Outpost Firewall rules

Системные правила:

До правил для приложений
-------------------------

Block RPC (TCP)
Where the Protocol is TCP
	and Local Port is DCOM, NBT_SS, MS_DS
	and Direction is Inbound
 Block It

Block RPC (UDP)
Where the Protocol is UDP
	and Local Port is DCOM, NBT_NS, NBT_DGM
 Block It

Block Incoming UPnP
Where the Protocol is TCP
	and Local Port is 2869, 5000, 5554, 9996
	and Direction is Inbound
 Block It

Block Outgoing UPnP
Where the Protocol is TCP
	and Remote Port is 2869, 5000, 5554, 9996
	and Direction is Outbound
 Block It

Block Incoming SSDP
Where the Protocol is UDP
	and Local Port is 1900
 Block It

Block Outgoing SSDP
Where the Protocol is UDP
	and Remote Port is 1900
 Block It

Block Incoming TCP
Where the Protocol is TCP
	and Local Port is 1025-1045
	and Direction is Inbound
 Block It


После правил для приложений
---------------------------

Block incoming RPC (UDP)
Where the Protocol is UDP
	and Local Port is DCOM
 Block It

Block incoming RPC (TCP)
Where the Protocol is TCP
	and Local Port is DCOM
	and Direction is Inbound
 Block It

Allow local TCP connection
Where the Protocol is TCP
	and Remote Address is Any Local Address
 Allow It

Allow local UDP connection
Where the Protocol is UDP
	and Remote Address is Any Local Address
 Allow It
	and Local port is equal to remote port

Block Outgoing FTP
Where the Protocol is TCP
	and Remote Port is FTP
	and Direction is Outbound
 Block It

Block Incoming FTP
Where the Protocol is TCP
	and Local Port is FTP
	and Direction is Inbound
 Block It

Block Incoming TCP 0-3000
Where the Protocol is TCP
	and Local Port is 0-Finger, 84, 86, 87, 89, 91-442, 444-3000
	and Direction is Inbound
 Block It

Block Other Outgoing TCP Traffic
Where the Protocol is TCP
	and Direction is Outbound
 Block It

Block Other Incoming TCP Traffic
Where the Protocol is TCP
	and Direction is Inbound
 Block It

Block Other UDP Traffic
Where the Protocol is UDP
 Block It


Низкоуровневые правила
-----------------------

Block IGMP
Where the Protocol is IP
	and protocol type is IGMP
 Block It

Block HIP protocol
Where the Protocol is IP
	and protocol type is HIP
 Block It
	and Disable logging

Allow PXP protocol
Where the Protocol is IP
	and protocol type is PXP
 Allow It

Block Incoming IP for UDP
Where the Protocol is IP
	and protocol type is UDP
	and Local Address is <HOST_MACRO_BROADCAST_ADDRESSES>, 169.254.255.255, 169.254.0.0 (255.255.0.0)
	and Direction is Inbound
 Block It
	and High Priority
	and Disable logging

Block IP for IPv6
Where the Protocol is IP
	and protocol type is IPv6
 Block It
	and High Priority
	and Disable logging

Block IP for ICMPv6
Where the Protocol is IP
	and protocol type is ICMPv6
 Block It
	and High Priority
	and Disable logging

Block IPv6 Hop-by-Hop Option
Where the Protocol is IP
	and protocol type is HOPOPT
 Block It
	and High Priority
	and Disable logging

Block Unused Protocols
Where the Protocol is IP
	and protocol type is GGP, IPIIP, ST, CBT, EGP, IGP, BBN-RCC-MON, NVP, PUP, ARGUS, EMCON, XNET, CHAOS, TMux, DCN-MEAS, HMP, PRM, XNS-IDP, TRUNK-1, TRUNK-2, LEAF-1, LEAF-2, RDP, IRTP, ISO-TP4, NETBLT, MFE-NSP, MERIT-INP, DCCP, 3PC, IDPR, XTP, DDP, IDPR-CMTP, TP++, IL, SDRP, IPv6-Route, IPv6-Frag, SDRP, RSVP, GRE, MHRP, BNA, ESP, AH, I-NLSP, SWIPE, NARP, MEP, TLSP, SKIP, IPv6-NoNxt, IPv6-Opts, CFTP, SAT-EXPAK, KRYPTOLAN, RVD, IPPC, SAT-MON, VISA, IPCV, CPNX, CPHB, WSN, PVP, BR-SAT-MON, SUN-ND, WB-MON, WB-EXPAK, ISO-IP, VMTP, SECURE-VMTP, VINES, TTP, NSFNET-IGP, DGP, TCF, EIGRP, OSPF, Sprite-RPC, LARP, MTP, AX.25, IPIP, MICP, SCC-SP, ETHERIP, ENCAP, GMTP, IFMP, PNNI, PIM, ARIS, SCPS, QNX, A/N, IPPCP, SNP, Compaq-Peer, IPX-in-IP, VRRP, PGM, L2TP, DDX, IATP, STP, SRP, UTI, SMP, SM, PTP, FIRE, CRTP, CRUDP, SSCOPMCE, IPLT, SPS, PIPE, SCTP, FC, RSVP, manet, Shim6
 Block It
	and High Priority

Block Unknown Protocols
Where the Protocol is IP
	and protocol type is RAWSOCKET
 Block It
	and Report It
	and High Priority

Allow Trusted ICMP
Where the Protocol is IP
	and protocol type is ICMP
	and Remote Address is 127.0.0.1, 10.6.11.1, 10.6.1.1, 0.0.0.0, 10.6.249.246, 10.6.249.1, 80.232.230.242, 8.8.8.8
	and Direction is Outbound
 Allow It

Allow Remote IP for ICMP, TCP, UDP
Where the Protocol is IP
	and protocol type is ICMP, TCP, UDP
	and Remote Address is 8.8.8.8
 Allow It

Allow Local IP for ICMP, TCP, UDP
Where the Protocol is IP
	and protocol type is ICMP, TCP, UDP
	and Local Address is 10.6.249.246
 Allow It

Allow IP for LOCAL NETWORK
Where the Protocol is IP
	and protocol type is ICMP, TCP, UDP
	and Local Address is <HOST_MACRO_LOCAL_NETWORKS>
	and Remote Address is <HOST_MACRO_LOCAL_NETWORKS>
 Allow It

Block DNS (TCP)
Where the Protocol is TCP
	and Remote Address is <HOST_MACRO_DNS_SERVERS>
 Block It
	and Report It
	and High Priority


Настройки ICMP
--------------

ICMPv4
Эхо-ответ                             + -
Получаталь недоступен        + +
Эхо-запрос                           - +
Для дг. превышено вр. ож.  + -

ICMPv6
Для дг. превышено вр. ож.  + -
Эхо-запрос                          - +
Эхо-ответ                            + -


Правила для приложений
-----------------------


acs.exe
-------

Agnitum Outpost Service outbound through AVP/KIS
Where the Protocol is TCP
	and Remote Address is 0.0.0.0, 127.0.0.1, <HOST_MACRO_MY_COMPUTER>
	and Remote Port is 1110-2110
	and Direction is Outbound
 Allow It

Agnitum Outpost Service connection
Where the Protocol is TCP
	and Local Port is 1024-65535
	and Remote Port is HTTP-83
	and Direction is Outbound
 Allow It

Agnitum Outpost Service DNS UDP connection
Where the Protocol is UDP
	and Remote Address is 80.232.230.242, 8.8.8.8
	and Remote Port is DOMAIN
 Allow It


chrome.exe
----------

360Chrome outbound through AVP/KIS
Where the Protocol is TCP
	and Remote Address is 0.0.0.0, 127.0.0.1, <HOST_MACRO_MY_COMPUTER>
	and Remote Port is 1110
	and Direction is Outbound
 Allow It

360Chrome DNS UDP connection
Where the Protocol is UDP
	and Remote Address is 80.232.230.242, 8.8.8.8
	and Remote Port is DOMAIN
 Allow It

360Chrome Streaming Media connection
Where the Protocol is TCP
	and Remote Port is 8000, 8001
	and Direction is Outbound
 Allow It

360Chrome PROXY connection
Where the Protocol is TCP
	and Remote Port is PROXY:3128, PROXY:8080, 8081, PROXY:8088, PROXY:8008, 8888
	and Direction is Outbound
 Allow It

360Chrome HTTPS connection
Where the Protocol is TCP
	and Remote Port is HTTPS
	and Direction is Outbound
 Allow It

360Chrome HTTP connection
Where the Protocol is TCP
	and Remote Port is HTTP-83
	and Direction is Outbound
 Allow It

360Chrome HTTP connection
Where the Protocol is TCP
	and Remote Port is 85, 88, 90
	and Direction is Outbound
 Allow It


AIMP.EXE
--------

AIMP Local TCP connection
Where the Protocol is TCP
	and Remote Address is 0.0.0.0, 127.0.0.1, 10.6.249.246, <HOST_MACRO_MY_COMPUTER>
	and Direction is Outbound
 Allow It

AIMP HTTP connection
Where the Protocol is TCP
	and Remote Port is HTTP-83
	and Direction is Outbound
 Allow It

AIMP HTTPS connection
Where the Protocol is TCP
	and Remote Port is HTTPS
	and Direction is Outbound
 Allow It

AIMP Media Streaming connection
Where the Protocol is TCP
	and Remote Port is 8000, 8001
	and Direction is Outbound
 Allow It

AIMP TCP connection
Where the Protocol is TCP
	and Remote Port is 1755
	and Direction is Outbound
 Allow It

AIMP UDP connection
Where the Protocol is UDP
	and Remote Port is 1755
	and Direction is Outbound
 Allow It

AIMP Proxy connection
Where the Protocol is TCP
	and Remote Port is PROXY:3128, PROXY:8080, 8081, PROXY:8008, PROXY:8088, 8888
	and Direction is Outbound
 Allow It

AIMP RTSP connection
Where the Protocol is TCP
	and Remote Port is 554
	and Direction is Outbound
 Allow It

AIMP RTSPU connection
Where the Protocol is UDP
	and Remote Port is 5005
	and Direction is Outbound
 Allow It

AIMP DNS UDP connection
Where the Protocol is UDP
	and Remote Address is 80.232.230.242, 8.8.8.8
	and Remote Port is DOMAIN
 Allow It


ping.exe
--------

ICMP connections
Where the Protocol is ICMP
	and Remote Address is 0.0.0.0, 127.0.0.1, 10.6.11.1, 10.6.1.1, 10.6.249.246, 10.6.249.1, 80.232.230.242, 8.8.8.8, <HOST_MACRO_DNS_SERVERS>, <HOST_MACRO_GATEWAYS>, <HOST_MACRO_MY_COMPUTER>
 Allow It
	and Report It