Outpost Free v. 6.5

[Manny Carvalho]

1.0 Introduction

Agnitum recently [April, 2009] released a free version of the Outpost firewall intended for personal home use only. It is a functionally equivalent but limited Outpost Pro version that includes a two way firewall with automatic rules creation, host protection, self protection and blocked traffic only shown in the log viewer. Compared to the pro version it does not include spyware protection, attack detection, web advertisement and active content blocking, identity protection, an advanced log viewer, update functionality and no technical support by Agnitum. This forum will, however, respond to questions about this free product. A tabular comparison to Outpost Pro and across the Agnitum product line is available.

The free version supports Windows 2000, XP and Vista and has a 64 bit version available. Agnitum does intend to update bug fixes in the free version as the pro version progresses but since no update functionality is available the free version will require downloading the newest version, reinstalling and possibly reconfiguring the firewall rules anew. The latest version can be obtained through here: http://free.agnitum.com/ Please note that the 64 bit version download is currently a bit hard to see. It's located right underneath the blue botton for the 32 bit version download.

After starting the download you can sign up to be notified of version updates. It is underneath the download dialog and may not be obvious.

Below are screen shots which show the major functional parts of this free product. The product installs in a very similar manner as the pro version by following the instructions. No screen shots are provided for the installation since it's reasonably routine.

This FAQ is intended as a general overview as to the features and limitations in Outpost free and not as a user guide. The built in help file provides fuller details with more documentation available from Agnitum.

Version 6.5.1 is the reference for this FAQ. Future builds may have different features and/or limitations.

2.0 Main Interface Screenshots




Fig 2.1 Main screen depicting overall status.




Fig. 2.2 Firewall Network Activity Screen.




Fig. 2.3 Host Protection Screen.




Fig. 2.4 The Event Viewer.

[Manny Carvalho]

3.0 Settings Screenshot

As opposed to the main interface above that mostly displays data, the Settings panel of the product is where the user configures the firewall.



Fig 3.1 General Settings.




Fig. 3.2 The ImproveNet Panel.




Fig. 3.3 The Rules Panel. The button is green for only allow rules; yellow for both allow and block rules; red for only block rules.




Fig. 3.4 An example of both firewall and anti-leak rules for one application.




Fig. 3.5 The Firewall Section where Policy, ICMP settings, System-wide and Network Rules may be modified.

[Manny Carvalho]

Fig 3.6 Host Protection Panel which includes settings for Anti-Leak Control, Component control and Critical Object Control.


4.0 Making Rules

Making rules in OP free is identical to that in OP Pro and may be done via several routes. Rules can be constructed either manually, using a wizard or automatically. Preset rules are either provided or suggested using Agnitum ImproveNet rules. For each attempted communication the firewall looks through all the rules in a certain well defined sequence until it finds one that matches. It then takes the action defined in that rule and stops looking.

Since the free firewall has event viewer limitations where only blocked items are shown, then a first time user should be a bit more careful in configuring the firewall and making rules. It's possible to make rules for applications and then not realize that traffic is being allowed because it does not show up in the logs within the firewall interface. This might occur if the Auto-learn mode, accessible via the tray icon right click, is used since this mode assumes a clean computer and all traffic is allowed during this period. However, such traffic can be seen while it is occurring by using Network Activity or by using any text viewer to look at the raw logs.

A way to automatically make rules and use the logs is to use the "Automatically create rules for applications signed by Trusted Vendors" which is available in Settings > General > ImproveNet in conjunction with the Block Most policy [see fig. 3.2]. The Block Most policy will block all communications not specifically allowed. With this combination only trusted applications rules will be automatically created and everything else will be blocked which then should show up in the firewall logs. By looking through the logs the user can then decide how to handle blocked applications. This mode of operation will result in very few pop ups and an automatically generated configuration that is safe. Figure 3.2 shows this recommended setup.

More experienced users can use the Wizard Policy mode where all communications result in a dialog allowing for using either the provided preset rules or creating rules manually. Once a user understands how to configure the firewall then they may wish to further tighten their rules by following the Guide to Producing a Secure Configuration for Outpost.

5.0 Version Control

1. Added comments to section 1.0 on 64 bit download location and update notication on 6 Oct 2009.
2. Added link to product line comparison in Introduction on 22 July 2009.
3. This is original issue of the FAQ posted on 2 June 2009.