kerio 2.1.5 (last freeware version), strange behaviour, related to port logger and svchost.exe

q_q_anonymous · 2006-07-31T15:51:38+00:00

i'm trying kerio out, it seems to have a bad port logger. not pickingup smtp or pop. I wonder if sygate would've seen it. (ethereal sees it)Why should kerio miss that out? How is it deciding what to miss out?Sometimes when browsing , page weren't loading up, a little red arrowflashes on the icon.I disabled kerio and immediately the page loaded up.I opened the port logger and then went to logs..firewall log, to seewhat it was blocking.(unlike sygate, it doesn't include blocked connections in the scren ofthe port logger. It's elsewhere)I saw it had blocked " SSDP " - particularly. There was Listening onmy machine 192.168.14.4:1900 svchost.exe , it was blocking incomingconnections from my "NAT router" 192.168.1.1:20xy: to my machine.I thought PFWs didn't block svchost.exe Anyhow, even after adding arule to allow my router to connect to me (from any port) to me @ 1900,I was still getting red arrows and inaccessible and a list of SSDPblocked. I haven't noticed a problem loading up pages though.I then noticed, that amongst all the ALLOWED including allowed foroutgoing svchost.exe, there was a deny for incoming to my port 1900 -svchost.exe.Is it using a strict policy - white list. Or a black list. It lookslike a "white list", many svchost.exe rules allowed. But I've just seenan explicit rule to *deny* SSDP incoming - from any ip any port onto mymachine's port 1900. If it's a whitelist, why should it be necessaryto say that? And isn't it a silly thing to deny anyway, it should bepermitted in the white list! I have amended it to permit it from myrouter any port. to my comp port 1900.If only sygate was fixed. It kicks kerio to pluto. Is there any way tonullify whatever security problem sygate has with the open windows?!!Actually, on trying to post this, Kerio gave 2 flashes of a red arrowpoitning upwards, like giving me the finger. And it fails to post.Listing nothing under blocked. disabling kerio lets me send thispost!! I guess that problem is unique, but...

Jul 31, 2006 42 Replies

Rate this thread:

Ansgar -59cobalt- Wiechers 20 years ago

You put up the claim, you bring the proof. That's how it works.

That unsupported claim of yours doesn't shoot down anything.

You still failed to explain why that would be.

59cobalt

Vote

q_q_anonymous 20 years ago

no, that only redirects a FQDN. so I could theoretically block google.com or

formatting link

- redirecting them to 127.0.0.1 - I run no web server. It would block certain http requests, but it wouldn't do so based on http fields any more than it would do so for tcp ports.

Vote