Jump to content

URBAN0

Members
  • Posts

    232
  • Joined

  • Last visited

  • Days Won

    2

Posts posted by URBAN0

  1. itman!! by accident I deleted the whole thread I was going too mark as solved and it turned out deleting 😄

     

    Here was my responds to you before deletion:

    That makes sense, otherwise, why using the learning mode. 

    Last night I even went to a length of reloading image of windows where there was nothing installed but updates only, then installed ISS and set on learning mode, this was done solely for test purposes to see if perhaps after the latest windows update 20H2 which I just got few days had some negative effect on ESE itself.

    While I installed some of the apps and then adjusting their settings I let them go online, ISS would show each app reaching their server with window notification with exception of HWiNFO that did that quietly, but after reading the "Learning Mode" and how rules are defined and applied I can see reasoning behind it.

    Thank you itman, you've been a truly great help.

    Have a wonderful day

     

    This thread can be closed

     

     

     

  2. 1 hour ago, itman said:

    Here's one possibility.

    When the Eset firewall is in Learning mode, it assumes there will be no user modification activities in regards to firewall rules. If the user subsequently deletes a rule while in Learning mode, the firewall might switch to Interactive mode. This makes sense to me since the user should not be performing firewall rule modification activities while in Learning mode. Or, the above applies only to a specific rule while in Learning mode.

    Another possibility is this setting:

    https://help.eset.com/eis/14/en-US/idh_config_epfw_basic_group.html?idh_config_epfw_learning_mode.html

    Appears the maximum rule count for inbound/outbound rules per app is 3.

     

    That makes sense, otherwise, why using the learning mode. 

    Last night I even went to a length of reloading image of windows where there was nothing installed but updates only, then installed ISS and set on learning mode, this was done solely for test purposes to see if perhaps after the latest windows update 20H2 which I just got few days had some negative effect on ESE itself.

    While I installed some of the apps and then adjusting their settings I let them go online, ISS would show each app reaching their server with window notification with exception of HWiNFO that did that quietly, but after reading the "Learning Mode" and how rules are defined and applied I can see reasoning behind it.

    Thank you itman, you've been a truly great help👍

    Have a wonderful day

     

     

  3. Weird!

    I reinstalled ISS, clean slate, then put firewall in learning mode and rebooted. While windows restarted ISS not  giving me any notification while HWiNFO checks for update and the rule is created.

     

    Now! while I deleted that rule and checked for update manually, ISS gives me a notification of HWiNFO going online using port 433...something isn't right.

  4. I think I went through every rule that has been created to see maybe I've missed something and its all clear from this app. What I might do is clear everything literally, still have my settings backed up, but start from absolutely scratch and see how the learning mode will work then.

    I know its extreme troubleshooting, but I don't have any more ideas how to go about this, my reasoning behind it is that maybe, just maybe while rule was created I saved it and  while I'm importing my previous settings the rule could be within and I just can't see it, if that makes sense 🙂

     

    I will report back my findings.

     

    Thank you for your effort of trying to help.

     

  5. We are on the same page as far is allowing  rule creation once and permanently. One thing I'm puzzled and Marcos comment confused me even more when he stated:

    Quote

    If a rule allowing the communication already exists, no new rule will be create and a notification will not pop up either.

    He never responded back while I made it clear that I only allow HWinfo once and that was prior to me importing settings which didn't have any rules for HWiNFO so that should have been clean slate, unless I'm not seen something.

    It only makes common sense that even thou, you allow rule permanently, If my backup settings are created prior to me allowing permanent rule creation, would importing that setting wipe clear the rule, even if it was created permanently?  If that's the case once put in learning mode, notifications should be showing🙂

  6. Thank you itman for more detail explanation.

    Tbh. now when I think of it, I'm not 100% sure. I think I did exit GUI as I normally would before making any changes, adding any rules or importing/exporting setting.

    Normally, any app that is under certain rule e.g. "check for updates" just  an example, If I would to delete the rule set firewall in learn mode and load the app again I would get a windows notification, but that was a while ago I don't really keep on track when, but lately (weeks, month or so) I haven't seen that, even thou the app can be installed and launching for the first time.

    Even thou I did allow HWiNFO outgoing connection once, but importing settings should be treated like clean slate and, so I  should be notify in learning mode that this app is making outgoing connecting to its server under learning mode, but nothing.

     

  7. That doesn't make sense.

    For test purpose I installed new app and having my setting backed up I would allow the new app to communicate with its server "checking for updates" in interactive mode and I get notification.

    Then I would import previous settings and set it into learning mode, the same app would check for updates and I would see the notification pop up, so whats missing here.

    HWiNFO checks for updates in learning mode but no notification and no rules were created prior other then once I allowed but I imported setting like I did with other apps.

     

  8. 4 hours ago, itman said:

    I would check the router for all existing Wi-Fi connections. A while back a rogue one was set up on my router. Still don't know how that one happened.

    Eset's Connected Home monitor should show all router connections.

    Very good suggestion and that was the first thing I did, all clear, that's why this was puzzling to me, never had any thing like it since I have ESET. I still cant find anything, coast its clear, so I'm still wondering.

    Thank you

  9. 5 hours ago, peteyt said:

    How do you connect to the Internet? That screenshot seems to suggest you have created a hotspot on your phone and the pc is then connecting to that hotspot rather than a router.

    I didn't make it clear, but "This is pop up from ESET's scenarios web page, but mine was the same.” by the time I realize that it might have confuse someone It was too late for me to delete

    It wasn't mine, mine is actually the below image.

     

  10. 16 hours ago, itman said:

    When you get this Unprotected Wi-Fi alert from Eset again, try to determine which Wi-Fi network connection it is flagging.

    My gut is telling me, this is not your WPA2 Wi-Fi connection set up on the router that you normally connect to.

    Never came back again and this have never happen as long as I own ESET IS.  As a habit I always hoover my mouse over Wi-Fi tray icon to know where I'm connected and it was contention to my WPA2 personal Wi-Fi as it normally would.

    This happened as soon as I enabled direct I/O vt-d for Hyper-V

     

    Thank you

     

     

×
×
  • Create New...