Firewall FAQs

How to limit access on certain port for all applications?

• Create the profile called "common".
• Put there the rules as desired
• Assign this profile to each application group.

Then, whenever you would change the rule in the "common" profile it would be automatically applied to all groups and applications.

What is 'Closed' or 'Unopened' port?

There may be a network communication coming to your computer on a specific port, which is not served by any running application on your computer at that point. That's when TPF4 reports the communication on closed port. You can set up how to handle such network communication in System Applications profile.

TPF4 is dropping packets coming on closed port by default. A very good example of the management of communication on closed port is ICS (Internet Connection Sharing).

Note! You can delete all predefined profiles except of System Application Profile!

How to handle ICS?

ICS (Internet Connection Sharing) may be very well secured using TPF4. When using ICS you need to set up the rules allowing the communication on 'Closed Port' since the packets are passing TPF4 computer to other destinations and therefore they are not destined to any application in your computer.

When ICS is in place TPF4 experiences the network communication coming to it but it does not see any application listening (ready to receive) such communication. Normally TPF4 would drop such communication but it would not do any good to ICS. In order for TPF4 not to drop such communication you need to set up the rule allowing the communication on closed port for all protocols.

In order to do that go to the System Applications Profile, edit all incoming rules and change the value for 'Closed' port from prevent to allow.

What is the security impact of 'Closed' port?

You do not have to worry about the security issue since you allowed communication on 'closed' ports only. Network communication on 'opened' ports (ports served by running applications) is secured by other rules in place. The effect of allowing the communication on 'closed' port may be expressed by say "there is nothing answering if there is nothing listening". Therefore the potentials hacker would have no luck even when you allow the communication on these 'closed' ports.

How to build custom rules?

• You need to create the firewall object or use existing predefined object
• Create the profile using new rules or edit/add rules in existing profile
• Make sure you assign the profile to correct application group

Note! One profile may be assigned to multiple application groups!