4.8. Firewall Black/White Lists, etc.

This tool is used to detect suspicious or abnormal activities and warns you of intrusion attempts to your machine. You can access it via the net applet by right clicking on it and choosing Interactive Firewall from the pop-up menu.

Even if your machine is protected by a firewall, intrusion attempts can be made, we recommend that you use this tool to monitor security status and to detect any intrusions.

4.8.1. Enabling and Accessing Interactive Firewall Feature

When you set up your firewall configuration, check the Use Interactive Firewall option to enable this feature. (Refer to Section 8.3, “Securing your Internet Access via DrakFirewall” for more details about firewall settings).

Each time a remote host tries to connect to one of the open ports on your system the tool pops up a message: click on it to view the full log of the connection attempt and to manage these remote hosts by allowing or denying their access.

4.8.2. Monitoring and Managing Intrusions

Figure 4.15. Interactive Firewall Window

Interactive Firewall Window


The Log tab shows connection attempt details: the date and time, the IP address of the machine trying to connect to yours, the service or port and protocol, and the network interface on which the connection attempt was made.

You can the manage the remote hosts access with the following buttons:

Blacklist

Forbid connections to addresses selected.

Whitelist

Allow access to addresses selected.

Open the Blacklist tab to view all the forbdden remote hosts. You can then:

Remove from blacklist

Remove a remote host from the black list.

Move to whitelist

Allow a remote host by adding them to the whitelist.

Open the Whitelist tab to view all the allowed addresses. You can then:

Remove from whitelist

Remove addresses from this list.