Managing the Personal Firewall

The Personal Firewall monitors the communications between your computer and other computers on the Internet. It also protects your computer from such common security problems as the following:

Improper connection attempts | Warns you of connection attempts from other computers and of attempts by programs on your computer to connect to other computers
Port scans | Cloaks the inactive ports on your computer and detects port scans
Intrusions | Detects and blocks malicious traffic and attempts by outside users to attack your computer

More Information

Making decisions about network traffic

Allowing or blocking access to your computer

Finding a computer's IP address

About firewall rules

Adding firewall rules

Changing an existing firewall rule

Changing the order of firewall rules

Turning off a General rule temporarily

Removing a firewall rule

About Intrusion Prevention

About Personal Firewall options


Making decisions about network traffic

When your computer is in a protected state, the Personal Firewall makes decisions about allowing and blocking communications to and from your computer. This automatic decision making process minimizes the number of notifications and dialog boxes that ask you what to do when a network event occurs.

If you want more control over network traffic decisions, you can turn off automatic decision making. When a network event occurs, an alert will prompt you to configure access settings.

To turn off automatic decision making

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Personal Firewall.

  4. Click Configure.

  5. In the Personal Firewall General Settings window, under How to respond when a program attempts to communicate with the Internet, click Ask me what to do.

  6. Click OK.

Once you have turned off automatic decision making, you can turn off Automatic Program Control. Turning off Automatic Program Control gives you more control over the Internet access settings for your programs.

More Information

Turning off Automatic Program Control

About Personal Firewall General Settings options

Managing the Personal Firewall


Allowing or blocking access to your computer

When your computer connects to a network, Norton Internet Security classifies the network as active. The Personal Firewall monitors communications to and from other computers on the network and grants or blocks access as necessary. You can use Personal Firewall Trust Control options to reclassify a network as trusted or restricted. You can also trust or restrict individual computers.

Restricted computers and computers that are on a restricted network cannot directly access your computer. Restricting a network has no effect on your computer's ability to access other computers. You can also continue to use the network for Web browsing, email, or other communications.

Restricting a network or computer does not protect you from Internet-based risks such as viruses and spyware. To ensure an adequate protection level, you should not turn off any Norton Internet Security features even when you use a restricted network.

When you use a wireless network in a public place such as a coffeehouse, you might want to restrict the network. Restricting a network ensures that no other computer on the network can directly access your computer.

If you trust a network, computers that are on that network can have the following types of access:

Open access | Computers are not subject to firewall rules and can access all files, printers, and ports on your computer.
Shared access | Computers can access all files and printers on your computer, but are subject to all other firewall rules and settings.

On both open and shared trusted networks, Intrusion Prevention remains in effect, so computers cannot send known attack signatures to your computer.

If you trust an individual computer, that computer will have open access to your computer.

To trust a network

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Trust Control.

  5. On the right side, do one of the following:

    • To trust an unassigned network, on the Active tab, click a network.

    • To trust a restricted network, on the Restricted tab, click a network.

  6. Click Trust.

  7. In the Properties dialog box, do one of the following:

    • To assign shared access, click Allow file sharing on this network (recommended).

    • To assign open access, click Allow all network activity on this network.

    You can also type a description of the network, if necessary.

  8. Click OK.

  9. In the Internet Security Options window, click OK.

To trust a computer

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Trust Control.

  5. On the right side, click the Trusted tab.

  6. On the Trusted tab, click Add.

  7. In the Enter Trusted Computer dialog box, type the IP address or physical address (also know as the Media Access Control, or MAC, address) of the computer that you want to trust, and then click OK.

  8. In the Internet Security Options window, click OK.

To restrict a network

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Trust Control.

  5. On the right side, do one of the following:

    • To restrict an unassigned network, on the Active tab, click a network.

    • To restrict a trusted network, on the Trusted tab, click a network.

  6. Click Restrict.

  7. In the confirmation dialog box, click Yes.

  8. In the Internet Security Options window, click OK.

To restrict a computer

  1. In the main window, under Quick Tasks, click View History.

  2. In the Security History window, in the Select View drop-down list, select Firewall - Traffic.

  3. In the Firewall-Traffic list, click the row that notes that the computer that you want to restrict was blocked from accessing your computer.

    The list identifies the computer by its IP address.

  4. At the bottom of the Alert Details pane, click More Details.

  5. In the Alert Summary window, in the Actions section drop-down list, click Restrict.

  6. Click Apply.

  7. Close the Security History window.

More Information

About Personal Firewall Trust Control options

Finding a computer's IP address

Stopping all network and Internet traffic

Using Security History

Managing the Personal Firewall


Finding a computer's IP address

There are two procedures for finding a computer’s IP address. On Windows 98/Me computers, you can use Winipcfg to find the IP address of a computer. On Windows 2000/XP and Windows Vista computers, you can use Ipconfig to find the IP address of a computer.

Winipcfg and Ipconfig report the IP address of their local computer only. You must run these programs on the computer you want to identify.

To find an IP address by using Winipcfg

  1. On the computer you want to identify, on the Windows taskbar, click Start > Run.

  2. In the Run dialog box, type winipcfg

  3. Click OK.

  4. Select the appropriate network adapter.

  5. Write down the IP address.

To find an IP address by using Ipconfig on Windows 2000/XP

  1. On the computer you want to identify, on the Windows taskbar, click Start > Run.

  2. In the Run dialog box, type cmd

  3. Click OK.

  4. At the command prompt, type ipconfig, and then press Enter on your keyboard.

  5. Write down the IP address.

To find an IP address by using Ipconfig on Windows Vista

  1. On the computer you want to identify, on the Windows taskbar, click Start.

  2. In the Start Search text box, type cmd, and then press Enter on your keyboard.

  3. At the command prompt, type ipconfig, and then press Enter on your keyboard.

  4. Write down the IP address.

More Information

Allowing or blocking access to your computer


About firewall rules

Firewall rules control how the Personal Firewall protects your computer from malicious programs and unauthorized access. The firewall automatically checks all traffic that comes in or out of your computer against these rules.

The Personal Firewall uses two kinds of firewall rules: Program Control rules and General rules. Program Control rules control Internet access for programs on your computer. General rules control all other incoming and outgoing network traffic.

More Information

About firewall rule processing

About General rules

About Program rules


About firewall rule processing

The Personal Firewall processes General rules first, and then Program rules. Within the list of General rules, rules are processed in order of appearance, from top to bottom. Program Control entries are not processed in order. The rules within each Program Control entry, however, are processed in order of appearance, from top to bottom.

For example, you may have a Program rule that blocks the use of Symantec pcAnywhere™ with any other computer. If you add a rule that allows the use of Symantec pcAnywhere with a specific computer and move the new rule above the original rule, the new rule lets you use Symantec pcAnywhere with that specific computer, but the original rule prevents its use with any other computer.

More Information

About firewall rules

About General rules

About Program rules

Adding firewall rules

Changing an existing firewall rule

About Personal Firewall Program Control options

About Personal Firewall Advanced Settings options


About General rules

Norton Internet Security includes a number of predefined general firewall rules. These rules provide network functionality and protection from known Internet risks. Examples of default firewall rules include the following:

Default Inbound ICMP Default Outbound ICMP | Permits all types of outbound and safe types of inbound ICMP (Internet Control Message Protocol) messaging. ICMP messages provide status and control information.
Default Inbound NetBIOS Name Default Inbound NetBIOS | Controls the use of the NetBIOS name service and the NetBIOS datagram service that the Microsoft Network uses in file and printer sharing.
Default Inbound Loopback Default Outbound Loopback | Permits inbound and outbound loopback connections to the localhost address of 127.0.0.1. It is usually safe to permit loopback or local connections because the connection originator is typically a trusted program on your computer. Even with this firewall rule turned on, remote computers are never allowed access to the localhost address by the underlying network.
Default Inbound Bootp Default Outbound Bootp | Permits the use of the Bootp service. Bootp is short for Bootstrap Protocol, which enables a computer to discover its own IP address.

More Information

About firewall rules

About firewall rule processing

Adding firewall rules

Changing an existing firewall rule

About Personal Firewall Advanced Settings options

About Program rules


About Program rules

Program rules control Internet access for programs that are on your computer.

You can create Program rules in the following ways:

Automatically customize Internet access settings for common programs

Let the firewall automatically configure access for well-known programs the first time that users run them. This method is the easiest way to create firewall rules.

Use Program Control

Manage the list of programs that can access the Internet.

Respond to alerts

Let the firewall notify you when a program attempts to access the Internet. You can then allow or block Internet access for the program.

The firewall notifies you only if you have changed the Personal Firewall General Settings options from their default, recommended settings.

About Personal Firewall General Settings options

More Information

Turning off Automatic Program Control

Adding a program to Program Control

Removing a program from Program Control

Customizing Program Control

About Personal Firewall Program Control options

About General rules


Turning off Automatic Program Control

Automatic Program Control automatically configures Internet access settings for programs the first time that they run. Automatic Program Control configures Internet access only for the versions of programs that Symantec recognizes as safe. If you want to determine Internet access settings for your programs, you can turn off Automatic Program Control. When a program tries to access the Internet for the first time, an alert prompts you to configure access settings.

Symantec regularly updates the list of recognized programs. You should run LiveUpdate regularly to ensure that your list is up to date.

You cannot turn off Automatic Program Control when the Automatically decide what to do option is selected in the Personal Firewall General Settings window.

To turn off Automatic Program Control

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Web Browsing, click Personal Firewall.

  4. Click Configure.

  5. In the Personal Firewall General Settings window, under Firewall Processing, uncheck Automatically customize Internet access settings for common programs.

  6. Click OK.

More Information

Making decisions about network traffic

About Personal Firewall General Settings options

About Program rules

Customizing Program Control

Keeping current with LiveUpdate


Adding a program to Program Control

You can add programs to Program Control to control their ability to access the Internet. Manually configured Program Control settings override any settings that are made by Automatic Program Control.

Program Control settings are not migrated from previous versions of Norton Internet Security. If you want to restore any programs that you manually added to Program Control in the previous version, you must add them again in the current version.

To add a program to Program Control

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Program Control.

  5. On the right side, click Add.

  6. In the Select a program dialog box, browse to the executable file for the program that you want to add.

  7. Click Open.

  8. In the Program Control alert, select the access level that you want this program to have. Your options are:

    Automatically configure Internet access

    Use the default Norton Internet Security settings for this program.

    Allow

    Allow all access attempts by this program.

    Block

    Deny all access attempts by this program.

    Manually configure Internet access

    Create rules that control how this program accesses the Internet.

  9. Click OK.

More Information

About Program rules

Customizing Program Control

Turning off Automatic Program Control

Removing a program from Program Control

About Personal Firewall Program Control options


Removing a program from Program Control

You can remove programs from Program Control if necessary.

Program Control settings are not migrated from previous versions of Norton Internet Security. If you removed any programs from Program Control in the previous version and want them to remain removed, you must remove them again from the current version.

To remove a program from Program Control

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Program Control.

  5. On the right side, in the Programs column, select the program that you want to remove.

  6. Click Remove.

  7. In the Confirmation dialog box, click Yes.

  8. Click OK.

More Information

About Program rules

Customizing Program Control

Turning off Automatic Program Control

Adding a program to Program Control

About Personal Firewall Program Control options


Customizing Program Control

After using Norton Internet Security, you may find that you need to change the access settings for certain programs.

To customize Program Control

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Program Control.

  5. On the right side, in the Program column, locate the program that you want to change.

  6. In the drop-down list next to the program that you want to change, select the access level that you want this program to have. Your options are:

    Allow

    Allow all access attempts by this program.

    Block

    Deny all access attempts by this program.

    Custom

    Create rules controlling how this program accesses the Internet.

    Auto

    Use the default Norton Internet Security settings for this program.

  7. Click OK.

More Information

About Program rules

Turning off Automatic Program Control

Adding a program to Program Control

Removing a program from Program Control

About Personal Firewall Program Control options


Adding firewall rules

Program Control automatically creates most of the firewall rules that you need. You can add custom rules if necessary.

Only experienced users should create their own firewall rules.

You can add the following types of firewall rules:

  • General rules

  • Program rules

To add a General rule

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Advanced Settings.

  5. On the right side, under General Rules, click Configure.

  6. In the General Rules window, click Add.

  7. Follow the instructions in the Add Rule wizard.

To add a Program rule

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Program Control.

  5. On the right side, in the Program column, select the program to which you want to add a rule.

  6. Click Modify.

  7. In the Program Rules window, click Add.

  8. Follow the instructions in the Add Rule wizard.

More Information

Using the Add Rule wizard

Changing the order of firewall rules

Turning off a General rule temporarily

Removing a firewall rule

About Personal Firewall Advanced Settings options

About Personal Firewall Program Control options


Using the Add Rule wizard

The Add Rule wizard leads you through the steps that are necessary to create firewall rules.

To use the Add Rule wizard

  1. Open the Add Rule wizard by creating a General rule or a Program rule.

  2. In the first panel of the Add Rule wizard, select the action that you want for this rule. Your options are:

    Permit

    Allow communication of this type to take place.

    Block

    Prevent communication of this type from taking place.

    Monitor

    Update the Firewall Activities tab in the Event Log each time that communication of this type takes place. This lets you monitor how often this firewall rule is used.

  3. Click Next.

  4. Select the type of connection for the rule. Your options are:

    Connections to other computers

    The rule applies to outbound connections from your computer to another computer.

    Connections from other computers

    The rule applies to inbound connections from another computer to your computer.

    Connections to and from other computers

    The rule applies to both inbound and outbound connections.

  5. Click Next, and then select the computers that apply to the rule. Your options are:

    Any computer

    The rule applies to all computers.

    Only the computers or sites listed below

    The rule applies only to the computers, sites, or domains that are listed.

  6. Click Next, and then select the protocols for the rule. Your options are:

    TCP

    The rule applies to TCP (Transmission Control Protocol) communications.

    UDP

    The rule applies to UDP (User Datagram Protocol) communications.

    TCP and UDP

    The rule applies to both TCP and UDP communications.

    ICMP

    The rule applies to ICMP (Internet Control Message Protocol) communications.

    ICMPv6

    The rule applies to ICMP (Internet Control Message Protocol for Internet Protocol version 6) communications.

    All

    The rule applies to all supported protocols.

    For UDP communications, the rule analyzes the first datagram only. If the rule applies, the same action (permit, block, or monitor) will be used for all subsequent UDP datagrams that flow in either direction between the same endpoints.

  7. Select the ports for the rule. Your options are:

    All types of communications (all ports)

    The rule applies to communications using any port.

    Only the types of communications or ports listed below

    The rule applies to the ports listed. You can add or remove ports from the list.

  8. Click Next, and then select if and how you want the rule to be tracked. Your options are:

    Create an Event Log entry

    An entry is created in the firewall Event Log when a network communication event matches this rule.

    Only log event after it occurs X times

    Control when the Personal Firewall begins logging network communication that matches this rule.

  9. Click Next, and then, in the text box, type a name for this rule.

  10. Click Next, and then review the new rule settings

  11. Click Finish.

  12. When you have finished adding rules, click OK.

More Information

Adding firewall rules

About firewall rules

About General rules

About Program rules

Changing an existing firewall rule

About Personal Firewall Program Control options


Changing an existing firewall rule

You can change and existing firewall rule if it does not function the way that you want.

To change a General rule

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Advanced.

  5. On the right side, under General Rules, click Configure.

  6. In the General Rules window, select the rule that you want to change.

  7. Click Modify.

  8. In the Modify Rule window, follow the on-screen instructions to change any aspect of the rule.

  9. When you have finished changing the rule, click OK.

  10. In the General Rules window, click OK.

  11. In the Internet Security and Firewall Options window, click OK.

To change a Program rule

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Program Control.

  5. On the right side, in the Program column, select the program that you want to change.

  6. Click Modify.

  7. In the Program Rules window, select the rule that you want to change.

  8. Click Modify.

  9. In the Modify Rule window, follow the on-screen instructions to change any aspect of the rule.

  10. When you have finished changing the rule, click OK.

  11. In the Program Rules window, click OK.

  12. In the Internet Security and Firewall Options window, click OK.

More Information

Adding firewall rules

About Personal Firewall Program Control options

About Personal Firewall Advanced Settings options

Using the Add Rule wizard


Changing the order of firewall rules

Each list of firewall rules is processed from the top down. You can adjust how the firewall rules are processed by changing their order.

Do not change the order of the default General rules unless you are an advanced user. Changing the order of default General rules could affect firewall functionality and reduce the security of your computer.

To change the order of General rules

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Advanced.

  5. On the right side, under General Rules, click Configure.

  6. In the General Rules window, select the rule that you want to move.

  7. Do one of the following:

    • To process this rule before the rule above it, click Move Up.

    • To process this rule after the rule below it, click Move Down.

  8. When you are done moving the rules, click OK.

To change the order of Program rules

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Program Control.

  5. On the right side, in the Program column, select the program that contains the rule that you want to move.

  6. Click Modify.

  7. In the Program Rules window, select the rule that you want to move.

  8. Do one of the following:

    • To process this rule before the rule above it, click Move Up.

    • To process this rule after the rule below it, click Move Down.

  9. When you are done moving the rules, click OK.

  10. In the Internet Security and Firewall Options window, click OK.

More Information

About firewall rule processing

Changing an existing firewall rule

Turning off a General rule temporarily

Removing a firewall rule

About Personal Firewall Program Control options

About Personal Firewall Advanced Settings options


Turning off a General rule temporarily

You can temporarily turn off a general rule if you need to allow specific access to a computer or a program. You must remember to turn on the rule again when you are done working with the program or computer that required the change.

To turn off a General rule temporarily

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Advanced.

  5. On the right side, under General Rules, click Configure.

  6. In the General Rules window, uncheck the box next to the rule you want to turn off.

  7. Click OK.

  8. In the Internet Security and Firewall Options window, click OK.

More Information

About Personal Firewall Advanced Settings options

About General rules


Removing a firewall rule

You can remove firewall rules if necessary.

Do not remove a default General rule unless you are an advanced user. Removing a default General rule could affect firewall functionality and reduce the security of your computer.

To remove a General rule

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Advanced.

  5. On the right side, under General Rules, click Configure.

  6. In the General Rules window, select the rule that you want to remove.

  7. Click Remove.

  8. When you are done removing rules, click OK.

  9. In the Internet Security and Firewall Options window, click OK.

To remove a Program rule

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Settings bar.

  3. Under Additional Options, click Internet Security and Firewall options.

  4. In the Internet Security Options window, on the left side, click Program Control.

  5. On the right side, in the Program column, select the program that contains the rule that you want to remove.

  6. Click Modify.

  7. In the Program Control window, select the rule that you want to remove.

  8. Click Remove.

  9. When you are done removing rules, click OK.

  10. In the Internet Security and Firewall Options window, click OK.

More Information

Changing an existing firewall rule

Turning off a General rule temporarily

Changing the order of firewall rules

Removing a program from Program Control


Attack Detected

Intrusion Prevention identified that a recent incoming communication attempt may have been part of an attack. If AutoBlock is on, it will automatically block all communication with this computer for 30 minutes.

In some cases, Intrusion Prevention might recognize normal activity as an attack. If you can't communicate with a computer that you should be able to communicate with, see if it is on the list of Computers currently blocked by AutoBlock.


Protection Alert

When the Personal Firewall is turned off, your computer is not protected from Internet threats and security risks. If you cannot view certain online content, you should adjust individual security settings instead of turning off the Personal Firewall.

If you must turn off the Personal Firewall, you should turn it off temporarily to ensure that it will turn on again automatically.

To turn off the Personal Firewall temporarily

  • In the drop-down list, select the amount of time that the Personal Firewall should be turned off, and then click OK.

    To ensure that your computer remains protected, you can turn on the Personal Firewall manually before the time that you specified concludes.


About restricted networks

Computers that are on a restricted network cannot directly access your computer. Connecting to a restricted network has no effect on your computer's ability to access other computers. You can also use the network for Web browsing, email, or other communications.

Connecting to a restricted network does not protect you from Internet-based risks such as viruses and spyware. To ensure an adequate protection level, you should not turn off any Norton Internet Security features even when you use a restricted network.

More Information

Allowing or blocking access to your computer


Personal Firewall

When Automatic Program Control is turned on, Norton Internet Security creates a firewall rule the first time that it detects that a recognized program is trying to access the Internet.

Run LiveUpdate weekly to keep the list of recognized programs current.

More Information

Turning off Automatic Program Control

Changing an existing firewall rule


Configure Program Component Monitoring

Program Component Monitoring ensures that Trojan horses and other malicious programs cannot attach to a safe program and evade detection. When Program Component Monitoring is active, it will alert you whenever a program uses an unrecognized component to access the Internet. You can then choose to allow or block access for this component.

All of the programs on your computer will be able to use the components that are listed in the Configure Program Component Monitoring dialog box to access the Internet. To learn more about a particular component, click its entry.


Configure Program Launch Monitoring

Program Launch Monitoring helps ensure that Trojan horses and other malicious programs cannot launch and manipulate safe programs without your knowledge. When Program Launch Monitoring is active, it will alert you whenever an unrecognized program launches another program. You can then choose to allow or block Internet access for the unrecognized program.

All of the programs listed in the Configure Program Launch Monitoring dialog box will be able to launch other Internet-enabled programs. Click the Add and Remove buttons to customize this list.