Wieso ist immer noch anpingen möglich

Internet Internet Sicherheit
1

Hallo!

Kann mir bitte jemand erklären, warum mein Rechner bei folgenden Rules in Norton Internet Security 2000 immer noch auf Pings antwortet?

Markus

P.S.: Sorry fürs lange Posting, aber ich habe vorsichtshalber mal ALLE Rules gepostet… (normalerweise ist Rule 25 fürs PingBlocken zuständig, aber anscheinend scheint es nicht zu greifen, ich hab nur keine Ahnung warum nicht!!!
Die vorangehenden Freigaberegeln gelten nur fürs interne Netz (10.0.0.1 (mein Rechner) - 10.0.0.255), und ansonsten steht der Ping-Blocker vor allen anderen Freigaberules…

Rule 1 ICQ Application
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Block
Direction: Outbound
Application: (ICQ Application_1)
… c:\internet\icq\icq.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (web.icq.com)
…HostName: web.icq.com
…IP: 205.188.248.25
…IP: 205.188.248.89
…IP: 205.188.248.57

Rule 2 FALCHNETDEVSTUDIO.EXE TCP/UDP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: (FALCHNETDEVSTUDIO.EXE)
… c:\sonstiges\palmprogramming\falch.net\developerstudio 2.5\falchnetdevstudio.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 3 Delphi-32 Development Environment TCP/UDP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: (Delphi-32 Development Environment)
… c:\sonstiges\delphi 5 enterprise edition\delphi5\bin\delphi32.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 4 TANKS.EXE TCP/UDP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: (TANKS.EXE)
… d:\download\tanks\tanks\tanks.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 5 Werbeserver
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (bootstraps.conducent.com)
…HostName: bootstraps.conducent.com
…IP: 216.35.217.132

Rule 6 Werbeserver
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (ans4.adsoftware.com)
…HostName: ans4.adsoftware.com
…IP: 206.112.72.59

Rule 7 Werbeserver
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (ans3.adsoftware.com)
…HostName: ans3.adsoftware.com
…IP: 208.184.172.196

Rule 8 Werbeserver
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (ans2.adsoftware.com)
…HostName: ans2.adsoftware.com
…IP: 208.184.172.197

Rule 9 Werbeserver
Category: General
Rule in use: YES
Logging: YES after 1 matche(s), No Security Alert
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (ans1.adsoftware.com)
…HostName: ans1.adsoftware.com
…IP: 216.37.13.196

Rule 10 Werbeserver
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (service.bfast.com)
…HostName: service.bfast.com
…IP: 64.69.165.248

Rule 11 Werbeserver (Opera)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (rgs2.opera.com)
…HostName: rgs2.opera.com
…IP: 212.29.215.4

Rule 12 Werbeserver (Opera)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (rgs1.opera.com)
…HostName: rgs1.opera.com
…IP: 209.11.42.235

Rule 13 Werbeserver (Gator.com)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (scriptserveraustin.eguard.com)
…HostName: scriptserveraustin.eguard.com
…IP: 216.30.17.4

Rule 14 Werbeserver (Gator.com)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (regserver.gator.com)
…HostName: regserver.gator.com
…IP: 208.184.198.79

Rule 15 Werbeserver (Gator.com)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (bannerserver.gator.com)
…HostName: bannerserver.gator.com
…IP: 208.184.198.94

Rule 16 Werbeserver (TV - Zeitung)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (ads.hbv.de)
…HostName: ads.hbv.de
…IP: 194.163.254.211

Rule 17 Werbeserver (Phonehome für Naviscope und Andere Programme)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (207.230.126.50)
…HostName: 207.230.126.50
…IP: 207.230.126.50

Rule 18 Werbeserver (Phonehome WS_FTP?)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (212.52.224.131)
…HostName: 212.52.224.131
…IP: 212.52.224.131

Rule 19 Werbeserver (ICQ)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Block
Direction: Outbound
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (cb.icq.com)
…HostName: cb.icq.com
…IP: 205.188.250.25

Rule 20 Default DNS
Category: General
Rule in use: YES
Logging: NO
Protocol: UDP
Action: Permit
Direction: Either
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote Service: (53)
…Port: 53
Remote Address: Any Address

Rule 21 Default Outbound Loopback
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Outbound
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (localhost)
…HostName: localhost
…IP: 127.0.0.1

Rule 22 Default Inbound Loopback
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Inbound
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (localhost)
…HostName: localhost
…IP: 127.0.0.1

Rule 23 Interne Netzfreigabe (Outbound)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Outbound
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (10.0.0.1-10.0.0.255)
…Range begin: 10.0.0.1
…Range end: 10.0.0.255

Rule 24 Interne Netzfreigabe (Inbound)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Inbound
Application: Any Application
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: (10.0.0.1-10.0.0.255)
…Range begin: 10.0.0.1
…Range end: 10.0.0.255

Rule 25 Ping - Defender
Category: General
Rule in use: YES
Logging: NO
Protocol: ICMP
Action: Block
Direction: Either
Application: -
Local Service: (Echo Request)
…Port: 8
Local Address: Any Address
Remote Service:
…Port: 0
…Port: 8
Remote Address: Any Address

Rule 26 NetBIOS Defender
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Block
Direction: Either
Application: Any Application
Local Service: (135 - 139)
…Range Begin: 135
…Range End: 139
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 27 Proxy+ Inbound Defender
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Block
Direction: Inbound
Application: Any Application
Local Service: (4480)
…Port: 4480
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 28 Default ICMP
Category: General
Rule in use: YES
Logging: NO
Protocol: ICMP
Action: Permit
Direction: Either
Application: -
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 29 GetRight Inbound FTP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Inbound
Application: (GetRight® www.getright.com_1)
… c:\internet\getright\getright.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (20)
…Port: 20
Remote Address: Any Address

Rule 30 Proxy+ Inbound FTP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Inbound
Application: (Proxy server & cache for Windows95, 98, NT)
… c:\internet\proxyplus\proxyplus.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (20)
…Port: 20
Remote Address: Any Address

Rule 31 Proxy+
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (Proxy server & cache for Windows95, 98, NT_1)
… c:\internet\proxyplus\proxyplus.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 32 Forte Free Agent
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (Free Agent for Windows)
… c:\internet\forte agent\agent.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (nntp)
…Port: 119
Remote Address: Any Address

Rule 33 Internet Explorer
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (Internet Explorer)
… c:\programme\internet explorer\iexplore.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 34 ICQ Application
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (ICQ Application)
… c:\internet\icq\icq.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (aol)
…Port: 5190
Remote Address: Any Address

Rule 35 PGP Key Manager
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (PGP Key Manager Application)
… c:\sonstiges\pgp\pgpkeys.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (389)
…Port: 389
Remote Address: (161.69.2.21)
…HostName: 161.69.2.21
…IP: 161.69.2.21

Rule 36 PGP Key Manager
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (PGP Key Manager Application_1)
… c:\sonstiges\pgp\pgpkeys.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (11371)
…Port: 11371
Remote Address: (161.69.2.21)
…HostName: 161.69.2.21
…IP: 161.69.2.21

Rule 37 Pegasus Mail POP3 (T-Online)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (WINPM-32.EXE)
… c:\internet\pmail\winpm-32.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (pop3)
…Port: 110
Remote Address: (pop.t-online.de)
…HostName: pop.t-online.de
…IP: 194.25.134.88
…IP: 194.25.134.25
…IP: 194.25.134.89
…IP: 194.25.134.26
…IP: 194.25.134.90
…IP: 194.25.134.27
…IP: 194.25.134.91
…IP: 194.25.134.24

Rule 38 Pegasus Mail SMTP (T-Online)
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (WINPM-32.EXE_1)
… c:\internet\pmail\winpm-32.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (smtp, port 25)
…Port: 25
Remote Address: (mailto.t-online.de)
…HostName: mailto.t-online.de
…IP: 194.25.134.24
…IP: 194.25.134.88
…IP: 194.25.134.25
…IP: 194.25.134.89
…IP: 194.25.134.26
…IP: 194.25.134.90
…IP: 194.25.134.27
…IP: 194.25.134.91

Rule 39 Cash-Machine
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (Cash-Machine Application)
… c:\internet\cash-machine v3\cashmachine.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (http, port 80)
…Port: 80
Remote Address: Any Address

Rule 40 GetRight
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (GetRight® www.getright.com)
… c:\internet\getright\getright.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 41 JAP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (Microsoft® Java Befehlszeilen-Interpreter)
… c:\winme\wjview.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 42 JAVAW.EXE TCP/UDP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Outbound
Application: (JAVAW.EXE)
… c:\winme\javaw.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 43 The Proxomitron TCP/UDP
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Outbound
Application: (The Proxomitron)
… c:\internet\proxomitron\proxomitron.exe
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address

Rule 44 HotSync® Manager Application
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (HotSync® Manager Application)
… c:\sonstiges\palm\hotsync.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (http, port 80)
…Port: 80
Remote Address: (sync.avantgo.com)
…HostName: sync.avantgo.com
…IP: 63.251.248.4

Rule 45 AVP Updates
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP
Action: Permit
Direction: Outbound
Application: (AVP Updates)
… c:\programme\gemeinsame dateien\avp shared files\avpupd.exe
Local service: Any Service
Local Address: Any Address
Remote Service: (http, port 80)
…Port: 80
Remote Address: (updates2.kaspersky-labs.com)
…HostName: updates2.kaspersky-labs.com
…IP: 194.135.30.80

2

Kann mir bitte jemand erklären, warum mein Rechner bei
folgenden Rules in Norton Internet Security 2000 immer noch
auf Pings antwortet?

Hallo Markus!

Verwende statt der Regel 25 mal die beiden folgenden:

Rule: Inbound ICMP echo request
Action: Block
Direction: Inbound
Protocol: ICMP
Type: Echo Request
Remote Address: Any
Local Address: Any

Rule: Outbound ICMP echo reply
Action: Block
Direction: Outbound
Protocol: ICMP
Type: Echo Reply
Remote Address: Any
Local Address: Any

Im Gegensatz zu Deinem Ruleset werden so ausgehende Pings und die erwartete Antwort zugelassen, jedoch keine eingehenden und deren Antwort.

CU
Markus

3

Hallo!
Hab ich auch schon versucht.
Das Problem ist ja auch nicht, das ich nicht pingen kann, sondern das mein Rechner immer noch von aussen anzupingen ist, was ja sowohl mit deinem als auch mit meinem ursprünglichem Ruleset eigentlich nicht mehr möglich sein dürfte.

Markus

Hallo Markus!

Verwende statt der Regel 25 mal die beiden folgenden:

Rule: Inbound ICMP echo request
Action: Block
Direction: Inbound
Protocol: ICMP
Type: Echo Request
Remote Address: Any
Local Address: Any

Rule: Outbound ICMP echo reply
Action: Block
Direction: Outbound
Protocol: ICMP
Type: Echo Reply
Remote Address: Any
Local Address: Any

Im Gegensatz zu Deinem Ruleset werden so ausgehende Pings und
die erwartete Antwort zugelassen, jedoch keine eingehenden und
deren Antwort.

4

ich hab die antwort
hallo!
wie ich grad rausgefunden hab, führt die firewall aus irgendeinem grunde nur noch applikationsbezogene regeln aus, der rest ist ihr schnuppe!!! fragt mich nicht warum, wenn ihr es wisst lasst es mich wissen…
ich werd das teil jetzt mal neu installieren und schauen wie’s ausschaut.

markus

5

doch nicht
f**k, neuinstallation bringt auch nix, aber ich hab jetzt noch gemerkt, das auch das werbungblocken nicht mehr funzt…
es werden halt nur noch die regeln ausgeführt, die sich auf irgendeine konkrete applikation beziehen :frowning:

ich hab eigentlich wenig lust, windows komplett neu zu installieren, weis jemand von euch rat?

markus

6

Hi.

Ist die 10.0.0.1 definitiv die einzige Adresse auf deinem Rechner?

Ich bin zwar nicht der absolute Crack für Norton, aber falls dein Rechner mehrere IP’s intern benutzt (z.B. eine fürs interne Netz und eine offizielle fürs Internet) mußt du die Rules an die entsprechenden IP-Adressen binden (das ist jedenfalls das Prozedere bei „richtigen“ Firewalls :wink:) )

Vielleicht hilft der Tip ja ein bisschen

Gruß

Markus