Eset 6.5 Firewall firewall keeps asking to approve the same programs

[Jason Ramy 0]

I'm using Eset endpoint 6.5. Recently the firewall started asking to approve connections that are already in the rules after the network is lost/reconnected. Everything is in 1 profile. It's set up in interactive mode to catch any new stuff. All networks are treated as public.

so for example: dnscrypt-proxy will query dns again after re-connection. eset will create rules like dnscrypt-proxy.exe (2), dnscrypt-proxy.exe(3), etc. All the same. They will work for a little while and then poof.

I have tried: Reinstalling, setting the firewall profile on all adapters and networks.  I updated to pre-release modules after reading the thread about v11 doing the same thing but the bug is still there. Anything else I can do to troubleshoot? I can downgrade to v5 but I'd rather not.

 

edit: Os is Win8.1 x64

 

Edited November 27, 2019 by Jason Ramy
os info

[Marcos 4,704]

Please try uninstalling EES 6.5 and installing the latest v7.2 from scratch. Should the problem persist, provide us with logs collected with ESET Log Collector.

[Jason Ramy 0]

I don't like 7.2. I will check the logs and see what's happening in them, however. Might not be a bad idea.

 

It isn't happening on v5, I did check that out and it looked to have downloaded the same exact modules with the update.

Edited November 28, 2019 by Jason Ramy
update.

[Marcos 4,704]

With v6.5 you don't have streamed updates, Ransomware shield, Deep behavior inspection, Advanced machine learning, kernel running as a protected service, AMSI scanner, Network protection and other invaluable protection features that can save your machine from being compromised.

V5 is even older and cannot cope with today's malware as effectively as newer versions.

An antivirus program should not be about liking or not liking its GUI but primarily about protection features, efficiency and system footprint.

[Jason Ramy 0]

Really 99% of my reason to recommend eset is the firewall. The A/V function are secondary to that, mainly scanning things that look suspicious. Between the web filter and ublock malware has really had a hard time trying to get any sort of foothold. In years, nothing has even downloaded, let alone executed.

If I were going to deploy, I'd probably stick with whatever the latest version is and turn all the features on. I wouldn't be worried about the UI, except for the remote administrator portion. Can't trust the regular users.

 

Anyways, I did a clean install. I re-did my settings instead of importing the profile. So far so good. What I did different this time is not name a firewall profile and just left it blank. I'll see how this works out over the next day or 2.