How can I see what Firewall is doing?

Written by

Firewall provides several ways to view network activity:

1. The summary list in the Firewall tab in Software Station
2. The summary list in the Firewall window display area
3. The data in the Firewall window Status Bar

You can view the Firewall Network Activity Graph in several different ways:

1. In the Firewall tab in Software Station, click Show Firewall to display the full-size Firewall window with the Network Activity Graph in the toolbar.
   
   
   


2. Click the Small button in the full-size Firewall window to display the graph in a small window, shown below.
   
   
   


3. Click the Task Bar button in either the full-size or small Firewall window to move the graph to the taskbar.
   
   Note: By default, the Task Bar button is not activated. To activate the button:
1. Right-click in an empty area in the taskbar to display the taskbar menu.
2. Select Toolbars > StopSign Firewall to activate the button.
3. Click the Task Bar button or the Windows Minimize button in either the full-size or small Firewall window to display the Network Activity Graph in the taskbar.
   Caution: Do not remove or uninstall Firewall when the Task Bar button is enabled. This will hide the taskbar's Quick Launch icons.
4. To restore Firewall to either the full-size or small window from the taskbar, right-click the minimized Firewall in the taskbar and select either Full Size or Small from the popup menu.

To disable the Task Bar button:

1. Right-click in an empty part of the taskbar to display the popup menu.
2. Select Toolbars > StopSign Firewall.

If you have activated the Task Bar button as described in the previous procedure, the Toolbars > StopSign Firewall option should have a checkmark by it. Selecting the option now unchecks it and turns off the Task Bar button in the Firewall window. You can now remove or uninstall Firewall without affecting the taskbar's Quick Launch icons.

How do I block a site with Firewall?

Written by

To block a site you do not want accessed from your computer, follow these instructions:

1. From the Firewall tab in Software Station, click Show Firewall to display the Firewall window.
2. Click Network Zones.
3. Double-click the Blocked zone to display the Blocked Properties window.
4. Click the Hosts tab.
5. Click the Create new item button or right-click in the Blocked Properties window and select Create New to display the Host window.
6. In the Enter IP address or host name field, enter the address of the site you want to block, in the format www..com and click OK. Firewall retrieves the host address and adds it to the list.
7. Click OK in the Blocked Properties window to close it. Firewall displays a message telling you that the change you have made does not have influence on established connections, only on new connections.
8. Click OK to close the message window.

How do I change the protection level?

Written by

When you first install Firewall, the default protection level is Allow Most. A useful setting to use when you are becoming familiar with Firewall is Learning Mode, which you set by selecting Firewall > Learning Mode in the Firewall window.

In Learning Mode, when Firewall detects network activity it has no defined rule for, it displays a message describing the activity and asks if you want to allow or block it. Firewall makes recommendations about whether to allow or block activity.

How do I install Firewall?

Written by

To download Firewall from Software Station:

1. Click the StopSign icon button on the left side of the Software Station window to display the StopSign pane.
2. Click the Add/Remove tab.
3. Scroll through the product list until you find the StopSign Computer Protection Service heading and click the Add link beside Firewall.
4. Click Yes in the eAcceleration Install confirmation window.

A download progress window will appear. When the download completes, a confirmation window appears.

5. Click OK.
   Caution: Before restarting your computer, close all applications except Software Station.
6. Restart your computer to complete the Firewall installation.

What are alert levels and how do I change them?

Written by

The alert level determines how often Firewall displays alerts about network events:

1. Never
2. Only for defined events (default)
3. For all events

An example of an alert is shown below.

To change the alert level:

1. Select Options > Settings to display the Settings window.
2. In the General tab, click the drop-down menu in the Alert Level field and select an option:
   • No Alerts
   • Show defined alerts
   • Show alerts for all events
3. Set the time for the alert window timeout (how long the window is displayed before automatically closing). (Default: 30 seconds)
4. Set the appearance of the alert window:
   • Remember last visited snap-in (displays alert windows at the same onscreen position as the previous alert window)
   • Always on top (puts the alert on top of open windows)
5. Click OK to save your settings.

What are network events?

Written by

Network events are any type of activity that goes across the network. They could be programs from your computer sending out information, or other computers trying to receive information from your computer.

When there is activity on your network - either outgoing or incoming - Firewall can alert you of this activity by displaying a Network Event window, depending on the protection level and alert level you have set. An example of a Network Event window that Firewall displays is shown below.

In this window you can choose to:

1. Block an event once by unchecking the Always take this action setting and clicking Block. If the same event occurs again, Firewall again prompts you to take action on it.
2. Allow an event once by unchecking the Always take this action setting and clicking Allow. If the same event occurs again, Firewall again prompts you to take action on it.
3. Create a rule to either block or allow an event if the same event occurs in the future. Do this by checking the Always take this action setting and clicking either Block or Allow. The next time the event occurs, Firewall will take the required action on the event - block or allow it, based on this rule - and not alert you about the event.
4. Display advanced block or allow options by clicking the down arrow next to the Block or Allow buttons, or clicking Advanced.

What are plug-ins?

Written by

A plug-in is an extra program, or extension, that works with Firewall. Firewall has a plug-in called Attack Detector that works with Firewall to recognize and prevent some types of network attacks, such as floods (a large number of data packets sent from a remote host) and port scanning (repeated connection requests from a remote host).

What do the different Firewall protection levels do?

Written by

Firewall has six levels of protection for your computer. They range from allowing all network traffic to blocking all traffic and locking the network. The different protection levels are:

Protection Option:	Description:
Allow All	Turns Firewall off so Firewall will not monitor network traffic and apply rules. The Firewall window remains displayed.
Allow Most	(Default protection level when you install Firewall) Allows all network traffic not specifically prohibited by Firewall's policy rules, including applications that have no rules defined for them.
Learning Mode	Allows network traffic from common applications and prompts you to permit traffic from applications that Firewall does not know about. Learning Mode helps automatically construct rules for specific applications and is especially useful when you are unfamiliar with firewalls or when you are initially configuring the rules that Firewall will apply to applications.
Block Most	Blocks all network traffic except from those applications specifically allowed by Firewall's rules. You can use this mode to provide greater security for your computer after you have configured the rules for your applications.
Block All	Immediately blocks all inbound network traffic. This mode still acknowledges network communications, and your computer remains visible on the network. Note: Block All blocks TCP/IP and UDP traffic. Other protocols are controlled based on Firewall's global- and system-level rules.
Lock Network	Blocks both inbound and outbound network activity, isolating your computer from the network. Firewall ignores all network communications, making your computer invisible on the network. You can use this mode when you suspect your computer is infected by a virus to help prevent the virus's spread to other computers on the network.

Before you can change the protection level from the default of Allow Most, you must configure Firewall.

What should I do if Firewall is blocking a program I want to use?

Written by

If Firewall blocks a program you want to use, you can either:

1. Change your protection level to Learning Mode, which lets you choose which activities to block or allow.
2. Use Firewall's Log to select and unblock the application.

To change your protection level:

1. Open eAcceleration Software Station by selecting Start > Programs > eAcceleration > eAcceleration Software Station.
2. Click the StopSign icon.
3. Click the Firewall tab.
4. In the Firewall tab, click Show Firewall to display the Firewall window.
5. In the Firewall window, select Firewall > Learning Mode.

Firewall will now prompt you when it detects activity it does not recognize, letting you allow or block the activity.

To use the Firewall Log to unblock an application you want to use:

1. In Firewall's navigation area, click Log to display the network event log.
   Note: By default, the log constantly updates and scrolls.
2. To temporarily stop the log from scrolling, click the Pause button in the log's toolbar.
3. Click the Action header to sort events by action and make your search easier.
4. Use the scrollbar to move down the list of events and search for the application you want to unblock.
5. Click the application to select it.
6. Either:
   • Click the Allow All Activity button in the toolbar.
   • Right-click the selected application and select Allow All Activity from the popup menu.
7. Click the Pause button to enable the log to update and scroll again.
8. If you sorted by Action, click the Date Time header to return to the log's default sorting method.

What should I do when I see a program trying to send or receive data?

Written by

When Firewall displays a Network Event window, prompting you to allow or block the activity, you have several choices:

1. If the network event is from a known safe program, ensure the Always take this action checkbox is checked and click Allow.
2. If you see many events for the same program, click the down arrow next to Allow and select Allow all for this application.
3. If the network event is from a known harmful program, block this activity by ensuring the Always take this action checkbox is checked, click the down arrow next to Block, and select Block all for this application.
4. If the network event is from a program you are unfamiliar with, ensure the Always take this action checkbox is NOT checked and click Block. Check the common programs you use to determine what the program is. If the Network Event window displays again for this activity and you are still unsure what the program is, block the activity and click I'm not sure (send report) for technical assistance about the activity.

Why won't Firewall turn on?

Written by

If you are running another firewall on your computer, you might have difficulty turning on StopSign Firewall. To run StopSign Firewall, remove or turn off any other firewall programs.