Welcome

Welcome to Sygate Personal Firewall 5.0

Thank you for choosing Sygate Personal Firewall for your computing security. This might be your first time using a firewall for computer security. If so, we recommend that you read our Introduction.

If you already use an older version of Sygate Personal Firewall or are well-acquainted with firewall usage, you can cruise right through the Table of Contents to find the function or feature you are looking for. It never hurts though, to browse the Introduction, just in case there are some new features you can utilize, or configurations you need to know about.

This Help file is broken into three main section: Introducing Sygate Personal Firewall, Using Sygate Personal Firewall, which provides basic instructions on how to use Sygate, and Navigating Sygate Personal Firewall, which concentrates on the firewall layout.

If you have any questions or concerns about the use of Sygate Personal Firewall or any of its components, visit our web site at http://forums.sygatetech.com to request help, and our technical support team will get in touch with you as soon as possible.

Sygate Personal Firewall offers unparalleled protection against malicious intrusion attempts by hackers, script kiddies, and cracks. With the combined power of bi-directional intrusion detection, vulnerability assessment, and extensive logging and forensics capabilities, you can't find a better protection package.


Registration

Registering Sygate Personal Firewall 5.0

After your have completed installing, Sygate Personal Firewall you will be prompted to register your installation. You can register Sygate Personal Firewall for personal (free) or for business use.

  1. To access the registration form at any time, open the Help menu and select Register....

  2. Fill in the appropriate information in the fields provided on the Registration window. If you are trying Sygate Personal Firewall for business use, simply click the Register Later button. You will be given a 30-day trial. After 30 days, you will need to register Sygate Personal Firewall for business use. Click the Buy Online button to do so. After purchasing Sygate Personal Firewall, you will be given a serial number and registration code that you will need to enter in the Registration window.

  3. Make sure to enter a valid e-mail address to ensure that you can receive email support from Sygate® Technologies, Inc.

  4. Make sure that you can connect to the Internet. Click Register Now.


Setting Your Security Level

What's the difference between the security levels?

Block All and Allow All

Switching Security Levels

There are three (3) security levels in Sygate Personal Firewall : Normal, which offers customizable protection, Block All, and Allow All.

The default security level (the level automatically assigned when you start Sygate Personal Firewall) is Normal.

Security Level | What This Means
Normal | The Normal level is a configurable security setting that automatically blocks any application from your network until you grant it access to your connection. You can alter the "status" of different applications in the Applications List.
Block All | Block All prevents all information entering or leaving your computer from ANY outside source. All network traffic is blocked from entering or leaving your computer.
Allow All | Allow All permits the transmission of ALL network traffic, including the Internet, to and from your computer system via network connections. The Allow All setting still logs all traffic that enters and exits your system.

Block All and Allow All

Block All prevents the transmission of ANY AND ALL network traffic that is attempting to either enter or leave your computer. Allow All effectively disables Sygate Personal Firewall protection for both incoming and outgoing traffic, but still logs all traffic movement through your network.

Why would I use Block All and Allow All?

Block All

  • Your system tray icon indicates that Sygate Personal Firewall is in alert mode.

  • You are leaving your computer unattended.

Allow All

  • You need to run an application that is not compatible with Sygate Personal Firewall. The Allow All security setting logs all traffic that enters and exits your computer via your network connection.

To Switch Security Levels

To switch from one security level to another, right-click the System Tray Icon, then select the desired security level from the list.

Alternatively, you can open the main screen, click the Security menu, and select the security level from the menu.

To set your security level to Block All, you can click the Block All button on the main console.


Allowing Applications

When you first launch an application after installing Sygate Personal Firewall, you will receive a pop-up message asking if you wish to allow the application to access your network card.

To allow the application, simply click Yes at the pop-up message If you place a check in the checkbox on the pop-up message, Sygate will remember your decision to allow the application, and will allow it each time. If you do not place a check in the checkbox, however, Sygate Personal Firewall will ask your permission each time the application is opened.

Blocking Applications

If you do not wish to allow an application to access your network card, simply click No when you receive a pop-up message from Sygate Personal Firewall regarding the application. Place a check in the checkbox on the pop-up message if you wish to have Sygate Personal Firewall block the application at all times. Keep in mind that you can always change the allow/block status of an application later.


Responding to Pop-up Messages

New Application Pop-up

System Tray Notification

Changed Application Pop-up

New Application Pop-up

In the beginning, it might be common for you to see the following pop-up message:

What does this mean? Well, it means that Microsoft Internet Explorer is trying to access your network connection, and is attempting to connect to the web site scan.sygatetech.com, which has an IP address of 207.33.111.332, at that site’s server port 80. That’s plenty of information to take in.

What caused this pop-up?

  • You might have tried to open the application. Either this is the first time that you have done so since you installed Sygate Personal Firewall, or you have assigned this application a status of “Ask”, meaning that every time it tries to access your network connection, Sygate Personal Firewall will ask you for permission to grant it access.

  • You might have clicked on a link to a web site, or tried to open another program that might use this application.

  • If you have copied a picture or text from the Internet and pasted it into another document, the document's application may try to access the Internet.

What if you didn’t open any program or click on any link, and a program suddenly tries to access your network connection? If you haven’t opened any programs that use the application listed on the pop-up message, or can’t see any reason why that application should try to access your network connection, it is always safest to say No. This might indicate the presence of a Trojan horse on your computer, something that needs to be checked immediately.

Clicking the Details button opens another information field containing further details on the application.

What Should I Do?

This kind of message is common when you first start using Sygate Personal Firewall . In this particular example, Microsoft Internet Explorer is trying to access a Sygate® Technologies web site at the remote port 80. Most servers use port 80 to send and receive information on the Internet, so this isn’t anything unusual.

If you believe that you have triggered this application, it would be safe to click Yes. You have the option to tell Sygate Personal Firewall to remember the your answer for future reference. If you check the box marked Remember my answer, and do not ask me again for this application, Sygate Personal Firewall will remember your choice, and will act accordingly the next time this application tries to access your network connection.

If You Select “Yes”

If you have tried to open an application (such as a web browser) or a program that uses another application to access the Internet (such as a media streaming program) and you feel comfortable granting this application access to your network connection, then you can select Yes.

If You Select “No”

However, if a pop-up message is unexpected, and you can’t see any reason why the listed application should access the network connection, select No. This will assign the application or service a status of Block, so that it will be automatically blocked from your network connection any time it tries to gain access.

You should also run a virus scan to make sure that you have not inadvertently downloaded a virus or a Trojan horse that could infect your computer files.

Changed Application Pop-up

Occasionally, you might see a pop-up such as the one pictured below.

What does this mean? Generally, it means that you have recently upgraded the application pictured on the pop-up. As Sygate Personal Firewall uses checksum to determine the legitimacy of an application, an upgraded version might not pass the checksum test, since a new build or new version of the application is likely to have a different checksum value. In this case, the DLL authentication feature has noticed a new DLL loading.

On the other hand, if you haven’t upgraded the application recently, and see no reason why this message should appear, this could be an instance of a new Trojan horse trying to access your network.

What Should I Do?

If you have recently upgraded the application mentioned on the pop-up message, it is probably safe to click Yes and allow the application network access.

However, if you do not think that you have recently upgraded the listed application, you should select No and run an anti-virus software program or, if you are at work, contact you IT department.

System Tray Notification

You may see notification messages above your system tray icon from time to time. These messages indicate that Sygate Personal Firewall has logged an attempted attack against your computer, or has blocked traffic that you have specified as not trusted. Please note that if you are operating under Block All mode, you will see these message quite often.

You can disable these messages in the Options window, under the General Tab.


Password Protection

You can protect your firewall from user tampering by setting up password protection. Ideal for computers with multiple users, you can ensure that your security setting will not be changed by creating a password that must be entered before a user can access Sygate Personal Firewall.

Please note that once password protection has been enabled, you will need to enter a password each time you want to access the user interface of Sygate Personal Firewall - from the main console to the Application Configuration and Options windows. Without the password, you will be unable to disable the firewall or change the security settings. If you forget the password that you have configured for Sygate Personal Firewall, you will need to uninstall and then re-install Sygate Personal Firewall. You can, however, change the password as often as you like.

To set password protection, open the Options window by selecting Options from the Tools menu at the top of the Sygate Personal Firewall main console. Click the Set Password button under the Password Protection section.

  1. To set a password for the first time, click the Set Password... button. The Password window opens.

  2. Leave the Old Password field blank.

  3. Enter a password in the New Password field, and type it again in the Confirm New Password field.

  4. Click OK.

To Change an Old Password

  1. To change your password, click the Set Password... button. The Password window opens.

  2. Enter your old password in the Old Password field.

  3. Enter a new password in the New Password field, and retype it in the Confirm New Password field.

  4. Click OK.


Responding to an Attack

When Sygate Personal Firewall detects and attempted attack on your computer, it will notify you with a notification message above the system tray icon. In addition, the system tray icon will flash.

The first thing to remember when you see a flashing system tray icon is that, while your computer may be under attack, Sygate Personal Firewall is blocking the attack, so that your computer and personal data are in no immediate danger.

Note also that the system tray icon will flash if Sygate Personal Firewall detects a change in a program that you regularly use. For instance, you will see a flashing system tray icon if you upgrade an application, and then open it for the first time since the upgrade. This "executable change" will be logged in the Security Log.

To view the attack, double-click on the flashing icon, or open the main console and click on the Logs button, then select the Security Log. The Security Log will open, displaying the any attack attempts that have been thwarted by Sygate Personal Firewall. For more information on reading the logged information, click here.

If you are receiving attacks from the same IP address routinely (more than once a week), you might want to consider contacting the owner of the router being used in the attack. First, you should back trace the attack to gain the router information. You might be able to determine the actual IP address belonging to the perpetrator of the attack, although this is unusual.

Back Tracing Hack Attempts

  1. From the Security Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

  3. Sygate Personal Firewall will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

Back tracing simply traces the data on the attack backwards from your computer to the source. Most often, the source displayed is not the hacker's computer, but the public router used by the hacker to launch the attack.

  4. To view contact information for the owner of the public router, click the Whois>> button at the bottom of the Back Trace Information window. A drop panel appears, displaying contact info.

  5. Click the Whois<< button again to hide the information.

Contacting a System Administrator

Once you have the contact information for the router's owner, you can call, write, or email the owner with information about the attack. Before doing so, we ask that you keep these points in mind:

Not all router owners will have the time to research each attack. These owners may receive hundreds of complaints every day, and may or may not answer your email.


How to Uninstall Sygate

How to Uninstall Sygate Personal Firewall

There might eventually come a time that, for some reason, you may need to uninstall Sygate Personal Firewall. This is a very simple process.

  1. Click the Start Menu on your task bar.

  2. Select Programs>Sygate Personal Firewall>Uninstall Sygate Personal Firewall.

  3. The InstallShield Wizard will guide you through the uninstall process.

You can also uninstall using the Add/Remove Programs feature of Windows. Select Add/Remove Programs under the Control Panel, found under the Settings entry in the Start menu.


Main Console

The main console of Sygate Personal Firewall provides constant, real-time updates on your computer's network traffic, application status, and security level. From the main console, you can navigate to anywhere else within the firewall.

The main console of Sygate Personal Firewall is resizable, so you can adjust how big the console is.

Menus

Toolbar

Traffic History Graphs

Running Applications List

Message Console


Menus

Menus run across the top of the Sygate Personal Firewall main console, just above the toolbar. Clicking on the menu name will open the drop-down list of options for that menu.

There are five menus in Sygate Personal Firewall. File, Security, Tools, View, and Help.

File

The File menu contains the Close and Exit Firewall options. Selecting the Close option will close Sygate Personal Firewall. Selecting Exit Firewall disables Sygate Personal Firewall. If you chose to disable the firewall, you can restart it through the Programs menu under the Start menu.

Security

You can change your security level through the Security menu.

  • Block All - Blocks all traffic coming into and leaving your computer through your network adapter. This setting is recommended if you plan to be away from your computer while it is running, and are not downloading data from the Internet at the time.

  • Normal - Normal operating mode. Sygate Personal Firewall will ask permission to grant new applications access to the Internet.

  • Allow All - Allows any and all traffic entering or leaving your computer through the network adapter, essentially disabling firewall protection. This level is only recommended if you need to disable the firewall while using incompatible software.

Tools

The Tools menu provides several options. Selecting Applications opens the Applications List, a catalog of all the software applications that have attempted to access your network, as well as the level of trust you have associated with them.

You can choose to view any of the four logs files from the Tools menu by choosing the Logs option.

The Options selection offers features including e-mail alerts, Network Neighborhood browsing rights, multiple NIC support, and log file configuration.

The Advanced Rules option will open the Advanced Rules window.

A checklist on the Tools menu provides the options to automatically launch Sygate Personal Firewall when your computer is booted, use SOS vulnerability assessment, hide the System Tray Icon, or disable the firewall altogether.

View

The View menu gives you the option to alter the display of software programs in the Running Applications field. The option Large Icons displays 32x32 icons in the field. The Small Icons option displays 16x16 icons. Both the large and small icon displays provide the full name of the application below the icon itself, and the icons are displayed in a “corkboard” fashion.

The List option also provides small icon representations, with the icons displayed in a standard list.

The Program Details option provides not only a list of all running applications, but also useful information on the version number and location path of each application.

The Connection Details options gives further information on the type of connection being made by an each application accessing your network connection, as well as the protocol, local and remote ports and IP addresses being used, the application path, and more.

Help

The Help menu provides a link to the embedded Help file, the About window, the Registration window, and links to information on Sygate® Technologies Managed Firewall and Internet Sharing opportunities. Also, if you want to upgrade your firewall protection to Sygate Personal Firewall Pro, you can access the link from the Help menu.


Toolbar

The Sygate Personal Firewall toolbar is located along the top of the main console. Toolbar buttons offer a quick and easy way to open important windows within Sygate Personal Firewall.

  • Block All - Sets the security level to Block All.

  • Applications - Opens the Application List.

  • Logs - Opens Sygate log files

  • Test - Opens the Sygate Online Services vulnerability scan service.

  • Help - Opens the embedded help files.


Traffic History Graphs

The most noticeable feature of Sygate Personal Firewall is the set of Traffic History graphs that are located below the toolbar on the main console.

The Traffic History graphs produce a real time picture of the last two minutes of your traffic history. The graphs reload new information every second, providing instant data, as measured in bytes, regarding your incoming and outgoing network traffic. Additionally, the Attack History graph on the right side of the console provides information on attempted attacks against your machine.

Hide Broadcast Traffic

Below the Traffic History graphs are two checkboxes. The Hide Broadcast Traffic checkbox, if checked, will prevent broadcast traffic from being displayed in the Traffic History graphs. This will minimize the appearance of traffic by limiting the display to unicast traffic only.


Running Applications List

What is the Running Applications List?

Hiding System Services

Changing Your View in the Running Applications List

The Running Applications list, which is located below the traffic flow graphs, displays all applications and services that are currently accessing (or attempting to access) your network connection. The status of the applications is also displayed:

Icon | Meaning
 | If an application has a status of "Allow", and is accessing your network connection, it is displayed as a normal icon.
 | If an application has a status of "Ask" and is accessing your network connection, it's icon will be displayed with a yellow question mark over it.
 | If an application is being blocked, its icon will be displayed with a red circle and cross mark over it.
 | If an icon is displayed with small blue dots over the lower-left or lower-right corners, then the application is receiving (left dot) or sending (right dot) traffic through your network connection.

You can change the size of the icons and the information displayed within the Running Applications field by right-clicking within the field and selecting the desired view from the list of options provided. Alternately, you can open the view menu at the top of the main console, and select the desired view from the list provided.

Hiding System Services

You may notice a large number of services displayed in the Running Applications field. Although they cannot access your network connection without your permission, since many services are hard-coded into your computer, they show up in the Running Applications field, anyway.

To hide the services from view, place a check in the Hide Windows Services check box above the Running Applications field.

Changing Your View in the Running Applications Field

There are a number of ways in which you can view the applications in the Running Applications field. You can change the view from the View menu on the main console, or by right-clicking inside the Running Applications field and selecting from the following options:

Choice

What You'll See

Large Icons

Large application/service icons representing with the name of the application/service, arranged in horizontal lines

Small Icons

Smaller icons and the application/service names, arranged in horizontal lines

List

Small icons and the application/service name, arranged in a vertical list

Application Details

A table of application/service icons with the following information provided in table columns:

  • Application - Name of the service or application running.

  • Version - Version of the service or application.

  • Path - Location of the application's installed executable file.

  • Incoming Allowed - Incoming network traffic, in bytes that has been allowed by the firewall.

  • Incoming Blocked - Incoming network traffic, in bytes that has been blocked by the firewall.

  • Incoming Total - Total incoming network traffic, both allowed and blocked, in bytes, as measured by the firewall.

  • Outgoing Allowed - Outgoing network traffic, in bytes that has been allowed by the firewall.

  • Outgoing Blocked - Outgoing network traffic, in bytes that has been blocked by the firewall.

  • Outgoing Total - Total outgoing network traffic, both allowed and blocked, in bytes, as measured by the firewall.

  • Checksum - The application's fingerprint.

Connection Details

A table of application/service icons, with an entry for EVERY CONNECTION CURRENTLY BEING USED BY THE APPLICATION/SERVICE with the following information provided in table columns:

  • Application - Name of the service or application running.

  • Protocol - Protocol being used by the application for the listed connection.

  • Status - What the application or service is actually doing as a part of this connection.

  • Local Port - The port on your computer being used for this connection.

  • Remote Port - The port on the other computer that is being used for this connection.

  • IP Address - The list of the local IP address (your IP) and the remote IP address (the IP of the computer communicating wit your computer).

  • Process - Process number as assigned by Windows (as seen in the Task Manager window).

  • Application Path - Location of the application's installed executable file.


Message Console

The Message Console of Sygate Personal Firewall is located below the Running Applications field on the main console. It provides a real-time update of network communication, including security level changes, service starts and shut down, the application or editing of advanced rules or options.

The Message Console is, by default, hidden from view. To view the Message Console, click the Show Message Console button below the Running Applications field on the main console. The Message Console will appear.

To hide the Message Console from view, click the Hide Message Console button. The Message Console will collapse so that only the Show Message Console button is apparent.


Status Bar

The Status Bar runs along the bottom of the main console of Sygate Personal Firewall. It provides information regarding the security level currently being used.


System Tray Icon

Icon Appearances | Why does my icon look so strange?
Hide the System Tray Icon | UnHide the System Tray Icon

Once installed, Sygate Personal Firewall will display an icon in the system tray of your computer's task bar (the lower-right corner of your computer screen, where the time display is located). This icon indicates the status of the traffic between your computer and any external network(s), including the Internet.

The icon has a dynamic appearance, and if you are actively connected to a local area network or the Internet, the icon will probably be changing its appearance frequently. To see a table of all the possible appearances the icon might have, as well as an explanation for the appearance, see the table below.

the downward-pointing arrow indicates incoming traffic

the upward-pointing arrow indicates outgoing traffic

If the arrow is BLUE, traffic is flowing in the direction indicated, and has been allowed to do so by Sygate Personal Firewall.

If the arrow is GREY in color, no traffic is flowing in that direction.

If the arrow is RED, traffic is attempting to flow in the direction indicated, but is being blocked by Sygate Personal Firewall.

Icon | Meaning
 | Sygate Personal Firewall is in Alert Mode.
 | Incoming traffic has been approved by the firewall; there is no outgoing traffic.
 | Both incoming and outgoing traffic have been approved.
 | Outgoing traffic has been approved by the firewall; there is no incoming traffic.
 | Potential incoming traffic has been blocked by the firewall; outgoing traffic has been approved.
 | Incoming traffic is being blocked by the firewall; there is no outgoing traffic.
 | Both potential incoming and outgoing traffic are being blocked by the firewall.
 | There is no incoming traffic; outgoing traffic is being blocked by the firewall.
 | Incoming traffic has been approved by the firewall; outgoing traffic has been blocked by the firewall.
 | There is no incoming OR outgoing traffic.
 | Indicates that the firewall is in Allow All mode.
 | Indicates that the firewall has been set to Block All.

To Hide the System Tray Icon

  • From the Sygate Personal Firewall main screen, click the Tools menu. Select Hide System Tray Icon from the list of options.

To UnHide the System Tray Icon

  • From the Sygate Personal Firewall main screen, click the Tools menu. Select Show System Tray Icon from the list of options.


Alert Mode

If your system tray icon takes on an unusual appearance, it may be because Sygate Personal Firewall is in Alert Mode.

Every time Sygate Personal Firewall records an attack on your computer in the Security Log, the system icon will display the flashing Alert Mode Status icon, as pictured below.

What should I do if the firewall is in Alert Mode?

  1. Don't worry. Simply double-click the System Tray Icon. The Security Log will open to display the logged attack.

  2. If you feel the need to take extra steps to ensure your protection, you can change your security setting to Block All.


System Tray Menu

You can access almost any part of Sygate Personal Firewall through the System Tray menu. Simply right-click on the System Tray icon, and select your desired destination from the menu that appears.

Sygate Personal Firewall - Launches the main console.

Block All, Normal, and Allow All - You can select which security level you want, without opening the main console.

Applications - Opens the Applications List.

Logs - Opens Sygate Personal Firewall logs.

Options - Opens the Options window, where you can enable security options.

Advanced Rules - Opens the Advanced Rules window. You can use Advanced Rules to set security policies that dictate how you want Sygate Personal Firewall to treat traffic and applications.

Hide System Tray Icon - Hides the System Tray icon from view.

Help - Opens the embedded help files.

About - Opens the About screen, which provides information on the version and build number of Sygate Personal Firewall.

Exit Firewall - Shuts down the Sygate Personal Firewall engine.


Understanding the Application List

Understanding the Applications List

Opening the Applications List | Understanding the Applications List
Applying or Changing Access Status | Advanced Application Configuration

The Applications List is a list of all software programs that have attempted to access your network from your computer. This includes any applications that you have allowed or denied access to your network connection. From the applications list, you can change the status of an application. An application's status determines whether or not it can utilize your network at any time. Advanced status settings allow you to specify which port an application can use, or to schedule a time period in which an application can be allowed or denied use of your network connection.

Open Sesame

You can access the Applications List by clicking the Applications icon on the toolbar, or by selecting Applications under the Tools menu.

Don't confuse the Applications List (which displays a list of all applications that have attempted contact with your network connection since the installation of Sygate Personal Firewall) with the Running Applications field (which shows all the applications that are currently accessing your network connection).

When you open the Applications List, you will find a list of applications that have attempted to access your network connection since the installation of Sygate Personal Firewall. The list displays each application in a separate row, with additional information in each column. The columns present the following information:

  • FileName - The name of the application.

  • Version - The version (build number) of the application.

  • Access - The access status that you have applied to this program (either Block, Ask, or Allow)

  • Path - The location of the file components on your computer.


Access Status

Applying or Changing an Application Access Status

What is Access Status?

Pop-up Messages and Access Status

Changing Access Status

What is Access Status?

An Access Status is a set of rules that governs how many rights an application has in terms of accessing your network connection or modem. Depending on what status is assigned to an application (or service), and how much configuration you apply to it, an application can either access your network whenever it wants, access your network under certain conditions, access your network with your permission, or be blocked from accessing your network completely.

There are three access statuses in Sygate Personal Firewall: Allow, Ask, and Block. An application with a status of Allow will be allowed to access network connections. Under the Allow status, and application (or service) can be configured so that it can only access the network if using a certain port, or during certain hours. An application with a status of Ask requires your permission each time it attempts to access network connections. An application with a status of Block will be blocked from using your network altogether.

When a new application attempts to access your network connection while you are under the default security setting (Normal), Sygate Personal Firewall will open a pop-up window to ask if you wish to allow the application access to the network. This is because the application has a default access status of Ask. If you haven't allowed it or blocked it, Sygate Personal Firewall is going to ask you about it every time it tries to access your network/modem.

Pop-ups and Access Status

Click | Check “Remember my answer...” box? | Access Status Assigned
Yes | Yes | Allow
Yes | No | Ask
No | Yes | Block
No | No | Ask

You have several choices when you get the application pop-up message:

  • Select Yes, which will allow this application at this point in time, and tell Sygate Personal Firewall to remember your answer, so that you are not asked in the future. This application will then be allowed to access your network until you change its access status. This gives the application a status of Allow.

  • Select Yes, which will allow this application at this point in time, but do not elect to have Sygate Personal Firewall to remember your answer. Every time this application attempts to use your network connection, you will be asked again if it should be allowed or denied access. This gives the application a status of Ask.

  • Select No, which will block this application at this point in time, and tell Sygate Personal Firewall to remember your answer, so that you are not asked in the future. This application will then be systematically denied access to your network unless you change its access status. This gives the application a status of Block.

  • Select No, which will block this application at this point in time, and do not elect to have Sygate Personal Firewall to remember your answer. Every time this application attempts to use your network connection, you will be asked again if it should be allowed or denied access. This gives the application a status of Ask.

If you change your mind about the access status of an application, you can change its status from the Applications List.

To Change the Status of an Application

  1. Open the Applications List.

  2. Click on the FileName of the appropriate application until the row is highlighted.

  3. Using your mouse, right-click on the highlighted row.

  4. Select the appropriate access status (Allow, Ask, or Block) from the list.

  5. Click OK to close the Applications List.


Advanced Application Configuration

Advanced Configuration | Screensaver Mode | Trusted IP Addresses
Trusted Ports |  | Scheduling

You can configure advanced security settings for each application on your application list by setting certain restrictions on which IPs and Ports an application can utilize.

Advanced Configuration

  1. Open the Applications List by clicking on the Applications icon on the Sygate Personal Firewall main console, or by right-clicking the system tray icon and selecting Applications from the list of choices.

  2. Select the name of the application that you wish to configure advanced settings for. Advanced Configuration is application specific, meaning that the configuration settings will only apply to the application selected in the drop-down box at the top of the screen. Make sure the name of the application is highlighted.

  3. Click the Advanced button at the bottom left corner of the Applications List screen. The Advanced Application Configuration window opens.

Screensaver Mode

  4. Place a check mark in the check box to allow network access to the selected application during Screensaver Mode. If not checked, all network traffic will be blocked while your screensaver is active.

Allow ICMP Traffic

  5. You can allow all ICMP traffic associated with this application by placing a check in the Allow ICMP Traffic checkbox.

Trusted IP Addresses

  6. Enter trusted IPs or IP ranges in the Trusted IPs for Application text box. This IP address or addresses will be trusted for this application. This means that anything arriving from this IP address or address range will be trusted if it is in the form of the above application.

Make sure that you enter a valid IP address. IP address within the following ranges are invalid:

  • 0.0.0.0

  • 255.255.255.255

  • 127.0.0.0 - 127.X.X.X

Remote Server Ports

  6. Check the Act as Client checkbox to allow traffic on these remote ports to be initialized by this computer. For example, if you set remote port 80, and check Act as Client, the application can initialize a connection to any remote host's port 80. However, a remote host cannot initialize a TCP connection with this computer, even if it is using remote port 80.

  7. Enter the ports or port range(s), or select the protocol from the drop-down TCP and UDP lists that can be utilized for this application. Only these ports will be used for this application.

  8. Click OK if the application restrictions are to be in effect constantly. If you wish to set a time limit or schedule specific periods when the restrictions will be in effect, see Enable Scheduling below.

Local Ports

Check the Act as Server checkbox to have the local ports you select initialized only by a remote host.

Enter the ports or port range(s), or select the protocol from the drop-down TCP and UDP lists that can be utilized for this application. Only these ports will be used for this application.

Allow ICMP Traffic

Place a check in this box to allow outgoing ICMP traffic.

Trusted Ports

  7. Enter the ports or port range(s), or select the protocol from the drop-down TCP and UDP lists that can be utilized for this application. Only these ports will be used for this application.

  8. Click OK if the application restrictions are to be in effect constantly. If you wish to set a time limit or schedule specific periods when the restrictions will be in effect, see Enable Scheduling below.

Enable Scheduling

You can also set times for which the advanced configurations take effect. You can trust or disable certain IP addresses or address ranges for specific days or for specified time spans. Similarly, you can schedule days or times spans in which certain ports or port ranges will be trusted or blocked.

  9. Check the Enable Scheduling check box below the Ports section on the Advanced Application Configuration screen.

  10. Select either the During the period below or the Excluding the period below dial.

  11. Select a Beginning Month, Day, Hour, and Minutes from the appropriate pull-down boxes.

  12. Enter a duration in units of Days, Hours, and/or Minutes.

  13. Click OK to set restrictions.


Understanding Logs

What is a Log? | Different Types of Logs
Exporting Logs | Local versus Source View

In Sygate Personal Firewall, a log is a record of information attempting to enter or exit you computer through your network connection. There are four separate logs that monitor different aspects of your network connection.

Logs are an important method for tracking your computer's activity and interaction with other computers and computer networks. They particularly useful in detecting potentially threatening activity, such as port scanning, that is aimed at your computer.

To view the different logs available in Sygate Personal Firewall, click on the Logs icon on the toolbar at the top of the main screen.

click icon to view security log [image] [image] [image] OR click down arrow and select log type

There are four different log types in Sygate Personal Firewall:

System Log

Security Log

Traffic Log

Packet Log

Exporting Logs

Logs can be exported and saved in different locations for the purpose of saving space. You can also select a range of logs to export.

  1. To export a log file, open the log in the Log Viewer.

  2. Open the File menu, and select Export....

  3. In the Save As window, select the location for the log file. We recommend giving it an appropriate name, incorporating the date, and type of log file.

  4. Click Save.

Local View vs Source View

Each Log Viewer window has several menus along the top. The View menu offers a method to jump between the different logs. The Local View and Source View options are also listed under the View menu.


Security Log

Opening the Security Log | Back Tracing Hacking Attempts | Reading the Log Information
Filtering Security Event Logs |  | Viewing the Security Log Events by Date

What is the Security Log?

The Security Log records potentially threatening activity directed towards your computer, such as port scanning, or denial of service attacks.. The Security Log is probably the most important log file in Sygate Personal Firewall.

Opening the Security Log

  1. There are two ways to open the log file from the Sygate Personal Firewall main console. Choose the one that is most useful for your use.

  • Click the downward-pointing arrow next to the Logs Icon. Select Security Log from the List.

  • Open the Tools menu. Select Logs>Security Log....

  2. The Log Viewer will open in a separate window. Every time a security-threatening activity aimed at your computer is recognized by Sygate Personal Firewall, it is recorded in the Security Log. The Log Viewer provides a standard list of these logged events. Each event occupies one line on the system log.

Reading the Security Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the Security Log, these fields are labeled Description and Data.

Icons

The first things that you will probably notice when you open a Security Log are the icons that run along the left side of the first column. These are graphical representations of the kind of attack logged on each line, and they provide an easy way to scan the Security Log for possible system errors.

Icon | Meaning
 | critical attack
 | major attack
 | minor attack

Event Log

The event log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

Column | Meaning
Time | The exact date and time that the event was logged
Security Type | Type of hacking attempt, such as Port Scan, Denial of Service, Trojan horse, etc.
Severity | One of three levels - Critical, Major, or Minor
Direction | Incoming or Outgoing - most attacks are Incoming, that is, they are originating from another computer and are attempting to enter yours. Other attacks, however, like Trojan horses, are programs that you might download onto your computer that then attack from within your computer, and are considered Outgoing.
Protocol | The type of protocol used in the attempted attack - TCP, UDP, ICMP
Destination Host | Name of the remote computer
Source IP | IP address of the traffic source.
Application Involved | This column provides the name and path of the application involved in the log event
Count | Number of attacks logged
Begin Time | The time that the attack attempt began
End Time | The time that the attack attempt ended

Description and Data Fields

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event, such as "Somebody is scanning your computer, with 13 attempts", appears in the Description field.

Back Tracing Hack Attempts

  1. From the Security Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

  3. Sygate Personal Firewall will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

  4. To view detailed information on the original IP address, click the Whois>> button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the security event originated.

  5. Click the Whois<< button again to hide the information.

Filtering the Log Events by Severity

  1. In the Security Log, you can filter the events that you are viewing by the severity level of the attack.

  2. In the Log Viewer, open the View menu.

  3. Select Filter.

  4. The Filter window opens. Place check marks in each box next to the severity level(s) that you wish to view. There are three choices: Critical, Major, and Minor. You can view more than one type of event at one.

  5. The Log Viewer will automatically reload.

Viewing the Log Events by Date

  1. To filter the log event by date, click the View menu in the Log Viewer window.

  2. Select which events you would like to view from the list:

    Events for...

    Displays...

    1 Day Logs

    the events recorded on the current day

    2 Day Logs

    the events recorded over the last two days, including the current day

    3 Day Logs

    the events recorded over the last three days, including the current day

    1 Week Logs

    the events recorded over the past 7 days

    2 Week Logs

    the events recorded over the past 14 days

    1 Month Logs

    the events recorded over the last 30 days

    Show All Logs

    all Security Log events

  3. The log will automatically refresh to display the requested events.


System Log

Opening the System Log

Reading the Log Information

Viewing the System Log Events by Date

What is the System Log?

The System Log records all operational changes, such as the starting and stopping of services, detection of network applications, software configuration modifications, and software execution errors. The System Log is especially useful for troubleshooting Sygate Personal Firewall.

Opening the System Log

  1. There are two ways to open the log file from the Sygate Personal Firewall main console. Choose the one that is most useful for your use.

  • Click the down arrow next to the Logs Icon. Select System Log... from the list of logs.

  • Open the Tools menu. Select Logs>System Log....

  2. The Log Viewer will open in a separate window. Every time an operational change, execution error, or system anomaly occurs, the event is recorded in the System Log. The Log Viewer provides a standard list of these logged events. Each event occupies one line on the system log.

Reading the System Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the System Log, these fields are labeled Description and Data.

Icons

The first things that you will probably notice when you open a System Log (besides the volume of log events) are the icons that run along the left side of the first column. These are graphical representations of the kind of event logged on each line, and they provide an easy way to scan the System Log for possible system errors.

Icon | Meaning
 | error with Sygate Personal Firewall service
 | warning; potential problem with Sygate Personal Firewall service
 | information regarding Sygate Personal Firewall service

Event Log

The Event Log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

Column | Meaning
Time | The exact date and time that the event was logged.
Type | The type of event - this will be either Error, Warning, or Information. An Error log indicates a problem with the source, a Warning log indicates a potential problem, and an Information log merely provides information on an event involving Sygate Personal Firewall.
ID | The ID assigned to the event by Sygate Personal Firewall.
Summary | A brief explanation of the logged event if offered in this field.

Description and Data Fields

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event, such as "Install WsProcessSensor successful....", appears in the Description field.

Viewing the Log Events by Date

  1. To filter the log event by date, click the View menu in the Log Viewer window.

  2. Select which events you would like to view from the list:

Events for... | Displays...
1 Day Logs | the events recorded on the current day
2 Day Logs | the events recorded over the last two days, including the current day
3 Day Logs | the events recorded over the last three days, including the current day
1 Week Logs | the events recorded over the past 7 days
2 Week Logs | the events recorded over the past 14 days
1 Month Logs | the events recorded over the last 30 days
Show All Logs | all Security Log events

  3. The log will automatically refresh to display the requested events.


Traffic Log

Opening the Traffic Log | Reading the Log Information
Viewing the Traffic Log Events by Date | Back Tracing the Log Information

What is the Traffic Log?

The Traffic Log records every packet of information that enters or leaves a port on your computer.

Opening the Traffic Log

  1. There are two ways to open the log file from the Sygate Personal Firewall main console. Choose the one that is most useful for your use.

  • Click the downward-pointing arrow next to the Logs Icon. Select Traffic Log from the List.

  • Open the Tools menu. Select Logs>Traffic Log....

  2. The Log Viewer will open in a separate window. The Log Viewer provides a standard list of logged traffic events. Each event occupies one line on the system log.

Reading the Traffic Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the Traffic Log, these fields are labeled Description and Data.

Icons

The first things that you will probably notice when you open a Traffic Log are the icons that run along the left side of the first column. These are graphical representations of the kind of traffic logged on each line, and they provide an easy way to scan the Traffic Log. The two kinds traffic that are logged in the Traffic Log are incoming and outgoing.

Icon | Meaning
 | incoming traffic; passed through firewall
 | incoming traffic; blocked by firewall
 | outgoing traffic; passed through firewall
 | outgoing traffic; blocked by firewall
 | traffic direction unknown; passed through firewall
 | traffic direction unknown; blocked by firewall

Event Log

The Event Log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

Column | Meaning
Time | The exact date and time that the event was logged
Action | Action taken by Sygate Personal Firewall: Blocked or Allowed
Protocol | Type of protocol - UDP, TCP, ICMP
Direction | Which direction the traffic was moving: into your computer (Incoming) or out of your computer (Outgoing)
Destination Host | The computer TO which the traffic was traveling.
Destination Port/ICMP Type | The destination port number or ICMP type.
Source IP | The IP address that is the source of the traffic.
Source Port/ICMP Type | The computer FROM which the traffic was traveling.
Application Involved | This column provides the name and path of the application involved in the security attack
Count | Number of events that occurred in this time period
Begin Time | The beginning time of the event
End Time | The time the event ended
Rule Name | The rule that determined the passing or blockage of this traffic. If you were blocking certain applications, this column might read “Block_All”. If Sygate Personal Firewall is running at the Normal security level, this might read “Ask all running apps”.

Description and Data Fields

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event appears in the Description field.

Back Tracing Traffic Events

  1. From the Traffic Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

  3. Sygate Personal Firewall will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

  4. To view detailed information on the original IP address, click the Detail button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the traffic event originated.

  5. Click the Detail button again to hide the information.

Viewing the Log Events by Date

    1. To filter the log event by date, click the View menu in the Log Viewer window.

    2. Select which events you would like to view from the list:

Events for... | Displays...
1 Day Logs | the events recorded on the current day
2 Day Logs | the events recorded over the last two days, including the current day
3 Day Logs | the events recorded over the last three days, including the current day
1 Week Logs | the events recorded over the past 7 days
2 Week Logs | the events recorded over the past 14 days
1 Month Logs | the events recorded over the last 30 days
Show All Logs | all Security Log events

    3. The log will automatically refresh to display the requested events.


Packet Log

Enabling the Packet Log | Opening the Packet Log | Reading the Log Information
Back Tracing the Packet Log |  | Viewing the Packet Log Events by Date

What is the Packet Log?

The Packet Log captures every packet of data that enters or leaves a port on your computer. The Packet Log is disabled by default in Sygate Personal Firewall because of its size.

To enable the Packet Log, open the Options window by selecting Options... from the Tools menu. Click on the Log File tab and click the check box next to the text Enable Packet Log. Then click Apply.

Opening the Packet Log

  1. There are two ways to open the log file from the Sygate Personal Firewall main console. Choose the one that is most useful for your use.

  • Click the downward-pointing arrow next to the Logs Icon. Select Packet Log from the List.

  • Open the Tools menu. Select Logs>Packet Log....

  2. The Log Viewer will open in a separate window. All packets are recorded in the Log Viewer, and displayed in a standard list of logged events. Each event occupies one line on the log.

Reading the Packet Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Icons

There is only one icon displayed in the Packet Log. It indicates the capturing of raw data packets.

Icon | Meaning
 | full data packet captured

Event Log

The Event Log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

Column | Meaning
Time | The exact date and time that the event was logged
Remote IP | The IP address of the sender or recipient of the data being logged
Remote Host Name | The name of the host computer
Remote Port | The virtual port being used for this data
Local IP | Your IP address
Local Port | The port being accessed for this data

Back Tracing Packet Log Events

  1. From the Packet Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

  3. Sygate Personal Firewall will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

  4. To view detailed information on the original IP address, click the Detail button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the raw traffic event originated.

  5. Click the Detail button again to hide the information.

Viewing the Log Events by Date

  1. To filter the log event by date, click the View menu in the Log Viewer window.

  2. Select which events you would like to view from the list:

Events for... | Displays...
1 Day Logs | the events recorded on the current day
2 Day Logs | the events recorded over the last two days, including the current day
3 Day Logs | the events recorded over the last three days, including the current day
1 Week Logs | the events recorded over the past 7 days
2 Week Logs | the events recorded over the past 14 days
1 Month Logs | the events recorded over the last 30 days
Show All Logs | all Security Log events

  3. The log will automatically refresh to display the requested events.


Options Window

The Options window contains some of the most important configuration tools in Sygate Personal Firewall. From the Options window, you can configure Network Neighborhood browsing rights, set up email notification for attacks against your computer, set screensaver mode, and configure log files. You can also enable or disable security options, such as stealth mode browsing, anti-IP spoofing, and port scan detection. Additionally, you can allow automatic updates of Sygate Personal Firewall Pro, ensuring you the latest and most powerful version of Sygate personal security.

Opening Options...

To access the Options window, open the Tools menu, and select Options....

The Options Window

The Options window is made up for the General, Network Neighborhood, Security, E-Mail Notification, Log, and Updates tabs.


General Tab

Automatic Launch | Screensaver Mode
System Tray Icon | Password Protection

The General tab provides options for the basic running of Sygate Personal Firewall.

Buttons

  • The OK button applies any changes that you have made in the Options window, and then closes the window.

  • Clicking the Cancel button ignores any changes you may have made in the Options window, and closes the window while retaining the previous settings.

Sygate Personal Firewall Service

Check this box to automatically launch Sygate Personal Firewall at start-up.

System Tray Icon

Checking this box will hide the Sygate Personal Firewall System Tray Icon from view.

Screensaver Mode

Enabling the Screensaver Mode option automatically sets your security level to Block All when your computer’s screensaver is activated. As soon as the computer is used again, the security level will return to the previously assigned level.

Notification

You can enable or disable the system tray notification messages using this checkbox. Additionally, you may select to allow audio announcement of the notification window by checking the Beep before notify checkbox.

Password Protection

Enabling Password Protection will protect your settings from being changed by another user. Password Protection will prompt you to enter your password every time you access the Sygate Personal Firewall main console.

Setting a Password

Changing a Password

To Set a Password

  1. To set a password for the first time, click the Set Password... button. The Password window opens.

  2. Leave the Old Password field blank.

  3. Enter a password in the New Password field, and type it again in the Confirm New Password field.

  4. Click OK.

To Change an Old Password

  1. To change your password, click the Set Password... button. The Password window opens.

  2. Enter your old password in the Old Password field.

  3. Enter a new password in the New Password field, and retype it in the Confirm New Password field.

  4. Click OK.


Network Neighborhood Tab

The Network Neighborhood tab provides multiple interface support and network browsing rights configuration. The Network Neighborhood tab is made up of three sections: Network Interface, Network Neighborhood Settings, and Description.

The settings in the Network Neighborhood section apply to the network displayed in the Network Interface pull-down box.

Network Neighborhood Settings

  1. Select the network from the Network Interface pull-down list.

  2. Decide if you wish to browse other computers on the network and if you wish to allow other users on the selected network to browse your computer. Under the Network Neighborhood Settings section, select the appropriate check boxes:

  • Select the Allow to browse Network Neighborhood files and printer(s) option to browse other files and printers on the selected network.

  • Select the Allow others to share my files and printer(s) to allow other users of the selected network to browse your files and printer(s).

  3. Click OK.


Security Tab

The Security tab offers a way to enable and disable security options. Please note that many of these options are disabled (faded, or "grayed out"). These options are available in our Sygate Personal Firewall Pro 5.0. The options are described below.

Enable Intrusion Detection System

By default, this option is already enabled. "IDS" stands for "intrusion detection system", and is the feature that provides you with alerts when another user attempts to compromise your system. Intrusion detection includes detecting DoS attacks, port scans, Trojan applications, and changed executables.

Enable port scan detection

Port scanning is a popular method that hackers use to determine which of your computer's ports are open to communication. Ports are dynamically blocked in Sygate Personal Firewall, and are protected from hacking attempts. This feature detects if someone is scanning your ports, and notifies you. If disabled, Sygate Personal Firewall will not detect scans or notify you of them, but will still protect your ports from hacking attempts.

Enable driver-level protection (enabled)

This feature, when enabled, blocks protocol drivers from accessing the network unless the user gives permission. If a protocol driver attempts to access the network, you will see a pop-up message asking if you wish to allow it.

Enable stealth mode browsing

"Stealth mode" is a term used to describe a computer that is hidden from other computers while on a network. A computer on the Internet, for instance, if in stealth mode, can not be detected by port scans or communication attempts, such as ping. If you enable this feature, your computer will be invisible to other computers on any network you are on.

Block traffic while the service is not loaded

This valuable feature prevents any traffic from entering or leaving your computer during the precious seconds between the time that your machine turns on and Sygate Personal Firewall is launched. This time frame is a small security hole that can allow unauthorized communication. Enabling this feature prevents possible Trojan horses or other unauthorized applications from communicating with other computers.

Automatically block attacker's IP address for _ seconds

Active response is a feature that blocks all communication from a source host once an attack has been detected. For instance, if Sygate Personal Firewall detects a DoS attack originating from a certain IP address, Sygate Personal Firewall will block any and all traffic from that IP for the duration specified in the seconds field.

Enable DLL authentication (enabled)

DLL stands for "dynamic link library", which is list of functions or data used by Windows applications. Most, if not all, Windows applications use DLLs to run, and each applications uses specific DLLs. Often, several applications will access the same DLL. However, some hackers try to disguise malicious code or applications as DLLs, and use them to hack computers. Most DLLs have the a file extension of .dll, .exe, .drv, or .fon.

Enabling DLL authentication means that you allow Sygate Personal Firewall to determine which DLLs are used by which applications, and to block any DLLs that are not associated with an application.

Because this option can interfere with the functioning of Windows applications, it is recommended that only users who have a firm understanding of Windows and DLLs enable this feature.

Enable anti-MAC spoofing

Like IP spoofing, some hackers use MAC spoofing to attempt to hijack a communication session between two computers in order to hack one of the machines. MAC (media access control) addresses are hardware addresses that identify computers, servers, routers, etc. When Computer A wishes to communicate with Computer B, it may send an ARP (Address Resolution Protocol) packet to the computer.

The anti-MAC spoofing feature prevents blocks any ARP packets sent to your computer. This way, hackers attempting to determine your MAC address is will blocked from doing so. If you request an ARP packet, Sygate Personal Firewall will allow it.

Enable anti-IP spoofing

IP spoofing is a process used by hackers to hijack a communication session between two computers, which we will call Computers A and B. A hacker can send a data packet that causes Computer A to drop the communication. Then, pretending to be Computer A, the hacker can communicate with Computer B, thus hijacking a communication session and attempting to attack Computer B.

Anti-IP spoofing foils most IP spoofing attempts by randomizing the sequence numbers of each communication packet, preventing a hacker from anticipating a packet and intercepting it.

Enable OS fingerprint Masquerading

OS fingerprint masquerading is a feature that protects your OS from being identified by other computers. If you enable this feature, be sure to also enable the anti-IP spoofing feature.

NETBIOS Protection

NETBIOS protection blocks all communication from computers located outside of your subnet range. A subnet range is a group of computers that connect to the same gateway. If your computer is located on an office network, then other computers in your office are most likely on your subnet. If you connect to the Internet using an ISP, such as Earthlink or America Online, your subnet might be very large. In order to further secure your computer against attack, you can disallow file sharing from the Network Neighborhood tab.

Enable smart DNS

Smart DNS is a feature that blocks all DNS traffic, EXCEPT outgoing DNS requests and the corresponding reply. This means that if your computer sends out a DNS request, and another computer responds within five seconds, the communication will be allowed. All other DNS packets will be dropped.

If you disable this feature, please note that you will need to manually allow DNS name resolution by creating an advanced rule that allows UDP traffic for remote port 53.

Enable smart DHCP

Smart DHCP is a feature that allows only outgoing DHCP requests, and only for network cards that allow DHCP.

Should you choose to disable this feature, and need to use DHCP, you must create an advanced rule that allows UDP packets on remote port 67.


E-Mail Notification Tab

The E-Mail Notification tab provides you with the option to automatically notify a specified recipient via email of any attacks against your computer.

To Activate Email Notification

  1. First, select the frequency of notification. You have three choices. Selecting Do Not Notify will disable the email notification option. Select Notify Immediately to have an email sent immediately following an attack on your computer. Alternately, you can select to have an email sent at regular intervals following an attack, by selecting the After Every X Minute(s) dial.

  2. Enter an email address in the From: address field. This can be your personal email address or another email address.

  3. Enter a recipient email address in the To: field. This can be an administrator's email address, or your email address, if you are accessing email remotely.

  4. If you wish, you may send a courtesy copy of each email to a specified email address in the Cc: field.

  5. Enter a subject in the Subject field.

  6. Enter your SMTP Server Address.

  7. If your email server requires authentication, click to check the box next to the indicative text. Enter the address of the authentication server in the Authentication Server Address field.

  8. Enter your username and password for the authentication server in the appropriate fields.

  9. Click OK to save changes.


Log Tab

The Log tab provides a central location to manage the logs for Sygate Personal Firewall. You can determine the standard log size for each log, as well as specify how many days worth of entries are recorded in each log.

To Set Log Size

  1. Click on the appropriate Maximum Log File Size field and enter a size, in kilobytes, of the maximum size for the log file.

  2. Click OK.

To Set Log Days

  1. Click on the appropriate Save Log File for the Past field for the log you wish to configure.

  2. Enter a number of days.

  3. Click OK.

To Clear Log

To clear a log from the Log File tab, simply click the Clear Logs button for the log you wish to clear.

To Enable Raw Traffic Log

  1. Click to check the box next to the Sygate Personal Firewall Pro option.

  2. Select a maximum file size (1024 KB is the default setting).

  3. Enter a number of days for which Sygate Personal Firewall Pro should save the log file entries.

  4. Click OK.


Updates Tab

Use the Updates tab to allow or disable automatic version and attack signature file updates for Sygate Personal Firewall. To be notified of new versions of Sygate Personal Firewall, place a check in the Automatically check for new versions checkbox.

The automatic update download feature is disabled in Sygate Personal Firewall 5.0, but is available in Sygate Personal Firewall Pro 5.0. For more information on, visit our web site at www.sygate.com.


Advanced Rules

To create a rule, you must first specify the kind of traffic that should be affected by the rule. There are several different characteristics of traffic, each of which you can use to specify the kind of traffic that you want to control. There are four different sections within the Advanced Rule Settings window where you can specify the characteristics of the traffic: General, Hosts, Ports and Protocols, Scheduling, and Applications.

Adding Rules

When you create a universal rule, first decide what effect you want the rule to have. Do you want to block all traffic when your screensaver is on? Would you like to allow all traffic from a particular source? Do you want to block UDP packets from a web site?

  1. To begin, open the Tools menu at the top of the main console, and select Advanced Rules. The Advanced Rules window will open.

Place your mouse over a rule to see a summary of the rule's effect

Once you have created rules, they will appear in this list.

  2. Click the Add button. The Advanced Rule Settings window opens.

Exporting a Rule

  1. To export a rule, right-click on the rule name in the Advanced Rules window. The Import/Export pop-up menu will appear.

  2. Select Export Rule.

  3. If you select Export Rule, the Export window will open. Browse through the folders until you determine the location to which you will export the rule. Click Save.


General

The General section is used to specify basic information regarding the rule that you create.

  1. First, enter a rule description. This will also function as the name of the rule, and it should indicate qualities of the rule. For instance, "Rule1" may not be a very good name for a rule, but "Block After 10PM" would be (assuming the rule had some sort of function that did block traffic after 10PM).

  2. Second, decide the main action of the rule - do you want to block traffic, or allow traffic?

  3. Next, choose which network interface card this rule will apply to. If you have multiple network cards, select one from the pull-down list, or select All network interface cards to apply the rule to ever card.

  4. Decide if this rule will be influenced by the activation of your computer's screensaver (if applicable).

  • On - The rule will be activated only when the screensaver is on. This is a great feature if you want to block all traffic and all ports while you computer is idle.

  • Off - This rule will be activated only if the screen saver is off and all other conditions are satisfied.

  • Both On and Off - This rule is unaffected by the screensaver.

  5. Place a check in the Record this traffic in 'Packet Log' checkbox if you want traffic affected by this rule to be entered in the Packet Log.

  6. The Rule Summary field at the bottom of the General tab provides a summary of the rule's functionality.

Hosts

Ports and Protocols

Scheduling

Applications


Hosts

The Hosts tab is where you can specify the source (IP address, MAC address, or Subnet range) of traffic that you wish to block or allow.

Select the way in which you want to identify the traffic source. You can use the All Addresses option if you are planning on blocking traffic from all sources for this rule. Enter the corresponding address or address range.

General

Ports and Protocols

Scheduling

Applications


If you select TCP, next enter choose the port type from the drop-down list for both the remote and the local ports.

If you select UDP, next enter the port or port range in the Remote and Local fields.

If you select ICMP, you will next need to select the ICMP type from the list by placing a check next to each type you want the rule to affect.

If you select IP Type, you will then need to enter IP Type in the IP Type field.

Ports and Protocols

The Ports and Protocols tab provides an area to specify which ports and protocols, if any, should be affected by the traffic specified in the rule.

  1. Select a protocol from the top pull-down box. Select ALL if you want the rule to apply to all protocols. You can also choose TCP, UDP, ICMP, or IP Type.

  2. Then, select the traffic direction from the pull-down list.

  3. Then click OK.

General

Hosts

Scheduling

Applications


Scheduling

Scheduling is a great way to create a rule that you want to take effect only during (or excluding) certain time periods. For instance, if you want to block all traffic after 10PM, then you can create a schedule that will permit the rule to do so.

  1. Place a check in the Enable Scheduling checkbox.

  2. Decide if you want the schedule to take place during a certain time period, or outside of a certain time period. Select either During or Excluding.

  3. Select a month, day and beginning time from the pull-down lists, or leave the default settings, which will apply the rule schedule to all day, every day, all year.

  4. If you have a beginning time, enter a duration for the rule's effect.

  5. Click OK.

General

Hosts

Ports and Protocols

Applications


Applications

You can now specify applications that will be affected by advanced rules. The Applications section provides a list of all applications that have accessed your network connection.

To select an application to be affected by this rule, simply place a check next to its name under the FileName column. You can select all applications in the table by clicking the Select All button. To browse for applications that are not displayed in the table, click the Browse button and select the application from its directory.

You can choose to display only the applications that you have selected to be controlled by this rule by placing a check in the Display selected applications only checkbox.

The Rule Summary at the bottom of the window provides a description of the rule and what traffic it will affect on your system.

General

Hosts

Ports and Protocols

Scheduling


Sygate Online Services

SOS Vulnerability Assessment

Assessing your vulnerability to attack and testing your firewall are some of the most important things you can do to ensure that you are protected from possible intruders.

Click the Test button located on the main console of Sygate Personal Firewall, or select Test Your System Security from the Tools menu.

The Sygate® Technologies web page (http://scan.sygatech.com) will load, and the Sygate® Online Services scanner will scan your computer and attempt to determine your IP address, operating system, and web browser.

Six Different Scans

There are six different scans available through Sygate® Online Services, listed along the left side of the main scan page. To view a brief description of the scan, click the name once. The description will load on the right side of the screen.

To Scan

To utilize a scan, click on the name of the scan and then click the Scan Now button.

A brief document of frequently asked questions about Sygate® Online Services can also be accessed from the main scan page, by clicking link labeled Scan FAQ at the bottom, left hand side of the screen.

Quick scan

Quickscan is a brief, general scan that encompasses several scan processes. The Quickscan feature usually takes 40 seconds or less to accurately scan your computer’s ports, protocols, services, and possible Trojans. Quickscan will be recorded in Sygate Personal Firewall's Security Log.

Stealth scan

Stealth scan scans your computer using specialized stealthing techniques, which mimic portions of legitimate computer communication in order to detect the presence of a computer. The Stealth scan takes about 40 seconds to complete, and will most likely not be recorded in the Security log.

Trojan scan

The Trojan scan feature scans all of your computer’s 65,535 ports for active Trojan horse programs that you or someone else may have inadvertently downloaded onto your computer. The Trojan scan takes about 10 minutes to complete. A list of common Trojans is available on the Web site.

TCP scan

The TCP scan examines the 1,024 ports that are mainly reserved for TCP services, such as instant messaging services, to see if these ports are open to communication. Open ports indicate a dangerous security hole that can be exploited by malicious hackers.

SOS TCP scan will scan devices such as routers and proxies for users connecting to the Web site through such a device. The scan takes roughly 20 minutes to complete and is logged by Sygate Personal Firewall as a scan event in the Security log.

UDP scan

The UDP scan uses various methods and protocols to probe for open ports utilizing UDP. SOS UDP scan will scan devices such as routers and proxies for users connecting to the Web site through such a device. The scan takes about 10 minutes and should be logged in the Security log as a portscan from Sygate®.

ICMP scan

When an SOS scan has completed scanning a user’s computer, it will display a page with the results of the scan. If a user is running Sygate Personal Firewall, all scans should be blocked.


Changed Application Pop-up

Occasionally, you might see a pop-up such as the one pictured below.

What does this mean? Generally, it means that you have recently upgraded the application pictured on the pop-up. As Sygate Personal Firewall uses checksum to determine the legitimacy of an application, an upgraded version might not pass the checksum test, since a new build or new version of the application is likely to have a different checksum value.

On the other hand, if you haven’t upgraded the application recently, and see no reason why this message should appear, this could be an instance of a new Trojan horse trying to access your network.

What Should I Do?

If you have recently upgraded the application mentioned on the pop-up message, it is probably safe to click Yes and allow the application network access.

However, if you do not think that you have recently upgraded the listed application, you should select No and run an anti-virus software program or, if you are at work, contact you IT department.


New Application Pop-up

In the beginning, it might be common for you to see the following pop-up message:

What does this mean? Well, it means that Microsoft Internet Explorer is trying to access your network connection, and is attempting to connect to the web site scan.sygatetech.com., which has an IP address of 207.33.111.332, at that site’s server port 80. That’s plenty of information to take in.

What caused this pop-up?

  • You might have tried to open the application. Either this is the first time that you have done so since you installed Sygate Personal Firewall, or you have assigned this application a status of “Ask”, meaning that every time it tries to access your network connection, Sygate Personal Firewall will ask you for permission to grant it access.

  • You might have clicked on a link to a web site, or tried to open another program that might use this application.

  • If you have copied a picture or text from the Internet and pasted it into another document, the receiving application may try to access the Internet.

What if you didn’t open any program or click on any link, and a program suddenly tries to access your network connection? If you haven’t opened any programs that use the application listed on the pop-up message, or can’t see any reason why that application should try to access your network connection, it is always safest to say No. This might indicate the presence of a Trojan horse on your computer, something that needs to be checked immediately.

Clicking the Details button opens another information field containing further details on the application.

What Should I Do?

This kind of message is common when you first start using Sygate Personal Firewall. In this particular example, Microsoft Internet Explorer is trying to access a Sygate® Technologies web site at the remote port 80. Most servers use port 80 to send and receive information on the Internet, so this isn’t anything unusual.

If you believe that you have triggered this application, it would be safe to click Yes. You have the option to tell Sygate Personal Firewall to remember the your answer for future reference. If you check the box marked Remember my answer, and do not ask me again for this application, Sygate Personal Firewall will remember your choice, and will act accordingly the next time this application tries to access your network connection.

If You Select “Yes”

If you have tried to open an application (such as a web browser) or a program that uses another application to access the Internet (such as a media streaming program) and you feel comfortable granting this application access to your network connection, then you can select Yes.

If You Select “No”

However, if a pop-up message is unexpected, and you can’t see any reason why the listed application should access the network connection, select No. This will assign the application or service a status of Block, so that it will be automatically blocked from your network connection any time it tries to gain access.

You should also run a virus scan to make sure that you have not inadvertently downloaded a virus or a Trojan horse that could infect your computer files.


Trojan Horse Warning

If Sygate Personal Firewall detects a known Trojan horse on your computer, you will be alerted with a message such as the one pictured below.

What Should I Do?

If at work, you should immediately notify your IT department. If you receive the notification on your home computer, you should purchase some anti-virus software. Some companies offer free trial versions of their anti-virus programs.