Advanced Plus Security ErzCrz Security Config 2024

[ErzCrz]

CF & VS are overkill. Choose one.

You are correct. VS is my choice for now so not going down the CF route as the WFH and VS creating rules for not safe items covers everything and keeping DefenderUI. Just WFC got tedious and seemed to cause issues. Thanks

 

[ErzCrz]

Just re-added WFC. Seems I need to restart after creating some rules for them to come into effect and having a little more patience with it initially was key.

So far not had the issues I was experiencing previously and partly turned out to Edge updating itself in the background even though I have Boost turned off and had Ended Task for the processes manually. Turning off getting updates quickly in Edge settings seems to have resolved that so it only updates when Edge is running rather than system idle.

EDIT: The WFH rules seem to get ignored if using WFC as I had a prompt for rundll.exe connecting out to port 443 this morning but I'll leave the WFH rules in place just in case.

On a different note, recovering from 2nd and last Rituximab IV infusion today so replies might be a bit slow for a day.

 

[Digmor Crusher]

recovering from 2nd and last Rituximab IV infusion today

Good luck with that.

 

[ErzCrz]

Good luck with that.

Thanks Just really knackered (tired) and all over aches and will probably feel rundown here and there for a couple of days but off work at the moment for another 2 weeks so plenty of time to recover, watch some of my favourite foreign crime dramas, sleep and some GW2

 

[ErzCrz]

Been having to add some static rules for streaming catch-up TV lately with my medium mode configuration

Spoiler: Static Rules

Static rules:
! Block beacons, obsolete plugins and websocket biderectional data connections on insecure websites
|HTTP://*$ping,object,websocket,important

! Block potentially unsafe third-party content linking to unsafe unencrypted websites
|HTTP://*$third-party,~document,~stylesheet,~image,~media,important

! Warn when opening webpages on top level domains and countries I never visit
||*$document,domain=~com|~info|~io|~eu|~net|~org|~uk|~ms|~gov

! Block third-party scripts and frames linking to top level domains and countries I never visit
||*$third-party,script,frame,to=~com|~info|~io|~eu|~net|~org|~uk|~ms|~gov

Spoiler: Dynamic Rules

Dynamic rules:
no-csp-reports: * true
no-large-media: behind-the-scene false
no-strict-blocking: zorkas.fr true
* * 3p-frame block
* * 3p-script block
* com * noop
* eu * noop
* info * noop
* io * noop
* net * noop
* org * noop
* twitch.tv * noop
* uk * noop
behind-the-scene * * noop
behind-the-scene * 1p-script noop
behind-the-scene * 3p noop
behind-the-scene * 3p-frame noop
behind-the-scene * 3p-script noop
behind-the-scene * image noop
behind-the-scene * inline-script noop

BBC Rule to play videos:
! 2024-01-09 BBC - Home
@@||r.bbci.co.uk/e/mediaplayout/*$ping,domain=www.bbc.co.uk
@@||mybbc-analytics.files.bbci.co.uk/echo-client-js/*$script,domain=www.bbc.co.uk

Channel4 On Demand to fix video playback issues:
! 2023-12-29 Channel 4 | Stream & Watch Live TV
@@||monitor.channel4.com/logs/dotcom/client/html5player$xhr,domain=www.channel4.com
@@||monitor.channel4.com/metrics/dotcom/client/html5player$xhr,domain=www.channel4.com

ITVX Playback issues rule:
! 2023-12-30 https://www.itv.com
@@||cpt.itv.com^$ping,domain=www.itv.com

Not a big deal but some of these sites working their way around the blocking including some sites using 3rd party frames. Anyway, just wanted to share those. It wasn't that long ago I switched up form a Hard Mode to Medium Mode.

 

[ErzCrz]

For info regarding Resource usage with my current setup:

I though Defender was meant to be lighter these days but that 267 MB is average though maybe affected by DefenderUI Recommended tweaks.Not all that noticable with 16gig ram on board but yeah, all seems to be running fine.

 

[Ink]

No memory leak, no problem.

CPU usage 0.1%? That’s a deal-breaker. /s

 

[ErzCrz]

No memory leak, no problem.

CPU usage 0.1%? That’s a deal-breaker. /s

Indeed, memory is fine though it runs at 120mb without tweaks. CPU only increases to about 4% but only when launching applications.

 

[ErzCrz]

Thinking I may have to do a dynamic ports rule for Teams Update, I get a pop-up every time Teams connects out to 443 to update via a different dynamic port.
Dynamic ports: 49152 - 65535. WFC is useful though I miss CF's simplicity even though it would be Overkill with Cyberlock/VoodooShield.
I've set CL/VS to create firewall rules for not safe items.

 

[ErzCrz]

Had some more playback errors on Channel4 On Demand. I seem to keep having to add exception rules which has been trial and error. I think at this stage I might have to change my streaming to a different browser.

Channel 4 exception rules so far:

Spoiler: Exception rules

! 2023-12-29 Channel 4 | Stream & Watch Live TV
@@||monitor.channel4.com/logs/dotcom/client/html5player$xhr,domain=www.channel4.com
@@||monitor.channel4.com/metrics/dotcom/client/html5player$xhr,domain=www.channel4.com

! 2024-01-19 Channel 4 | Stream & Watch Live TV
@@||webstats.channel4.com/b/ss/channel4dotcom/*$image,domain=www.channel4.com
@@||webstats.channel4.com/b/*$image,domain=www.channel4.com
@@||sdk.fra-01.braze.eu^$xhr,domain=www.channel4.com
@@||dpm.demdex.net/id$xhr,domain=www.channel4.com
@@||b45f12f3d1d8ff61fde258f94943ae3b02a43d94.cws.conviva.com^$xhr,domain=www.channel4.com
@@||logx.optimizely.com^$xhr,domain=www.channel4.com

Just strange. Most of these are xhr protocol. Will try with Edge and see if issue is reproduced without these exception rules.

 

[oldschool]

Had some more playback errors on Channel4 On Demand.

Do you have Exploit Protection settings enabled for FF? I had to make some changes to my setup and that solved the issue I had with Hulu.

 

[ErzCrz]

Do you have Exploit Protection settings enabled for FF? I had to make some changes to my setup and that solved the issue I had with Hulu.

Thanks for reply.

No, not using any exploit tweaks beyond Windows 11 defaults at the moment. Doesn't appear to relate to my uBO configuration as the block log would indicate as such. Doing some re-testing and see if I can figure out the cause. I might try disabling the Firefox video pop-out feature as I never seem to use it but I doubt that's related.

 

[ErzCrz]

Just changed my primary browser to Edge. To many issues with DRM content playback with Firefox and for general convenience. I'll probably implement some of these changes to Edged: How to Make Edge Less Annoying but yeah, a simple change. Otherwise all running fined

 

[ErzCrz]

Removed WFC, was causing some random network issues and although useful it's very talkative and I just prefer Comodo Firewall.

**I'm aware that CF with CruelSister settings is a bit of an overkill but it works fine with CL/VS. DefenderUI probably not needed so that might get removed but there's no conflict**

 

[Szellem]

Some brief amendments.
1. Removed WFC - Had some browsing lag after a number of rules created, slow resume of WIFI connection after hibernate and a lot of connection alerts got a bit tedious if I didn't put it in Learning Mode for a couple of days.
2. Implemented @Andy Ful 's WindowsFirewallHardening with H_C Recommended rules applied.
3. Enabled VS/CL rule to create rules for Not Safe items.
View attachment 280748
I may end up going down the CF route eventually as it'll work with VS/CL if using @cruelsister 's configuration at which point DefenderUI might not be needed.

So, some changes this year already but just finding what works best without issue.

Which is this configuration? I mean for CF.

 

[ErzCrz]

Which is this configuration? I mean for CF.

Yes, sometimes I forget to include a context so sorry for the confusion. I'm trying not to change config too much this year but as per my post earlier I changed back to Comodo Firewall using CruelSister's configuration which is a great set and forget.

 

[Szellem]

Yes, sometimes I forget to include a context so sorry for the confusion. I'm trying not to change config too much this year but as per my post earlier I changed back to Comodo Firewall using CruelSister's configuration which is a great set and forget.

Thanks for the reply! I will try that today. I'll be curious to see how much easier my system will be compared to Kaspersky.

 

[ErzCrz]

Thanks for the reply! I will try that today. I'll be curious to see how much easier my system will be compared to Kaspersky.

Kaspersky includes a firewall already though some people have used Kaspersky Free with CF if it's installed first though Kaspersky has been known to show a conflict alert when the two are running together. Kaspersky is a good product so use that if it works for you.

CF is light on the system I'm just waiting for 3rd Beta and eventual stable to come out before switching to the new version

 

[Szellem]

Kaspersky includes a firewall already though some people have used Kaspersky Free with CF if it's installed first though Kaspersky has been known to show a conflict alert when the two are running together. Kaspersky is a good product so use that if it works for you.

CF is light on the system I'm just waiting for 3rd Beta and eventual stable to come out before switching to the new version

View attachment 281237

The truth is that Kaspersky 21.16 didn't do very well. For example, web pages are noticeably slower to load. I'm looking for an alternative where I can play Call of Duty in peace and it doesn't block or interfere with online interaction. And it doesn't hold the machine.

 

[ErzCrz]

Back to using WFC just because I'm covered with CL/VS and DefenderUI without the need for CFW overkill.