multicast Name Resolution) is a DNS packet based protocol that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link without requiring a DNS server or DNS client configuration. This option allows incoming multicast DNS requests from the Trusted zone through the firewall.

Windows HomeGroup support – Enables HomeGroup support for Windows 7 and later operating systems. A HomeGroup is able to share files and printers on a home network. To configure a Homegroup, navigate to Start > Control Panel > Network and Internet > HomeGroup.

icon_section Intrusion detection

Protocol SMB – Detects and blocks various security problems in SMB protocol, namely:

Rogue server challenge attack authentication detection – Protects against an attack that uses a rogue challenge during authentication in order to obtain user credentials.

IDS evasion during named pipe opening detection – Detection of known evasion techniques used for opening MSRPCS named pipes in SMB protocol.

CVE detections (Common Vulnerabilities and Exposures) – Implemented detection methods of various attacks, forms, security holes and exploits over SMB protocol. Please see the CVE website at cve.mitre.org to search and obtain more detailed info about CVE identifiers (CVEs).

Protocol RPC –  Detects and blocks various CVEs in the remote procedure call system developed for the Distributed Computing Environment (DCE).

Protocol RDP –  Detects and blocks various CVEs in the RDP protocol (see above).

ARP Poisoning attack detection – Detection of ARP poisoning attacks triggered by man in the middle attacks or detection of sniffing at network switch. ARP (Address Resolution Protocol) is used by the network application or device to determine the Ethernet address.

Allow response to ARP requests from outside the Trusted zone – Select this option if you want the system to respond to ARP requests with IP addresses that are not from the Trusted zone. ARP (Address Resolution Protocol) is used by the network application to determine the Ethernet address.

DNS Poisoning attack detection – Detection of DNS poisoning – relieving a fake answer to a DNS request (sent by an attacker) which can point you to fake and malicious websites. DNS (Domain name systems) are distributed database systems that translate between human-friendly domain names and numeric IP addresses and allow users to refer to a website simply by using its domain name. Read more about this type of attack in the glossary.

TCP/UDP Port Scanning attack detection – Detects attacks of port scanning software – application designed to probe a host for open ports by sending client requests to a range of port addresses with the goal of finding active ports and exploiting the vulnerability of the service. Read more about this type of attack in the glossary.

Block unsafe address after attack detection – IP addresses that have been detected as sources of attacks are added to the Blacklist to prevent connection for a certain period of time.

Display notification after attack detection – Turns on the system tray notification at the bottom right corner of the screen.

Display notifications also for incoming attacks against security holes – Alerts you if attacks against security holes are detected or if an attempt is made by a threat to enter the system this way.

icon_section Packet inspection

Allow incoming connection to admin shares in SMB protocol - The administrative shares (admin shares) are the default network shares that share hard drive partitions (C$, D$, ...) in the system together with the system folder (ADMIN$). Disabling connection to admin shares should mitigate many security risks. For example, the Conficker worm performs dictionary attacks in order to connect to admin shares.

Deny old (unsupported) SMB dialects – Deny SMB sessions that use an old SMB dialect unsupported by IDS. Modern Windows operating systems support old SMB dialects due to backward compatibility with old operating systems such as Windows 95. The attacker can use an old dialect in an SMB session in order to evade traffic inspection. Deny old SMB dialects if your computer does not need to share files (or use SMB communication in general) with a computer with an old version of Windows.

Deny SMB sessions without extended security – Extended security can be used during the SMB session negotiation in order to provide a more secure authentication mechanism than LAN Manager Challenge/Response (LM) authentication. The LM scheme is considered weak and is not recommended for use.

Deny opening of executable files on a server outside the Trusted zone in SMB protocol – Drops connection when you are trying to open an executable file (.exe, .dll, ...) from a shared folder on the server that does not belong to the Trusted zone in firewall. Note that copying executable files from trusted sources can be legitimate, however this detection should mitigate risks from the unwanted opening of a file on a malicious server (for example, a file opened by clicking a hyperlink to a shared malicious executable file).

Deny NTLM authentication in SMB protocol for connecting a server in/outside the Trusted zone – Protocols that use NTLM (both versions) authentication schemes are subject to a credentials forwarding attack (known as an SMB Relay attack in the case of SMB protocol). Denying NTLM authentication with a server outside the Trusted zone should mitigate risks from forwarding credentials by a malicious server outside the Trusted zone. Similarly, you can deny NTLM authentication with servers in the Trusted zone.

Allow communication with the Security Account Manager service – For more information about this service see [MS-SAMR].

Allow communication with the Local Security Authority service – For more information about this service see [MS-LSAD] and [MS-LSAT].

Allow communication with the Remote Registry service – For more information about this service see [MS-RRP].

Allow communication with the Service Control Manager service – For more information about this service see [MS-SCMR].

Allow communication with the Server service – For information about this service see [MS-SRVS].

Allow communication with the other services – Other MSRPC services. MSRPC is the Microsoft implementation of the DCE RPC mechanism. Moreover, MSRPC can use named pipes carried into the SMB  (network file sharing) protocol for transport (ncacn_np transport). MSRPC services provide interfaces for accessing and managing windows systems remotely. Several security vulnerabilities have been discovered and exploited in the wild in the Windows MSRPC system (for example, Conficker worm, Sasser worm,…). Disable communication with MSRPC services that you do not need to provide to mitigate many security risks (such as remote code execution or service failure attacks).

Check TCP connection status – Checks to see if all TCP packets belong to an existing connection. If a packet does not exist in a connection, it will be dropped.

Maintain inactive TCP connections – In order to function, some applications require that the TCP connection that they establish is maintained even though the TCP connection may be inactive. Select this option to avoid terminating inactive TCP connections.

TCP protocol overload detection – The principle of this method involves exposing the computer/server to multiple requests – also see DoS (Denial of service attacks).

ICMP protocol message checking – Prevents attacks that exploit the weaknesses of the ICMP protocol, which could lead to computer unresponsiveness - also see DoS (Denial of service attacks).

Covert data in ICMP protocol detection – Checks to see if the ICMP protocol is used for data transfer. Many malicious techniques use the ICMP protocol to bypass the firewall.

Please see this ESET Knowledgebase article for an updated version of this help page.