Re: Kerio + Netia

Użytkownik "Solar" <solar91@opBEZTEGO.pl> napisał w wiadomości
news:essfak$3rs$1@news.onet.pl...
goomish napisał(a):

> Regułki dotyczące przeglądarek nie wystarczą. Te (OIDP wbudowane,
> domyślne) odnoszące się do komunikacji z serwerami DNS, DHCP itp
> sprawdziłeś?

Jeszcze dodam fragment z logu kerio

1,[09/Mar/2007 20:27:55] Rule 'Block Out NetBIOS TCP UDP': Blocked: Out
UDP, localhost:137->87.205.42.11:137, Owner: SYSTEM
1,[09/Mar/2007 20:27:56] Rule 'Block Out NetBIOS TCP UDP': Blocked: Out
UDP, localhost:137->87.205.42.11:137, Owner: SYSTEM
1,[09/Mar/2007 20:27:58] Rule 'Block Out NetBIOS TCP UDP': Blocked: Out
UDP, localhost:137->87.205.42.11:137, Owner: SYSTEM
1,[09/Mar/2007 20:28:14] Rule 'Block Out NetBIOS TCP UDP': Blocked: Out
UDP, localhost:137->87.205.44.182:137, Owner: SYSTEM
1,[09/Mar/2007 20:28:16] Rule 'Block Out NetBIOS TCP UDP': Blocked: Out
UDP, localhost:137->87.205.44.182:137, Owner: SYSTEM
1,[09/Mar/2007 20:28:17] Rule 'Block Out NetBIOS TCP UDP': Blocked: Out
UDP, localhost:137->87.205.44.182:137, Owner: SYSTEM

To wycielo ruch *wychodzacy* z twojego komputera do adresu 87.205.44.182 na
porcie
137/udp, to jest ogloszenie uslug przegladania sieci i bardzo dobrze ze je
wycielo.
Nie ma nic wspolnego z IE/OE, de facto, taki pakiet zasadniczo nie powinien
wogole
sie pojawic.

1,[09/Mar/2007 20:29:32] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.205.50.96:3877->localhost:1433, Owner: no owner
1,[09/Mar/2007 20:30:17] Rule 'Packet to unopened port received':
Blocked: In TCP, 90.194.107.68:1451->localhost:6348, Owner: no owner
1,[09/Mar/2007 20:52:03] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.205.95.235:4574->localhost:2967, Owner: no owner
1,[09/Mar/2007 20:52:05] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.205.95.235:4574->localhost:2967, Owner: no owner
1,[09/Mar/2007 20:54:37] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.205.51.110:1032->localhost:8555, Owner: no owner
1,[09/Mar/2007 20:54:40] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.205.51.110:1032->localhost:8555, Owner: no owner
1,[09/Mar/2007 20:59:03] Rule 'Packet to unopened port received':
Blocked: In TCP, 82.44.5.61:2075->localhost:6348, Owner: no owner
1,[09/Mar/2007 20:59:06] Rule 'Packet to unopened port received':
Blocked: In TCP, 82.44.5.61:2075->localhost:6348, Owner: no owner
1,[09/Mar/2007 20:59:11] Rule 'Packet to unopened port received':
Blocked: In TCP, 82.44.5.61:2075->localhost:6348, Owner: no owner
1,[09/Mar/2007 21:02:40] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.205.46.172:63810->localhost:5900, Owner: no owner
1,[09/Mar/2007 21:04:03] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.119.103.131:4732->localhost:2967, Owner: no owner
1,[09/Mar/2007 21:06:47] Rule 'Packet to unopened port received':
Blocked: In TCP, 87.205.49.212:3172->localhost:1433, Owner: no owner
1,[09/Mar/2007 21:07:39] Rule 'Packet to unopened port received':
Blocked: In TCP, 82.7.115.15:1409->localhost:6348, Owner: no owner
1,[09/Mar/2007 21:07:42] Rule 'Packet to unopened port received':
Blocked: In TCP, 82.7.115.15:1409->localhost:6348, Owner: no owner
1,[09/Mar/2007 21:07:49] Rule 'Packet to unopened port received':
Blocked: In TCP, 82.7.115.15:1409->localhost:6348, Owner: no owner

To z kolei wycina rozne pakiety *przychodzace* do twojego komputera z
roznych adresow (82..., 87..., 90...) na rozne porty (6348,1433, 2967, 5900
itd).
Tez bardzo slusznie, to smieciowy ruch, jakies wirusy itp smieci).

Tylko jak na tej podstawie wyedytować/stworzyć regułę w Kerio?

Na tej podstawie nie zrobisz regulek. Zeby napisac regulke, musisz wiedziec
jaki ruch uznajesz za pozadany i ladnie go zapisac, najlepiej na papierze
(to bardzo ulatwia) a pozniej przepisac do Kerio.
Zasadniczo, najprostsze regulki dla IE/OE to:
Zezwol na kazdy ruch wychodzacy na dowolny adres IP w protokole TCP do
portow
25, 80, 110, 119, 143, 443, 465, 563, 995 (odpowiednio SMTP, HTTP, POP3,
NNTP, IMAP4, HTTPS,
SMTPS, NTTPS, POP3S) oraz w UDP na port 53 twoich serwerow DNS, reszte ruchu
odrzuc.

Moja konfiguracja jest dobra dla stacji ktora gada tylko z internetem, jesli
chcesz jakichs ekstra
uslug to musisz je explicite dodac (Przegladanie sieci Microsoft przez
Otoczenie Sieciowe, dostep
do plikow przez udzialy na innych komputerach, dostep do plikow u ciebie
itp).

k
Received on Sat Mar 10 00:20:09 2007