Reply to thread

Message

<blockquote data-quote="Decopi" data-source="post: 985127" data-attributes="member: 67091">Thanks again [USER=38787]@valvaris[/USER].Yeap, I know that firewall (software) can be hardened. But the firewall (software) itself can&#039;t be hardened when processes are IN/OUT enabled, which is the case of svchost.exe or browsers using ports (80, 443, 53, 123 etc). Once enabled, firewall (software) can&#039;t monitor IN/OUT traffic over these processes/ports.And I totally understand that firewall is just a layer, it never will be the whole privacy/security solution.As a layer, firewall always will need other layers (or hardened settings like GPO etc).And I do value firewall (software) layer as a PRIVACY protection (blocking telemetry) and apps/programs SECURITY protection (blocking IN/OUT).But all my questions to you were focused on trying to understand firewall (software) limitations for enabled IN/OUT processes/ports.I know some firewall (software) where svchost.exe can be allowed only for specific processes (Windows Update, NTP, DNS, browsers etc). But what I learnt from different forums (where I asked for help) is that malwares/malicious scripts can use any process/port already enabled in the firewall (software, including third-party firewall software). Even if svchost/browsers have hardened firewall settings... malwares/malicious scripts can find a way to have IN/OUT connection.My intention was to understand if a firewall (software) can monitor/control enabled IN/OUT processes/ports by blocking malware/malicious connections.</blockquote>

[QUOTE="Decopi, post: 985127, member: 67091"] Thanks again [USER=38787]@valvaris[/USER]. Yeap, I know that firewall (software) can be hardened. But the firewall (software) itself can't be hardened when processes are IN/OUT enabled, which is the case of svchost.exe or browsers using ports (80, 443, 53, 123 etc). Once enabled, firewall (software) can't monitor IN/OUT traffic over these processes/ports. And I totally understand that firewall is just a layer, it never will be the whole privacy/security solution. As a layer, firewall always will need other layers (or hardened settings like GPO etc). And I do value firewall (software) layer as a PRIVACY protection (blocking telemetry) and apps/programs SECURITY protection (blocking IN/OUT). But all my questions to you were focused on trying to understand firewall (software) limitations for enabled IN/OUT processes/ports. I know some firewall (software) where svchost.exe can be allowed only for specific processes (Windows Update, NTP, DNS, browsers etc). But what I learnt from different forums (where I asked for help) is that malwares/malicious scripts can use any process/port already enabled in the firewall (software, including third-party firewall software). Even if svchost/browsers have hardened firewall settings... malwares/malicious scripts can find a way to have IN/OUT connection. My intention was to understand if a firewall (software) can monitor/control enabled IN/OUT processes/ports by blocking malware/malicious connections. [/QUOTE]

Verification