Hi,
Some strange problem appears with my Outpost 2.1
System W2K sp4 + all upgrades from windowsupdate.com
After installing, rebooting and configuring program worked just fine, but when I've switched off the computer and switched it on all the connection was blocked.
I've noticed that in the “Open Ports” info window was no open ports present.
I've tried to reinstall the Program but the result was the same when I've restarted the computer second time. Outpost just wasn't able to see any port. May be some of you faced the same problem and find the solution?
Thanks in advance.
I'm pretty certain that is not the problem (assuming that you installed Outpost as Administrator). Could you try Internet access using a different method (e.g. dialup). Also, if you are using cable, exactly how is the cable modem connected to your PC? (Ethernet, USB, Firewire, etc).
Originally posted by David
Hi Nicholas,
So, are you using a router?
It's not my private network. My provider arrange it's service via LAN. IP adrees is a fake one, but need to register my on their network.
System window???[/QUOTE]
Yup. Options -> System -> LAN Settings.
Check the Blocked and also the Attack Detection Logs as they might be able to provide us some insight into your problem. If you see anything in those logs that you believe might be related to your problem, please post them in your next reply. [/QUOTE]
IMHO the problem can be in booting sequence. Cause if there would be some other problem, why if works perfectly just after installing? I have some feeling that windows override settings from Outpost.
I dont know if it will be helpfull, but system events viewer shows me some errors:
Windows cannot unload your registry file. If you have a roaming profile, your settings are not replicated. Contact your administrator.
DETAIL - Access is denied. , Build number ((2195)).
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.
Data:
0000: 34 00 00 c0 4..A
Unable to open the Redirector service. Redirector performance data will not be returned. Error code returned is in data DWORD 0.
Data:
0000: 34 00 00 c0 4..A
Kind Regards,
Nicholas
VPN=Virtual Private Network - it creates a "tunnel" between your PC and another network (typically a corporate LAN) over the Internet. Traffic sent and received on this is encrypted to prevent others from eavesdropping on it.
I can't find any description of VRN in relation to OpenOffice - any further details on this?
Hi Nicholas,
Wow, this sounds a lot like business account. I have some ideas on how we might continue troubleshooting. However, I should have asked one question long ago:
What type of internet connection do you have? DSL? Cable? Satellite? DialUp?
The only one I'm aware of is if you apply a patch or Service Pack which requires a reboot - in which case you should disable Component Control (see Component Control vs. LSASS (http://www.outpostfirewall.com/forum/showthread.php?s=&threadid=8665) for details). This was supposed to have been addressed in the latest version of Outpost though...
Originally posted by Paranoid2000
Can you please check your Blocked and Attack Detection logs - post details of any entries.
Sure.
I don't see any blocked exept NetBios if I've uncheck the box in LAN Settings
When I turn Outpost to Disalble mode to get the Internet.
This site requsest some information and it appears like
9:06:45 PM Port scanned 216.12.219.12 TCP (1042, 1041, 1040, 1039, 1038, 1035)
Originally posted by Paranoid2000
Outpost 2.x will protect on Windows startup - all traffic will be blocked until the GUI starts.
Hi Paranoid.
Could there be any conflicts with Windows system durig the startup process?
Regards,
Nicholas
Nicholas:
Those extra network adapters don't seem to be unusual but the WAN Miniport does look to be VPN-related (PPTP and L2TP are different methods of encrypting network traffic) - did you have any VPN software installed previously? Disabling unused adapters is a good idea though and has solved other people's problems - just so long as you remember to re-enable them if you need them! Thanks for providing the update.
Banzi Baby:
The role of LAN settings is described in more detail in the Outpost Rules Processing Order (http://www.outpostfirewall.com/forum/showthread.php?s=&threadid=8394) FAQ. Simply put if neither the NetBIOS nor Trusted boxes are checked, the entries make no difference. If the boxes are checked, Outpost will permit traffic to/from that subnet. If you have a standalone PC, you can just delete the entries and clear the "Auto-Detect" box to stop Outpost from putting them back (this feature is to deal with new network cards being added).
Your setting looks normal - it is a network/subnet mask pair that is given and so will be different from your current address. See here (http://www.webopedia.com/TERM/S/subnet_mask.html) for more details on this.
As for the online scan results, if you have the Attack Detection plugin set to Block Intruder IP then this will kick in and prevent a full scan - you should disable it and run Outpost in Block Most mode (to avoid receiving lots of popups) for the duration of the scan.
As for losing connectivity, this could be a DHCP lease renewal failure - check the Outpost Blocked and Attack Detection logs for entries at this time. You can "force" a DHCP renewal to see if the problem recurs by opening a DOS Box/Command Prompt and typing ipconfig /release followed by ipconfig /renew.
If you are using Windows XP then svchost.exe will be responsible for DHCP so check that you have the correct ruleset - a forum search should turn up something suitable.
Originally posted by David
Tell us if you see a normal IP address or something like 127.0.0.1 or 'localhost'.
I get that as well sometimes with 2.1, when system boots, most of the time it displays my proper IP, but it has started to sometimes display either Localhost or a IP that starts with 162 or 192 with netbios enabled?, my real IP begins 82.xx.xxx.xxx
Why does it do that, is my sytem under an danger when that happens, everytime i boot or reboot now i check it too see if it right, if it isnt i then have to go into options system/lan settings & ok on that screen & then apply to get it back to me IP, connection is usb cable modem, no NIC, 1mb line, XP pro SP1 with all critical updates
Also will outpost be protecting me while i do a boottime virus scan or boottime defrag (raxco perfectdisk)
Thx in adavnce:)
BaNzI :D
PS also getting a lot of portscan alerts, i have it set to alert if one port scanned because i was noticing that i was gettin a lot of hits on the dcom port, mostly from other blueyonder users UK (similar IP range) & also other addys, any advce?
Originally posted by Paranoid2000
VPN=Virtual Private Network - it creates a "tunnel" between your PC and another network (typically a corporate LAN) over the Internet. Traffic sent and received on this is encrypted to prevent others from eavesdropping on it.
I can't find any description of VRN in relation to OpenOffice - any further details on this?
A "tunnel" with encrypted data? Yes, I have two such program in my PC. Thise are two trading software from two brokers. I'm not sure about the encription method, but may be they do creates such activity. Time to time I'm installing on my PC trial version on some new programs so possibly one of them created those miniports.
Regards,
Nicholas
Originally posted by David
It sounds like Outpost is not monitoring the proper adapter. I look forward to your reply.
Thanks for you prompt reply David.
Yes, there is one strange thing.
When I'm point cursor on outpost icon in the popup window i see proper IP address (192.168.132.9), but in the system window in outpost setting I see IP address as 192.168.132.0. I've tried to add proper address manually but in this case it uses wrong Subnet Mask.
3 Questions [Archive] - Outpost Users Support Forum::
Has anyone else seen this error, and if so, what can be done? Recently I had all ports stealthed with no ports open or listening in OP.
http://www.outpostfirewall.com/forum/archive/index.php/t-8902.htmlHOME |
The only network activity I can see in outpost when ports are gone is NetBios activity.
I've installed Norton Personal Firewall instead just to check if my Windows allow to take control op ports in general, but it operating normally.
Cheers for the reply :)
My Ip has never ever been that way before, have never had this with any other firewall & didnt have it with Outpost 2.0, I am on a 1mb cable line, as i said before NO NIC (network card) it a USB Motorola Surfboard 4200 plugged nto USB port, My IP is static, it has never changed since i got the line & as i said above havent had this prob with version 2.0 or any other firewall i have tried.In the OptionsLan Settings i have a Ip that isnt the same as my IP, mine is 82.XX.162.xxx, the IP listed in the settings box is differnt (will pm U with real IP's) I do not have a lan, it a stand alone PC.Is it wise to delete the entry & disable auto detect new settings :confused: Will i still be protected, i thought the Lan setting had to have at least one setting in there ( i have only one, but as i said it doesnt look exactly the same as my IP :confused:Most times if i hover over the outpost icon, it shows my real IP, other times it doesnt
Im glad that it does protect at startup, that was major reason why i bought it, but im still curious about it getting the worng settings on boot or reboot sometimes, i never use netbios & outpost 2.0 never used to do that (prolly yet another bug) As i said the Ip is sometimes 162 or 192
Another prob i have with the attack detection plug in is if i set it to Warn if one port is scanned & then go to GRC. com, while doin the common ports test, i just get 1 portscan alert, if i the do all service ports, outpost doesnt alert me again, it as if it only will show 1 alert from a site at a time, the only time i have had multiple alerts is when tryin the Exploits test at pcflank.com, then i get so many that U cant read them fast enough:confused: I also have it set to block IP that attack me & subnet mask & also block DoSS attacks ( but not while testing on firewall test sites).Im using the default ruleset & have added rules as i have been asked, svchost.exe hasnt been changed form defaults.The reason i asked about it is i can get 1 or 2 in a day if i dont surf of use mailwasher pro, if i then surf, i get more (multiple) which was making me think that other could see when i was surfing or such (ie ports getting open by firewall to let traffic out, also in the network activity screen i often see System BootPS (allow out going DHCP), is that nessecery for a working net connection?
Another major prob is that with 2.1 i can lose my connection, sometimes not regularly, sometimes regularly, i mean all connection, if i browsing a forum it will just sit there saying "connecting to remote host (site name) Cant surf, use mail or anything & only way to get it back is is to reboot & even then it sometimes does it again (i know it aint the attack detection plugin as it doesnt block the site & i can get back on after reboot, why does it do this, 2.0 never ever done that & neither has any other firewall
Thx in advance
BaNzI :D
If your IP address is of the form 169.x.x.x then this is due to Automatic Private IP Addressing (APIPA (http://compnetworking.about.com/cs/protocolsdhcp/g/bldef_apipa.htm)) and is most likely due to your ISP having a problem with IP address allocation. However your mention of NetBIOS enabled suggests that you are talking about Options/System/LAN/Settings - this will contain entries for all network cards on your system (whether connected or not) and suggests that you are using a network of Windows PCs. If your PC is standalone then, as David has said, no entries are needed and you can delete them all and clear the Auto-Detect box.
Outpost 2.x will protect on Windows startup - all traffic will be blocked until the GUI starts.
Finally, you will see plenty of connections on port 135 due in part to the number of PCs on the Internet compromised by various worms (like MSBlast) scanning for other systems and also due to spammers trying to send popup messages using the Windows Messenger service. Outpost should block these by default - the only danger is if you run Windows XP and have chosen to add svchost.exe as a Trusted Application. This will override the default block rules and leave you vulnerable. If this is the case, move svchost.exe to the Partially Allowed group (it performs some vital functions so cannot be blocked completely) and do a forum search for an appropriate ruleset.
Tere is only two things that I can't understand Pranoid:
1) Why the problem appears just afther second restrart?
I'll explain. Install Outpost; restart by request; start Windows; Outpost works correctly, everithing is fine thise moment; second restrart (for e.g. shut down for a night), and only after second start of the system outpost blocks all the connection exept dissable mode and see no open ports. All the network activity it see the same time. For e.g. HTTP, NetBios. Connections request from thise forum site it reports as attack. :)
2) Why other wirewalls such as Kerio can work with the same system settings?
There is something about start process.
Could you gues what is it?
Kind Regards,
Nicholas
This should only be the case if the tunnel has a "virtual" IP address at either end (in which case you should see the virtual address along with your real one when you move your mouse over the Outpost system tray icon, or if you type ipconfig /all from the Command Prompt). If the programs using https or are Java applications using a separate encryption routine, then this should not apply.
Originally posted by Nicholas
Could you gues what is it?Not without the information I asked for from your logs I can't! I have yet to hear of anyone having this sort of problem and seeing exactly what is being reported in the logs is the only way I can make suggestions.
For instance when you say that everything is reported as an attack, is this in the Blocked logs ("Block Hacker IP after attack") or Attack Detection logs? Which IP address is mentioned and does this correspond with anything significant (e.g. a proxy server used for Internet access).
Do you have any other firewall software installed? If so you must properly remove it as detailed in the Extended Application or Firewall Uninstall/Install Instructions (http://www.outpostfirewall.com/forum/showthread.php?s=&threadid=7186) FAQ. Also any other software that hooks into Windows' networking subsystem can cause conflicts and should be disabled (e.g. packet sniffers, VPN software, port monitors). Java Tech - Chapter 23 : Outside the JVM::
No port COM5 Check each port to see if it is open. **/ public class PortListOpen Open failed. Port currently not owned
http://www.particle.kth.se/~lindsey/JavaCourse/Book/Part3/Chapter23/commPortsOps.htmlHOME |
Dear David, dear Paranoid2000,
Thanks for your time you've spent helping me.
Here is the letter how my problem was finally solved. I hope it will give you a new information to help other users.
After uninstalling and cleaning all the registry the result was the same and I decided to reinstall all the network components in my system and network adapter drivers.
I've faced the problem I never faced before. When I've tried to uninstall the TCP/IP protocol Windows didn't allow me to do it. Later I did it many times and never faced the same problem. So the problem appears in system security policy with no doubt (remember I've downloaded all the updates for Windows, by now windowsupdate.com reports no updates at the moment available). I've tried to reinstall network services from W2K disk, but it has no result at all. Absolutely no changes in my system appeared (!).
I boot my system in safe mode and look into Hardware device manager. I found that instead of one network adapter seen in normal mode I see four. Other was “Direct Parallel”; “WAN Miniport (L2TP)”; “WAN Miniport (PPTP)”. I've tried to uninstall all other devices except physical network adapter, but the system didn't allow me to do it.
Finally I've made them as disabled. After that I've reinstalled Outpost and this time it works properly.
Thanks for your kind help.
Regards,
Nicholas
Originally posted by Paranoid2000
The only one I'm aware of is if you apply a patch or Service Pack which requires a reboot - in which case you should disable Component Control
So in case of my situation. When I've installed Outpost later that all of updates, can it be that Outpost can not take enought control on second (!) system startup?
It seems like some settings cann't be saved properly. And afther second system restarting outpost cann't take enought rights to work properly.
Hi Nicholas,
Originally posted by Nicholas
When I'm point cursor on outpost icon in the popup window i see proper IP address (192.168.132.9),
So, are you using a router? You IP Address is in a Private IP Range. If you are using a router, is this your personal router and home network or are within some business network?
Originally posted by Nicholas
but in the system window in outpost setting I see IP address as 192.168.132.0.
System window??? Do you mean Options -> System -> LAN Settings from the Outpost GUI?
Originally posted by Nicholas
I've tried to add proper address manually but in this case it uses wrong Subnet Mask.
Under Options -> System -> LAN Settings, you only need to enter an IP if:
1. You are within a corporate (business) network.
2. You need access to other file servers (NetBIOS).
3. Other hosts (PCs) need access to file shares (NetBIOS) on your system.
Otherwise, there should be no entries there and you should remove any IPs, domains, or IP Ranges listed and also UNCHECK the item called 'Auto-Detect New Network Settings'.
Originally posted by Nicholas
The only network activity I can see in outpost when ports are gone is NetBios activity.
Check the Blocked and also the Attack Detection Logs as they might be able to provide us some insight into your problem. If you see anything in those logs that you believe might be related to your problem, please post them in your next reply.
Originally posted by Paranoid2000
I'm pretty certain that is not the problem.
Also, if you are using cable, exactly how is the cable modem connected to your PC? (Ethernet, USB, Firewire, etc).
Yes, yes. I suppose it's not really problem of program but the problem of settings, or may be some wrongly installed driver.
I'm using LAN to get to the Internet. Looks like corporative network.
Originally posted by Paranoid2000
Nicholas:
Those extra network adapters don't seem to be unusual but the WAN Miniport does look to be VPN-related (PPTP and L2TP are different methods of encrypting network traffic) - did you have any VPN software installed previously?
I'm not sure about what is VPN software exactly, but if I've understood nature if VRN correctly my OpenOffice 1.1 can be a VPN software. As well I have two programs using nettwork connections, but can't say anything about their architecture.
Regards,
Nicholas
Hello Nicolas,
Thank you posting back and keeping us updated. I hope it continues to work for you.
Regards
Randy
Originally posted by David
Hi Nicholas,
What type of internet connection do you have? DSL? Cable? Satellite? DialUp?
Cable. I'm not fluent in english, thats why I'll refine. No modem. Looks like normal corporate network. :)
Kind Regards,
Nickolas
Banzi Baby: The role of LAN settings is described in more detail in the Outpost Rules Processing Order FAQ. Simply put if neither the NetBIOS nor Trusted boxes are checked, the entries make no difference. If the boxes are checked, Outpost will permit traffic to/from that subnet. If you have a standalone PC, you can just delete the entries and clear the "Auto-Detect" box to stop Outpost from putting them back (this feature is to deal with new network cards being added). Your setting looks normal - it is a network/subnet mask pair that is given and so will be different from your current address. See here for more details on this. As for the online scan results, if you have the Attack Detection plugin set to Block Intruder IP then this will kick in and prevent a full scan - you should disable it and run Outpost in Block Most mode (to avoid receiving lots of popups) for the duration of the scan. As for losing connectivity, this could be a DHCP lease renewal failure - check the Outpost Blocked and Attack Detection logs for entries at this time. You can "force" a DHCP renewal to see if the problem recurs by opening a DOS Box/Command Prompt and typing ipconfig /release followed by ipconfig /renew. If you are using Windows XP then svchost.exe will be responsible for DHCP so check that you have the correct ruleset - a forum search should turn up something suitable.
Thank U for the reply
I have removed the entry in lan settings & unticked auto detect, ok'd then applied it, still didnt stop the localhost bug, still on boot or reboot it will just say Outpost Firewall : Localhost, seems like yet another version 2 bug that hasnt been fixed
As for the online firewall tests, of course i disable the block IP & subnet mask, if U had read my previous post properly i said that, this is what i do, set the alerts to maximum, diable block IP & subnet, go to Grc.com, run the file sharing test, i get ONE popup alert, then i run the comman ports test, i get NO popup alerts, then i run the All System Ports, i still get NO popup warning despite the fact the plugin is set to maximum (ie alert if ONE port is scanned), i then go to PcFlank.com, i run the quick test, i get ONE popup alert, all the other tests apart from the exploits test (which i dont try now as Outpost then pops up loads of boxes asking me to block protocols) so let me repeat, the alets have serious probs with these sites & it doesnt work as it is advertised to, yet another bug
Also, i repeat again, i have never had the connection probs that i have with outpost 2.1 (ie the lost net connection requiring a reboot EVER before with my connection, NEVER had it with version 2.0 or ANY OTHER FIREWALL, so there is no problem with my connection, so that tells me that it yet another BUG in outpost.Now an example of this is this, i was using firefox to browse a music forum & using it java chat room, then i closed the chat window & then logged out the forum, cleared the firefox cache & cookies & then closed it, then opend Opera to check other forums, BANG, Just sits there saying "Connecting to remote host (site name) & does absolutely nothing else apart from pop up a box sayin it cant connect, when this happened, i right clicked the outpost tray icon & clicked show outpost, then looked in the network activity section, lo & behold there were still many connections for firefox & the chat window, i tried to right click them & breack connection, NOTHING HAPPENED, forcing me into one of many reboots, i then got so fed up with this, i then unistalled, cleaned up & then reinstalled, GUESS WHAT, it still does it :rolleyes:
Now im not the kinda of person that likes to criticise others, but it is painfully clear that the beta testers failed in their work on 2.1, bugs that were supposed to be fixed were let through & a shed load of new ones introduced, also i read here that there is supposed to be a new beta version very shortly, this tells me that agnitum knew of the bugs & let an unfinished product be sold, 2.1 should have stayed in beta or should have been classed as RC, NOT final, i think it will be like the 2.0, most of the probs only fixed at the end of the products life, so just like version 2.1, we will have to pay yet again for a MINOR bugfix that didnt even fix the bugs :( Nice business plan there Agnitum :rolleyes:
No one should have to constantly unistall & reinstall a prog all the time, yet that seems to be the most comman advice given here
Sadly another post on here seems to be spot on, they said something like this Now we pay agnitum to have the right/privalige to be beta testers, sadly this is so true with 2.1
I have to say if i find any more serious bugs in this software, then i will be dropping it, sadly agnitum just doesnt seem to care
Thank U
BaNzI :D
Can you please check your Blocked and Attack Detection logs - post details of any entries.
Banzi Baby,
You have not supplied the information requested (specifically the ipconfig release/renew query). Your post is clearly a different issue and therefore not related to this thread's subject (and Nicholas, the original poster, seems to have a solution now). Finally, you seem to want to spend more time ranting about supposedly incompetent beta-testers and evil Agnitum (who provided free updates to 2.0 for everyone, how dare they!) than on finding a fix to your problem.
I am therefore closing this thread - if you want to open another one for technical assistance by all means do so. If however, you want to rant further (and waste your time and anyone else's) then do it in Chit Chat...
Hi Nicholas,
Move your mouse over the Outpost icon in the system tray. Tell us if you see a normal IP address or something like 127.0.0.1 or 'localhost'.
It sounds like Outpost is not monitoring the proper adapter. I look forward to your reply.
Originally posted by Paranoid2000
Do you have any other firewall software installed? If so you must properly remove it as detailed in the Extended Application or Firewall Uninstall/Install Instructions (http://www.outpostfirewall.com/forum/showthread.php?s=&threadid=7186) FAQ. Also any other software that hooks into Windows' networking subsystem can cause conflicts and should be disabled (e.g. packet sniffers, VPN software, port monitors).
Thanks for your advice Paranoid2000.
I'll try to uninstall Outpost, clean all the registry and reinstall the Firewall.
Kind Regards,
Nicholas
 Get Smart About Monitoring Virtual Machines
 Microsoft Gets Ex-Streamly Cozy with U.K.'s MediaWave
|
No open ports seen