Personal firewalls

It has been a while since I messed around with firewall rules, and apparently I should get back into it. Recently I had to rebuild one of the home computers to put Windows on it. Initially (pre antivirus install), I shut down all the non-essential windows vista default services that I could think of and left the basic Microsoft provided firewall running. To check for any obvious opening, I ran a basic nmap Syn scan

Starting Nmap 4.75 ( http://nmap.org ) at 2010-10-24 14:46 
Initiating ARP Ping Scan at 14:46 
Scanning 192.168.2.3 [1 port] Completed ARP Ping Scan at 14:46, 0.01s elapsed (1 total hosts) 
Initiating Parallel DNS resolution of 1 host. at 14:46 
Completed Parallel DNS resolution of 1 host. at 14:46, 0.02s elapsed 
Initiating SYN Stealth Scan at 14:46 Scanning 192.168.2.3 [1000 ports] 
Completed SYN Stealth Scan at 14:47, 21.88s elapsed (1000 total ports) 
Host 192.168.2.3 appears to be up ... good.
All 1000 scanned ports on 192.168.2.3 are filtered MAC Address: 00:23:AE:1B:1F:6E (Unknown)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 22.08 seconds
          Raw packets sent: 2001 (88.042KB) | Rcvd: 2 (98B)

Looks ok to me. So after buying antivirus (customer wanted Kaspersky), we got the Kaspersky Internet Security 2011 suite. It looked interesting for features, and the firewall component took over for windows firewall. Using the standard config, I ran the scan again afterwards.

Starting Nmap 4.75 ( http://nmap.org ) at 2010-10-24 14:20  
Initiating ARP Ping Scan at 14:20 Scanning 192.168.2.3 [1 port] 
Completed ARP Ping Scan at 14:20, 0.11s elapsed (1 total hosts) 
Initiating Parallel DNS resolution of 1 host. at 14:20 
Completed Parallel DNS resolution of 1 host. at 14:20, 2.52s elapsed 
Initiating SYN Stealth Scan at 14:20 Scanning 192.168.2.3 [1000 ports] 
Discovered open port 49156/tcp on 192.168.2.3 
Discovered open port 49153/tcp on 192.168.2.3 
Increasing send delay for 192.168.2.3 from 0 to 5 due to 53 out of 176 dropped probes since last increase.
Increasing send delay for 192.168.2.3 from 5 to 10 due to max_successful_tryno increase to 4 Discovered open port 49155/tcp on 192.168.2.3 
Increasing send delay for 192.168.2.3 from 10 to 20 due to 12 out of 39 dropped probes since last increase.
Discovered open port 49152/tcp on 192.168.2.3 
Increasing send delay for 192.168.2.3 from 20 to 40 due to 14 out of 45 dropped probes since last increase.
Discovered open port 139/tcp on 192.168.2.3 
Discovered open port 135/tcp on 192.168.2.3 
Discovered open port 49154/tcp on 192.168.2.3 
Discovered open port 1110/tcp on 192.168.2.3 
Completed SYN Stealth Scan at 14:20, 38.70s elapsed (1000 total ports) Host 192.168.2.3 appears to be up ... good.
Interesting ports on 192.168.2.3:
Not shown: 992 closed ports
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
1110/tcp  open  nfsd-status
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
MAC Address: 00:23:AE:1B:1F:6E (Unknown)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 41.58 seconds
           Raw packets sent: 1154 (50.774KB) | Rcvd: 1009 (40.612KB) dfkj123:/home

Well that's interesting. Basically the suite sees several zones. Anything on your local network, it seems to be happy with. So if you're on some public wifi spot, you're screwed. Also, most common Microsoft and commercial apps get whitelisted and all hosts (internet wide) are allowed full access. Seriously? Trying to shut all that down and fix it to something sane was looking like a near impossible task, so for simplicity I actually had to disable that and fall back to Microsoft. I hope their AV component doesn't act as badly.