ESET Firewall

[OutpostAlan 0]

Hi, I'm an Agnitum Outpost Firewall user for many years. It was discontinued and I lament the loss.

Current Windows 10 will run the Outpost firewall but not the HIPS(Proactive Protection).

ESET has good creation of rules through pop-ups. Feels similar to Outpost.

What I haven't found in ESET is live firewall connections. This was a standard feature in Outpost and very useful for monitoring live traffic of all types with right click rule creation.

I have attached an example screen capture of the Outpost's firewall view.

Outpost's firewall view is excellent for monitoring normal and suspicious activity. Many times I have caught an application's live activity that purports to not communicate in a certain way and the truth is revealed in the live activity. An example of this is, a freshly installed popular non chrome browser communicating directly with Google servers on startup when the developer says it doesn't. The proof is in the eating. This is a low and legitimate communication but it shows how Outpost immediately shows the traffic and allows for immediate action rather than allowing the communication for as long as it takes you to trawl a log file. Of deeper concern is Windows' svchost. I have 8 rules for this alone. FYI, All rules created satisfactorily from pop-ups.

Does ESET have any products approaching this sort of functionality?

I have read about a ESET downloadable tool but this is far from live and is informational not proactive.

Thank you.

 

[Marcos 5,070]

The feature is there under Tools -> More tools -> Network connections:

[OutpostAlan 0]

Thanks for you quick reply Marcos.

The ESET Network Connections view is good but lacks many options available to Outpost's similar view. Also Outpost's Network View click depth is one double click.

There isn't an option for a rule creation beyond the current connection on this screen.

I also note that there is restricted flexibility for svchost on this display.

ESET seems to have the core components for displaying the information. More right click context options on this network view would be useful.

Does ESET have a business product closer to my wants?

 

[Marcos 5,070]

What exactly are you missing in the Network connection view? You see there a list of connections and we provide users with an option to create a blocking rule for it with a single click. It doesn't make sense to have an option to create a brand new firewall rule there for instance.

[OutpostAlan 0]

Hi Marcos,

Yes, it does make sense to create a rule from here.

It's quick, instant and flexible.

Outpost2.png shows the rule creation from live network connections.

Outpost3.png shows modifying all of the application's rules and the priority order. From the live connections.

Outpost4.png shows all application that have rules applied to them.

Outpost5.png shows the Outpost logs. The continuous result of application rules.

An example of this flexibility is the ability to quickly decide on whether to block the protocol, IP, IP range, etc. All very quickly and live.

Outpost has a nice feature that pauses the live view while the right click context is in effect.

This is what I want and Agnitum thought it was logical. Maybe that's why Yandex bought them. 

So Marcos, correct me if I am wrong. If ESET doesn't have a product approaching this I will keep moving.

[itman 1,659]

Outpost was unique software and you're not going to find anything in an integrated AV solution with like features. One reason is you paid for all those features in the Outpost license.

[cyberhash 188]

Many many years back (prior to eset suites being available) i always used a 3rd party firewall along side NOD32 as there was never any compatibility issues that other vendors suffered from. Like @itman has mentioned above. Because these 3rd party firewalls are dedicated applications they will always be more flexibe when  it comes to ease of use (for more complex settings). Other vendors that offer security suites have either similar or worse methods of configuration when you get to the firewall.

Maybe using outpost along with NOD32 might be more to your liking .

 

[itman 1,659]

8 minutes ago, cyberhash said:

Maybe using outpost along with NOD32 might be more to your liking .

My understanding is it is not compatible with x(64) kernel patch protection. The primary reason almost all the third party HIPS solutions shut down. Assume their profits from such software were not worth reengineering the software to be compatible. 

[cyberhash 188]

6 minutes ago, itman said:

My understanding is it is not compatible with x(64) kernel patch protection. The primary reason almost all the third party HIPS solutions shut down. Assume their profits from such software were not worth reengineering the software to be compatible. 

Yes the user base that needed all the features of a dedicated software firewall was very slim and therefore not profitable.

[OutpostAlan 0]

Thank you itman and cyberhash,

I agree that I am part of a minority user base and I understand that there are significant development costs in producing products for market. As a Sales Manager I also understand that It's all about the sales figures. Not a bad thing. A company grows to a certain size and there are a lot of mouths to feed. I see that ESET have 1300+ employees. They wouldn't be immune from the effects of growing islands of self interest. A challenge I must negotiate with my own large sales accounts. Slow moving large wheels influenced by even larger ones.

I am of the mind that there many benefits that come from seeing and controlling your own position in the flow of data traffic. How that information is scaled per user is a developers continuing challenge.