software firewall that allows inter-process traffic control?

That's not possible.

cu

No, it doesn't seem too useful, but it is possible, at least on many computer systems. On Linux, Netfilter works on the loopback interface as well as on any other; and some of the more esoteric modules will allow you to do just this.

That being said, configuring the proxy well is likely to be far more beneficial. Plus I wouldn't know how to what you describe... on Windows. ;-)

Joachim

Any *decent* software firewall should be able to do that as long as the connection to the proxy is a regular IP connection so that it goes through the regular IP stack.

I use Kerio Personal Firewall 2.1.5 to allow/block connections to the AdSubtract Pro HTTP proxy program that I run on my PC.

What you are trying to do is possible with any decent firewall software. It has nothing to do with inter-process trafic control, just IP filtering.

inter-process traffic control is not possible, since its not based on IP. If it IS based on IP, use a normal firewall.

Also, large NAC suites like the one from Sygate can deliver the same services company wide.

Wrong. He wants to prevent a certain program from accessing the proxy. That's simply impossible because all I have to do is stick a proxy of my own between them.

cu

Well, that gets a little harder when you use whitelists instead of blacklists, as you should, but yes.

There are probably quite a few ways around it, and it is of course nonsense if the blocked program runs with administrator rights, as is likely the case on Windows, but it's not *impossible*.

Just pretty senseless, and very nearly impossible to get right.

Joachim

When programs are whitelisted (on a Windows box) then you start with the kinky stuff. If at least one program is allowed to access the proxy, then every other program can too, because it can be controlled through window messages. Have a look at e.g. [1].

If there are ways around it, then it *is* impossible. At least for every definition of "impossible" that I am aware of.

Let me restate it more clearly: the above approach, done right, might stop the attack vector described (i.e. the process in question, itself, cannot connect), however, there are other ways to the same end (like you described) which cannot reasonably all be blocked, hence 'not too useful'.

(And, of course, the one way to stop [1] is not to present a GUI (to unpriviliged users). Which is, IMNSHO, generally a good idea for daemons, or 'services'.)

Joachim