Configuration of Shareaza - It´s correct???

SeekingSecurity · January 14, 2007, 5:06pm

Hello friends:

I create a rule for shareaza of a forum:

Open Comodo and click Security Application monitor.
Now click on add. In the first textbox under Application / Parent Application put in the path to your shareaza.exe (The default is C:\Program Files\Shareaza\Shareaza.exe)
select learn parent and allow all activities for this application. Also click Allow invisible connection attempts and skip advanced security checks, Click OK.

Next were going to add an port exception so shareaza can use this port.

Now click network monitor and add.
action = allowed. Protocol = TCP or UDP. Direction In/Out. Now click the Destination port tab, Select “A single port”, now enter the port you use for shareaza (the default is 6346). Click OK.
You should now see a new rule has been created, now select this rule. Place it above the rule with the red X that reads “Block & Log”.

My question is:

this configuration is secure?
Before create a rule about a port 6346 allowing this, why “Block & Log” this rule?. I don´t understand, now block this port?

Sorry for my poor english. Bye. (:WIN)

SeekingSecurity · January 14, 2007, 5:27pm

Hello:

With this configuration, I have connection but edonkey show lod id???

What´s the solution?

Chiao. (:SAD)

Rucia · January 14, 2007, 8:08pm

Benvenuto alle tribune!

To answer your first two questions:
Firstly, yes your configuration is secure because only shareaza will be listening, accepting & processing requests on that port. When shareaza is not running the port is closed and will be in stealth mode.

Secondly, if i understand you correctly you mean the default block rule. This should always appear at the bottom of your network monitor rules. And what it does is stop unsolicited IP traffic which doesn’t have a rule. It basically blocks the traffic you haven’t explicity allowed.

With this configuration, I have connection but edonkey show lod id???

Could you explain that a bit more please? I’m not sure what you mean by “lod id”

SeekingSecurity · January 15, 2007, 12:25pm

Hello:

If you have a low id (which means a slow connection to a server) then you cannot connect to other users on that server that have low ids, you may only connect to high ids on that server. So if you have broadband, keep trying to get on a good server with a high ID so you can connect to all users and get better results.

I have a router and open the port 6346, when I used Outpost firewall Pro, I did not have problems with the connection (had a HighId), but comodo firewall seems more robust, although it limits the connection to me. In other firewalls ones it was necessary to form shareaza as if he was a server, but here not another way.

If I put in network monitor allow in for all ports can enter any intruder, that I can do?

thanks to answer

SeekingSecurity · January 15, 2007, 12:53pm

Hello:

This it is a piece of my log file:

Date/Time :2007-01-15 13:03:10
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = ..., Port = 6346)
Protocol: UDP Incoming
Source: ...:61768
Destination: 192.168.1.5:6346
Reason: Network Control Rule ID = 6

Date/Time :2007-01-15 13:03:10
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = ..., Port = 6346)
Protocol: UDP Incoming
Source: ...:1439
Destination: 192.168.1.5:6346
Reason: Network Control Rule ID = 6

Date/Time :2007-01-15 13:03:10
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = ..., Port = 6346)
Protocol: UDP Incoming
Source: ...:34214
Destination: 192.168.1.5:6346
Reason: Network Control Rule ID = 6

Date/Time :2007-01-15 13:03:10
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = ..., Port = 6346)
Protocol: UDP Incoming
Source: ...:33967
Destination: 192.168.1.5:6346
Reason: Network Control Rule ID = 6