Outpost Firewall Presets: Idea and Format

[Mikhail]

Outpost Firewall includes presets for popular applications such as ICQ, Internet Explorer, Outlook Express and many others. When an application tries to connect to the Internet for the first time, Outpost searches its application database and suggests a set of rules worked out by our engineers that are optimum for this application. Even advanced users are recommended to use these presets and then tweak their settings as needed. This very powerful technique lets you create rules with one click and without any special knowledge of ports and protocols.

The presets are stored in the preset.lst file. There are two kinds of presets:[list=1][*]Application Specific Presets—for particular applications such as Internet Explorer, Microsoft Telnet or Outlook Express.[*]Common Activity Preset—for common activities such as browsing the Web, connecting via the Telnet protocol or receiving and sending e-mail.[/list=1]

Any line that starts with “;” is a comment and not processed by Outpost Firewall. The format of the preset.lst file is described below:

;Preset header
[XXX]
Name of the preset, such as [Web Browser]. Each preset can include a single firewall rule or a set of different rules. For example, “Allow to receive e-mail”, “Allow to send e-mail” and “Allow to browse newsgroups” for your favorite e-mail client.

VisibleState: X
Can be 1 or 0. 1 means that this preset will be visible in the “Create Rules for Application” dialog and 0 means that it will be hidden. If not specified, it defaults to 1. It is recommended to set Visible to “0” for all Application Specific Presets.

Exe:
XApplication, xname.exe

This field makes Application Specific Presets different from Common Activity Presets. In Application Specific Presets, one MUST include it, but Common Activity Presets must not.

Note that you should insert a line break after Exe: because you can list only one application at a time. The application description and its executable name are separated by a comma.

If the application foo.exe tries to connection to the Internet, Outpost will:[list=1][*]Search the preset file trying to find the appropriate Application Specific Preset (looking for foo.exe in the Exe: section of each item). If it finds a match, Outpost Firewall displays the Rules Wizard dialog that recommends creating a rule based on the preset found.[*]If it does not find an appropriate Application Specific Preset, it will search the Common Activity Presets that describes similar network activities. If it finds one, Outpost Firewall displays the Rules Wizard dialog that suggest creating a rule based on the preset found.[*]If it does not find an appropriate Common Activity Preset, it displays the Rules Wizard dialog that suggests creating a rule yourself.[/list=1]

Example: Let’s assume that you have two browsers, Internet Explorer (ie.exe) and SomeBrowser (sb.exe) with the following preset.lst file:


[Common Browser]
DefaultState: 1
RuleName: Browser HTTP rule
Protocol: TCP
RemotePort: 80
Direction: Outbound
AllowIt

[Internet Explorer]
Exe:
Internet Explorer, ie.exe
DefaultState: 1
RuleName: Browser HTTP rule
Protocol: TCP
RemotePort: 80
Direction: Outbound
AllowIt


If you launch ie.exe then Outpost will search the Application Specific Presets in preset.lst for ie.exe in the Exe: section. When it finds it, Outpost Firewall suggests creating a rule using the [Internet Explorer] preset.

Next, you launch “SomeBrowser” and it tries to make an outbound connection using the TCP protocol to port 80. Outpost Firewall does not find an Application Specific Preset for sb.exe because there is no such preset having sb.exe in the Exe: section. Outpost then searches for a Common Activity Preset that has the following properties:

Protocol: TCP
RemotePort: 80
Direction: Outbound

Outpost finds the [Browser] preset that describes absolutely the same activity and suggests that you apply it to “SomeBrowser”.

;End of Preset header

After the end of preset header, you can create as many rules as you wish. For [Internet Explorer] for example we created a set of seven rules—Allow HTTP, HTTPS, SOCKS, Proxy, Gopher, Web Folder and FTP. Each rule has the following properties:

DefaultState: X.
Can be 1 or 0. The value 1 means that this rule is turned ON and 0 that it is turned OFF (checked in the “List of Application Rules” dialog).

RuleName: XXXXX
Name of the rule that will be displayed in the “List of Application Rules” dialog.

Protocol:
TCP or UDP.

RemotePort: X, Y, Z, A-C
Self-explanatory. Multiple entities should be separated by commas. Port ranges are also supported.

Direction: X
Outbound or Inbound.

Action: X
AllowIt or BlockIt.

IMPORTANT: For your changes in preset.lst to take effect, you need to restart Outpost.