Best free firewall for Windows?

[Armando]

  Well, I do have Irish blood... That's why I was asking...

I tried OA, it kept popping up runtime errors. The other apps didn't freeze up like with Comodo but everything went into slow-motion, including my download speeds. I have to assume that something on my system doesn't like HIPS or more likely, the other way round. Judging by the hit a PC takes with HIPS installed, anyone installing it should give some serious thought to whether it is _really_ worth it. For me getting rid of HIPS wasn't even a security decision, more like whether I wanted to keep using my PC or not. Am back with Comodo (sans HIPS, of course) Maybe my experience was a lot worse than some of you considering my P4 3GHz Prescott is kinda dated... and yet, kinda state-of-the-art, compared to other frying pans!

-nosh (February 05, 2008, 06:03 PM)

Software firewalls and HIPS are just a pain in the βǚŧ... I must say though that (fortunately for me, because of its high rating) OA doesn't slow down anything  on my system (like I said : oasrv.exe is usually at 0%, sometimes it jumps to 5 max, 30-40 when I run uTorrent, for brief moments -- X1, firefox, etc. consume more cpu power in comparison). Maybe you have some conflicting antispyware or antivirus??? But I understand if one just moves on after some really annoying and enigmatic problems. Life is a bit  too short.

[4wd]

FWIW I gave PC Tools a whirl and have to say I was mightily disappointed. 

first problem (for me) - it blocked the internal network for some reason (and I'm not even on a network!!!), wouldn't let me play CounterStrike (single player).  Tried tweaking the rules to no avail (probably my lack of expertise didn't help here...)

-Target (February 03, 2008, 06:07 PM)

Interesting, I can't recall having that problem but it's easily fixed.  If you go to the History screen you'll see a list of whatever was blocked, (Source, Dest, Port, Protocol, etc - doubleclicking will give detailed info), right-click on it and select 'Add Rule: .....' and it will create a rule in the appropriate zone, (Internet/Trusted).
You can then edit it, (it always appears at the top before other rules), to fine tune, etc.

second problem - inability to connect to the net.  It may be a good firewall, but I never found out 'cos it either blocked my connection, or dropped it after a very short time.  I spent well over an hour trying to establish a reliable connection, and in the end simply disabled the firewall (problem solved!!).  Maybe I'm a slow learner, but I can't for the life of understand why an app that is apparently as well considered as this one appears to be shouldn't work straight out of the box...

Strange, what can I say except it didn't happen here and it sounds more like a software conflict.

On top of that it was so intrusive (I'm still installing stuff after a rebuild) - every install required a response (some several).

Generally because the installer wants to connect to the net, accept connections, etc, (Microsoft Installer will).  But at least you don't end up with 50+ uninstall/install/setup items in the Apps list like ZA, (mine has none).  All the firewalls I've tried do this, (except purely rule-based), and personally I'd consider it a failing if they didn't, (open a requester when net access is happening during program install/uninstall).

This is one reason why the majority of programs I use are portable.

Now I know this is a 'good thing', but it's irritating in the extreme.  Clicking on the 'remember this' option shortcuts some of this, but creates a useless rule.  Uninstalling was an equally frustrating exercise (why would I want to create a rule to uninstall something???).

Because, again, the uninstaller is trying to connect to the net, accept connections, memory injection, etc.

And at least it shows you in the Apps list if a application is no longer available - about the only firewall I've seen that does.

[Target]

Generally because the installer wants to connect to the net, accept connections, etc, (Microsoft Installer will).  But at least you don't end up with 50+ uninstall/install/setup items in the Apps list like ZA, (mine has none).  All the firewalls I've tried do this, (except purely rule-based), and personally I'd consider it a failing if they didn't, (open a requester when net access is happening during program install/uninstall).

This is one reason why the majority of programs I use are portable.

Now I know this is a 'good thing', but it's irritating in the extreme.  Clicking on the 'remember this' option shortcuts some of this, but creates a useless rule.  Uninstalling was an equally frustrating exercise (why would I want to create a rule to uninstall something???).

Because, again, the uninstaller is trying to connect to the net, accept connections, memory injection, etc.

fair enough, but this is exactly the reason why i don't install/uninstall software while I'm connected, so, apart from the memory injection part, in my case it's kind of redundant.

can't comment on the software conflict, though this is a brand new build so I haven't really got much installed at the moment (I had, I think, not much more than Avast and the firewall at the time...)

Likewise, my preference is for small no install type apps (I even try unpacking installers with UniExtract <http://legroom.net/software/uniextract> to get around this), though this isn't always possible/practical

Target

[nosh]

Maybe you have some conflicting antispyware or antivirus???

-Armando (February 05, 2008, 06:28 PM)

Possible (NOD32), but unlikely. More likely just quite a few things running and HIPS wanting to play mommy to all of them.

[Armando]

NOD32? I'm using NOD32 too, so I'd be surprised too...

[Curt]

A new version of Online Armor was launched today: 2.1.0.85

You can get the "pro" version with a $15 rebate, using dicount code OAFEB

list of Features and Bug fixes – In detail

General

Resizeable GUI - our customers have been asking us to resize the Online Armor GUI - now, you can.

Remove Spamshield - the previous flagging of suspect spam messages was based on checking messages for spam-vertised links on SURBL. As spammers changed their tactics, it became clear this it became clear this approach was no longer effective and so the feature was removed..

Multiple Desktop Support - users with desktop switching software could not use Online Armor as popups would appear on the default desktop and were not answerable. Now, this is solved.

Fixed bug with uninstall protection - Online Armor protects itself from uninstallation. In the recent release, some users were unable to remove Online Armor without entering Safe mode. This issue is now fixed.

Fixed unresponsive tray icon - A few users reported after changing some options in Online Armor that the Online Armor menu became unresponsive. This meant settings could not be changed. This has now been fixed

Added hotkeys disable option - Some users did not want hotkeys (me included) - so now they can be disabled

Autoruns Enhancements

Online Armor has always monitored autorun locations; The scope of protection has been significantly enhanced in Online Armor - (Thanks to Tony Klein)

Additional scan during SCW added (folders where start menu items reside).

Safety Check Wizard

Realtime update during SCW - When Online Armor first starts, a Safety Check Wizard runs. This allows the system to scan the start menu, autoruns and so on to detect components that are already installed on the computer. This step means that the user should not be inundated with popups after a restart.

The Safety Check Wizard has a local list of common files which it compares against; This has been updated to link with OASIS (Online Armor Software Information Service) in real time. What this means is that the absolute latest data will be used on each install.

Faster Saving - Saving of the configuration during the wizard has been optimised

OASIS

OASIS (Online Armor Software Information Service) has been significantly updated. OASIS 2 provides the users with this data whether or not the file has been assessed, information about what the program does, how many users have seen it and some information about what it does.

When a program runs that is unknown - you can click the "more" button to get the OASIS results for it. This might help you decide what to do as it provides aggregate information about what the other users did.

You can also right click inside programs -> File Information -> More to get information out of OASIS.

Firewall

Optimized Performance for Torrents - when using bittorrent, firewall processing created slowdowns. This issue has been comprehensively corrected. You should not see slowdowns caused by Online Armor Firewall.

Automatic Network Identification (Interfaces) - previously all interfaces were lumped in as one. Now, ONLINE ARMOR will allow interfaces to be selectively trusted/not trusted. This caters for the case of the rOnline Armord warrior that may plug into trusted/public networks. This now also includes VPN interfaces.

Manage Windows Firewall during ONLINE ARMOR Install - If the windows firewall is active, it will be disabled. If Online Armor firewall is removed, windows firewall will be reactivated.

Added firewall log viewer - Users requested the ability to see firewall logs, and now they can.

Block network connection on boot (optional) - Users requested the ability to block all traffic during boot.

Firewall Logs are defaulted to "Off" - users reported big log file sizes - since most users have neither the need nor desire to manage or view firewall logs, we believe this makes sense. Advanced users will easily find out how to turn logs on - Standard users would not even know they needed to turn them off, or otherwise manage them

ICMP traffic is now blockable per application.

Help

Our help file has been updated, and localised into Japanese and Turkish.

Video help has been added in the help file - "Show me how".

Program Guard

Install Mode added (paid version) - automatically allows trusted installers to install without further prompting.

Allow blocking of trusted programs - We resolved a bug where users could not prevent safe programs from running.

Runsafer - probaby one of the coolest features of ONLINE ARMOR allows a user logged in as Admin to run a program with lowered rights (like dropmyrights) - but automatically. We added the ability for the user to run a "Safer" program normally, or a normal program "Safer" from inside the program guard.

CPU Limiter added to control runaway processes;

CPU Affinitity control to show which processor a program may use.

-ChangeLog

[Target]

apologies for resurrecting a dead thread, but it seems appropriate...

ran across this today on FWT - <a href="http://wareseeker.co...fwpam-0.2.zip/427395">WFWPAM</a>

haven't used it, so I can't comment, but there seems to be a lot of people here using the windows firewall so this might be of interest

Help the average user to change and manage settings of the embedded firewall

Is a free tool that can help the average user to change and manage settings of the embedded firewall in Windows XP giving many extra options regarding the firewall

Target

[BinderDundat]

I've been spending time getting to know Comodo Firewall, and I like it a lot, but it does have its drawbacks.  What's to like?  Well it is probably the best firewall for dealing with malware.  Leak test results are better than almost any other firewall - free or not.  The HIPS means that the firewall will survive shutdown attempts from any source.  It is also configurable.  That is also one of its drawbacks.  You have to get friendly with writing application rules for both the firewall and the HIPS component to get the most out of it.  There are a number of applications that have to be hand-configured to work - like games, xBox units, VPN's, torrent clients, and a bunch of others.  It also has fairly light resource usage by comparison to others.  That said, it still has a lot of rough edges.  There are still a couple of applications that don't work well with Comodo's firewall.  NOD32 in its current incarnation uses a proxy to filter all the web pages email through its on-access scanner.  That means that all the connections appear as originating from NOD32, so there is no firewall filtering of connections as a result.  There is also a problem with a MS VPN connection involving Outlook - something that is more due to the way Outlook handles the connection (proprietary bonding protocol - trust MS to do it their own way) than anything else.  The thing to bear in mind is that their firewall is only 3 months out of beta on a complete version change (2.4 to 3.0).  I would advise anyone interested in trying it to install the HIPS.  It does take a few days of training to reduce the alerts to a reasonable level, but the extra security makes me feel more secure.  You can always put the HIPS into training mode for a few days if you are happy that you are not infected.  That keeps it quiet while it learns your normal usage patterns.

[Armando]

apologies for resurrecting a dead thread, but it seems appropriate...

-Target (February 28, 2008, 12:58 AM)

No apologies, please!   
I personally love it when people resurrect dead threads when it's appropriate (and it is). Usually makes it easier to find info on a subject.

[taichimaster]

There are still a couple of applications that don't work well with Comodo's firewall.  NOD32 in its current incarnation uses a proxy to filter all the web pages email through its on-access scanner.  That means that all the connections appear as originating from NOD32, so there is no firewall filtering of connections as a result. 

-BinderDundat (March 07, 2008, 05:52 PM)

The NOD32 ekrn proxy doesn't just affect Comodo though.  There's been a lot of complaints about it rendering ANY firewall useless.

See: http://www.wildersse...wthread.php?t=192305

[Curt]

@ taichimaster - Yes, it is sad that so many people don't take the time and effort to set up their security programs the proper way. There is absolutely nothing wrong with the cooperation between my NOD32 3.0 and my Outpost Pro 6.0 - Outpost is doing all it is supposed to do.

[Armando]

There are still a couple of applications that don't work well with Comodo's firewall.  NOD32 in its current incarnation uses a proxy to filter all the web pages email through its on-access scanner.  That means that all the connections appear as originating from NOD32, so there is no firewall filtering of connections as a result.

-BinderDundat (March 07, 2008, 05:52 PM)

The NOD32 ekrn proxy doesn't just affect Comodo though.  There's been a lot of complaints about it rendering ANY firewall useless.

See: http://www.wildersse...wthread.php?t=192305

-taichimaster (March 08, 2008, 06:27 AM)

And that's why I'm keeping NOD32 v2.7

[taichimaster]

@ taichimaster - Yes, it is sad that so many people don't take the time and effort to set up their security programs the proper way. There is absolutely nothing wrong with the cooperation between my NOD32 3.0 and my Outpost Pro 6.0 - Outpost is doing all it is supposed to do.

-Curt (March 08, 2008, 12:58 PM)

Hi Curt,

How do you like Outpost 2008 compared to Outpost 4.0 (if you have used it)?  I have upgraded to 2008 before when it first came out, but then promptly downgraded back to 4.0 since it was crashing my machine left and right.

[Curt]

Yes, I too installed version 6.0 too early and had some problems at first. In fact, the problems were so big that I removed Outpost for some months and tested various others, including no firewall at all..., but finally everything came to order. I consider today's 6.0 (2008) superior to 2, 3, 4 and 5 in many ways - yes, I have been using Outpost for several years - but still I am eagerly waiting for Blockpost to be incorporated, as they have promised to do this summer. I really mean that I have no problems at all with NOD32 3.0 and Outpost 6.0 working together. Further more, I am running ThreatFire at the same time.

XP Home, x86.

[BinderDundat]

It's not that NOD32 and firewalls don't co-operate, it's just that you have to choose between firewall control of your outbound connections and NOD32 filtering of the source programs.  The proxy setup for NOD32 means that you only see NOD32 as the source for connection requests in your firewall.  That makes it impossible to write firewall rules restricting connections.  You may want to have NOD32 in control of the connection, but you lose the firewall's filtering ability.  You can also choose to restrict NOD32 filtering to certain types of connections - email and browser say - but you then do not inspect the other connections for bad guys sneaking in or out.

[Armando]

Exactly. So there are no easy solutions for those who want to combine NOD32 v3 and another firewall than ESET's.

[Target]

but wait, there's more (for fans of Windows Firewall, at least)

will it never end!!

another windows firewall interface popped up this morning <a href="http://www.winff.org/">WinFF</a>

Target

[Lashiec]

Er... but that's a frontend for FFmpeg

[Target]

Er... but that's a frontend for FFmpeg

-Lashiec (March 11, 2008, 07:28 PM)

GAAAAAK!!!

try this - <a href="http://www.bestsecur...tent+index.id+16.htm">XP Firewall Commander</a>

Target 

[Curt]

try this - <a href="http://www.bestsecur...tent+index.id+16.htm">XP Firewall Commander</a>

-Target (March 11, 2008, 07:37 PM)

This really brings meaning to XP's firewall! 

[tomos]

jeez
just trying jettico the last couple of days - it's too much
hundreds of clicks per day, many for software I've added to trusted zone or whatzever they call it (it's gone now I cant check)

not for me,
might try commodo or online-armor

I used use Fritz!Box router which came with a really nice software firewall but now have internet via cable (Kabel.de) and they charging 4€/month for their security "suite" - I'd be wary of it if it was for free

[nosh]

I'm disappointed with Comodo. I'm running it without the anti-malware or HIPS addons (which completely freeze up everything) but the least I expect it to do is inform me when an executable has changed. Sygate was quite reliable in that sense. Any other light-weight 3rd party firewalls out there? I think I'll give PC Tools a try next.

[tomos]

... Isn’t giving a firewall a because it’s not perfectly compatible with PS tray a bit… extreme  ?? ...

-Armando (February 03, 2008, 04:12 PM)

I have a license for Outpost Pro, so I don't have to tolerate any problems. 

The Danes ruled certain parts of Ireland a thousand years ago, so there may be some Irishmen with Danish blood, but I am quite sure that I don't have Irish blood...

-Curt (February 05, 2008, 06:08 PM)

reading back in this thread I came across the above -
[possibly/probably off-topic] (depending on Curt's answer ):-

whats with the irish blood (or lack of it) Curt?
BTW I'm one of those irish with viking blood... also BTW, not looking to complain or anything about the rep of the irish, just curious

[Curt]

I don't fancy a pint, so there is no way I can have traces of Irish blood. Furthermore I don't think rain is normal fine weather, so I really cannot be any less Irish, can I.

-- Editedx5, so others may see the connection as well:
You missed to quote the rest of the major reason for my original answer:

...Isn’t giving a firewall a because it’s not perfectly compatible with PS tray a bit… extreme (: do you have Irish blood?  ) ??...

-Armando (February 03, 2008, 04:12 PM)

- emplying, I guess, that the Irishmen tend to ask for extreme standards... -gratis!
(maybe Armando was thinking about the Scottish?) 

[Armando]

Some say Irish have a short fuse. 
(No offense Curt. It was only a joke.)