help
9.4 Firewall configuration files
9.4.1 About firewall configuration files
Sophos Client Firewall enables you to export the firewall general settings and rules as a configuration file. You can use this feature to do the following:
■
■
Back up and restore your entire firewall configuration.
Save a general settings configuration and install it on multiple computers.
■
■
Create rules for applications on one computer and export them for use on other computers running the same set of applications.
Use the management console to merge configurations created on several different computers to create a policy that is valid for all computers on the network.
9.4.2 Export a firewall configuration file
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Click Export.
3. Give your configuration file a name and location, and then click Save.
9.4.3 Import a firewall configuration file
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Click Import.
3. Select a configuration file and click Open.
4. Follow the instructions on the screen.
9.5 Firewall rules
9.5.1 About firewall rules
Global rules
Global rules apply to all network communications and to applications even if they have application rules.
Application rules
You can have one or more rules for an application. You can either use preset rules created by
Sophos or create custom rules to give you fine control over the access allowed for an application.
69
Sophos Endpoint Security and Control
For information about the settings for the default global and application rules, see http://www.sophos.com/en-us/support/knowledgebase/57757.aspx
.
9.5.2 About the order in which rules are applied
For connections that use rawsockets, only the global rules are checked.
For connections that do not use rawsockets, various rules are checked, depending on whether the connection is to a network address that is listed on the LAN tab or not.
If the network address is listed on the LAN tab, the following rules are checked:
■
■
If the address has been marked as Trusted, all traffic on the connection is allowed with no further checks.
If the address has been marked as NetBIOS, file and printer sharing on any connection that meets the following criteria is allowed:
Connection
TCP
TCP
UDP
UDP
Port
Remote
Local
Remote
Local
Range
137-139 or 445
137-139 or 445
137 or 138
137 or 138
If the network address is not listed on the LAN tab, other firewall rules are checked in the following order:
1. Any NetBIOS traffic that has not been allowed using the LAN tab is dealt with according to the setting of the Block file and printer sharing for other networks check box:
■
■
If the check box is selected, the traffic is blocked.
If the check box is cleared, the traffic is processed by the remaining rules.
2. The high-priority global rules are checked, in the order in which they are listed.
3. If the connection has not already had rules applied to it, the application rules are checked.
4. If the connection has still not been handled, the normal-priority global rules are checked, in the order in which they are listed.
5. If no rules have been found to handle the connection:
■
■
■
In Allow by default mode, the traffic is allowed (if it is outbound).
In Block by default mode, the traffic is blocked.
In Interactive mode, the user is asked to decide. This mode is not available in Windows
8 and later.
70
help
Note: If you have not changed the working mode, the firewall will be in Block by default mode.
9.5.3 About local network detection
Note: This option is not available on Windows 8 and later.
You can assign the local network for this computer to firewall rules.
The firewall determines this computer's local network when it starts, and then monitors for any changes whilst it is running. If any change is detected, the firewall updates any local network rules with the new local network address range.
Caution: We strongly advise caution when using local network rules as part of configurations
that may be used in "out of office" locations. For more information, see Create a secondary configuration
(page 78).
9.5.4 Global rules
9.5.4.1 Create a global rule
Important: We recommend that you create global rules only if you are familiar with networking protocols.
Global rules apply to all network communications and to applications which do not already have a rule.
To create a global rule:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Global Rules tab.
4. Click Add.
5. Under Rule name, type a name for the rule.
The rule name must be unique within the list of rules. Two global rules cannot have the same name.
6. On Windows 8 or later, under Protocol, select the protocol you want to use.
7. To apply the rule before any application rules or normal priority global rules, select the Higher
priority than Application rules check box.
For information on the order in which rules are applied, see About the order in which rules are applied
(page 70).
8. Under Select the events the rule will handle, select the conditions that the connection must match for the rule to apply.
9. Under Select the action with which the rule will respond, select either Allow it or Block
it.
71
Sophos Endpoint Security and Control
10. Do one of the following:
■
■
To allow other connections to and from the same remote address while the initial connection exists, select Concurrent connections. This option is only available for TCP rules.
To intelligently allow replies from the remote computer based on the initial connection, select Stateful inspection. This option is only available for UDP rules.
Note: On Windows 8 and later, these options are not displayed as Stateful inspection is always used and Concurrent connections are not supported.
11. Under Rule description, click an underlined value.
9.5.4.2 Edit a global rule
Important: We recommend that you change global rules only if you are familiar with networking protocols.
To edit a global rule:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Global Rules tab.
4. In the Rule list, select the rule that you want to edit.
5. Click Edit.
For information on the global rule settings, see
Create a global rule
(page 71).
9.5.4.3 Copy a global rule
To copy a global rule and append it to the list of rules:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Global Rules tab.
4. In the Rule list, select the rule that you want to copy.
5. Click Copy.
9.5.4.4 Delete a global rule
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Global Rules tab.
4. In the Rule list, select the rule that you want to delete.
5. Click Remove.
72
help
9.5.4.5 Change the order in which global rules are applied
Global rules are applied in the order in which they appear from top to bottom in the list of rules.
To change the order in which the global rules are applied:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Global Rules tab.
4. In the Rule list, click the rule that you want to move up or down in the list.
5. Click Move Up or Move Down.
9.5.5 Application rules
9.5.5.1 Apply preset application rules
A preset is a set of application rules created by Sophos. To append preset rules to the list of rules for an application:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Applications tab.
4. Select the application in the list, and then click the arrow next to Custom.
5. Point to Add rules from preset, and then click a preset.
9.5.5.2 Create an application rule
To create a custom rule which allows fine control over the access allowed for an application:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Applications tab.
4. Select the application in the list, and then click Custom.
You can also double-click the application in the list.
5. In the Application Rules dialog box, click Add.
6. Under Rule name, type a name for the rule.
The rule name must be unique within the list of rules. Two application rules cannot have the same name, but two applications can each have a rule with the same name.
7. On Windows 8 or later, under Protocol, select the protocol you want to use.
8. Under Select the events the rule will handle, select the conditions that the connection must match for the rule to apply.
73
Sophos Endpoint Security and Control
9. Under Select the action with which the rule will respond, select either Allow it or Block
it.
10. Do one of the following:
■
■
To allow other connections to and from the same remote address while the initial connection exists, select Concurrent connections. This option is only available for TCP rules.
To intelligently allow replies from the remote computer based on the initial connection, select Stateful inspection. This option is only available for UDP rules.
Note: On Windows 8 and later, these options are not displayed as Stateful inspection is always used and Concurrent connections are not supported.
11. Under Rule description, click an underlined value.
9.5.5.3 Edit an application rule
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Applications tab.
4. Select the application in the list, and then click Custom.
You can also double-click the application in the list.
5. In the Application Rules dialog box, click Edit.
6. Under Rule name, type a name for the rule.
The rule name must be unique within the list of rules. Two application rules cannot have the same name, but two applications can each have a rule with the same name.
7. On Windows 8 or later, under Protocol, select the protocol you want to use.
8. Under Select the events the rule will handle, select the conditions that the connection must match for the rule to apply.
9. Under Select the action with which the rule will respond, select either Allow it or Block
it.
10. Do one of the following:
■
■
To allow other connections to and from the same remote address while the initial connection exists, select Concurrent connections. This option is only available for TCP rules.
To intelligently allow replies from the remote computer based on the initial connection, select Stateful inspection. This option is only available for UDP rules.
Note: On Windows 8 and later, these options are not displayed as Stateful inspection is always used and Concurrent connections are not supported.
11. Under Rule description, click an underlined value.
9.5.5.4 Copy an application rule
To copy an application rule and append it to the list of rules:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
74
help
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Applications tab.
4. Select the application in the list, and then click Custom.
You can also double-click the application in the list.
5. In the Application Rules dialog box, select the rule you want to copy and click Copy.
9.5.5.5 Delete an application rule
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Applications tab.
4. Select the application in the list, and then click Custom.
5. In the Application Rules dialog box, select the rule you want to remove and click Remove.
9.5.5.6 Change the order in which application rules are applied
Application rules are applied in the order in which they appear from top to bottom in the list of rules.
To change the order in which the application rules are applied:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Applications tab.
4. Select the application in the list, and then click Custom.
You can also double-click the application in the list.
5. In the Rule list, click the rule that you want to move up or down in the list.
6. Click Move Up or Move Down.
9.5.5.7 Allow applications to launch hidden processes
Note: This option is not available on Windows 8 and later as it is handled automatically by the
Sophos Anti-Virus HIPS technology.
An application sometimes launches another hidden process to perform some network access for it.
Malicious applications can use this technique to evade firewalls: they launch a trusted application to access the network rather than doing so themselves.
The firewall sends an alert to the management console, if one is being used, the first time a hidden process is detected.
To allow applications to launch hidden processes:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
75
Sophos Endpoint Security and Control
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Processes tab.
4. In the upper area, click the Add button.
5. Locate the application, and then double-click it.
If you are using interactive mode, the firewall can display a learning dialog when it detects a new launcher.
■
■
Enable interactive mode (page 66)
Enable hidden process learning dialogs (page 67)
9.5.5.8 Allow applications to use rawsockets
Note: This option is not available on Windows 8 and later. The firewall will treat rawsockets in the same way as ordinary sockets.
Some applications can access a network through rawsockets, which gives them control over all aspects of the data they send over the network.
Malicious applications can exploit rawsockets by faking their IP address or send deliberately corrupt messages.
The firewall sends an alert to the management console, if one is being used, the first time a rawsocket is detected.
To allow applications to access the network through rawsockets:
1. On the Home page, under Firewall, click Configure firewall.
For information about the Home page, see
About the Home page (page 6).
2. Under Configurations, click Configure next to the location that you want to configure.
3. Click the Processes tab.
4. In the lower area, click the Add button.
5. Locate the application, and then double-click it.
If you are using interactive mode, the firewall can display a learning dialog when a rawsocket is detected.
■
■
Enable interactive mode (page 66)
Enable rawsocket learning dialogs
(page 68)
9.5.5.9 Use checksums to authenticate applications
Each version of an application has a unique checksum. The firewall can use this checksum to decide whether an application is allowed or not.
By default, the firewall checks the checksum of each application that runs. If the checksum is unknown or has changed, the firewall blocks it or (in interactive mode) asks the user what to do.
The firewall also sends an alert to the management console, if one is being used, the first time a new or modified application is detected.
76
