Network Computers Get Blocked

[RexG 0]

I am a long term ESET user, infact have never used any other security. but for about 1 year I have been having trouble with networking  my pc's. It bseems that Eset decides out of the blue to block one or some times both pc's, I unblock them and it says will not block again, but it does fib. I have attached a screenshot showing the product ID and one of the  Network Security. Can you please make a suggestion? Thanks for your time.

 

Cheers Rex

Edited January 23, 2020 by RexG
wanted to check box for notification

[Nightowl 202]

If you go to Setup and then Network and then Troubleshooting Wizard , do you see the app that is blocked over there?

What kind of application are you trying to allow or what is the software that is blocked ?

Edited January 23, 2020 by Rami

[Marcos 5,074]

Have you already created some custom firewall rules? Is the machine within the trusted zone?

[RexG 0]

The two devices being blocked are as follows:

LAPTOP-ERIRU048

REX-DESKTOP-6QQ

Being the names of my two Network computeers, occassionall my network printer MG3660 is block but doesn't appear to be causing a problem, but I unblockm it as well if it is being blocked.

I have not created any Firewall Rules as I have never had to before and I don't really know how, anyway. Normall ESET learns but it seems to be very slow learning at the moment.

I am not considering changing my security at all but it is a bit frustrating when you have to keep doing it all over again. Any help would be appreciated.

Cheers Rex

[Marcos 5,074]

To start off, please provide logs collected as follows:
- under Help and support -> Details for customer care, enable advanced logging
- reproduce the issue
- disable logging
- collect logs with ESET Log Collector and upload the generated archive here.

[itman 1,659]

One of the problems with Eset's Network Wizard in regards to blocked connections is it is just responding to whatever immediate blocked activity occurs via firewall activity from the source network connection. Using the Network Wizard to unblock that event via permissive firewall rule creation, does not prevent the source device/connection from being blocked again if it performs different network activity. 

What needs to be done is a thorough examination of why these two device network devices are being blocked by the firewall. Assuming these two devices are part of your local network and you are using the Home/Office firewall profile, existing Eset default firewall rules should allow all legitimate network inbound and outbound activity from those devices.

Edited January 24, 2020 by itman

[RexG 0]

I will wait until the next time it happens and get the screenshots then.

Thanks for your input.

[RexG 0]

Hi All,

It didn't take long, I have attached a screenshot from network troubleshooter, after I unblocked as I forgot to doit first!

Cheers Rex

[Marcos 5,074]

Please provide logs as requested above.

[itman 1,659]

Open the Eset firewall rules section and determine what rule the Network Wizard created in regards to blocked DNS traffic for the REX-Desktop device. I suspect it was to allow inbound port 53 traffic which frankly, is a no-no. By default, Eset allows all outbound port 53 DNS traffic.

Note: As I posted previously, you cannot blindly unblock Network Wizard previously block traffic without fully determining if it is safe to do so.

Edited January 27, 2020 by itman

[RexG 0]

Hi itman,

 

Thanks for your time, I have posted two screenshots of firewall rules, the last one wouldn't fit in so had to do a second. Thanks.

 

Rex

[Marcos 5,074]

Why are there so many rules created by the troubleshooting wizard? I'd suggest removing all custom rules, making sure that your network is in the trusted zone and that's it.

Should the problem persist, carry on as follows:
- in Help and support -> Details for customer care, enable advanced logging
- reproduce the issue
- stop logging
- collect logs with ESET Log Collector and provide the generated archive
- provide information about machine and its IP address whose inbound communication was blocked.

[RexG 0]

Thanks Marcos

[RexG 0]

Have done as you suggested Marcos. Thanks for the help.

 

Cheers Rex

[itman 1,659]

9 hours ago, Marcos said:

Why are there so many rules created by the troubleshooting wizard?

This is the second recent posting that indicates there is an issue with the Eset firewall default setting for Protection type of new networks. That default setting is Use Windows setting.

Review of all the OP's unblocked Network Wizard rules clearly indicate that the Win firewall Public profile was in effect. This in turn would have resulted in Eset not populating any local subnet addresses in the Trusted Zone.

Now when Windows is installed, the Win firewall is set by default to the Home network profile. However, the user could have at some time later changed that to the Public profile prior to Eset installation. Then there is this "tidbit" I discovered on my Win 10 firewall Public profile setting. All the rules pertaining to Public profile use had been mysterious disabled somehow. I know I certainly did not do that.

What I recommend is that Eset change the default Protection type of new networks setting to Ask User which I believe was the setting in previous Eset versions. Or, set the default setting to Home/Office profile which I  believe the majority of Eset retail version users deploy.