McAfee Question on Firewall Networks

[Gatorbait]

I have McAfee and on the Firewall it gives you options on the level of trust you assign to a network (using its IP address):

They give you three options:

Trusted (described as: Firewall allows traffic from an IP to reach your computer through any port. Activity between the computer associated with a Trusted IP address and your computer is not filtered or analyzed by Firewall. By default, the first private network that Firewall finds is listed as Trusted in the Networks list. An example of a Trusted network is a computer or computers in your local or home network.)

Standard (described as: Firewall controls traffic from an IP (but not from any other computer in that network) when it connects to your computer, and allows or blocks it according to the rules in the System Services list. Firewall logs traffic and generates event alerts from Standard IP addresses. An example of a Standard network is a computer or computers in a corporate network.)

and Public (described as: Firewall controls traffic from a public network according to the rules in the System Services list. An example of Public is an Internet network in a cafe, hotel, or airport.)

McAfee also says that when allowing a connection, make sure that the computer that you trust is safe. If a trusted computer is infected with a worm or other mechanism, your computer can be vulnerable to infection. Also, McAfee recommends that the computer you trust is protected by a firewall and an up-to-date antivirus program.

So, what level should I be using? Using their verbage, you would think Trusted, but when you read the definitions, it seems you would have better protection with Public. Does anyone know what is the best solution to keep me protected as best I can with McAfee's firewall regarding the network?

Thanks

[noknojon]

Hi Gatorbait -

This Section <<- of the FAQ gives you the information on McAfee A/Virus -

I hope this helps - Please post back if you have further questions -

Thank You -

[Gatorbait]

Hi Gatorbait -

This Section <<- of the FAQ gives you the information on McAfee A/Virus -

I hope this helps - Please post back if you have further questions -

Thank You -

Sorry, I'm just asking about what setting I should have my McAfee SecurityCenter at for networks that would best protect me. I think that thread is dealing with a different topic altogether.

[PedroHin]

You will always have better protection with 'public', but for a standard home network that is behind a router, 'standard' is fine

Go with 'trusted' if any of the following are true:

1) you need to share files with another PC on the network

2) You need to print to a network-attached printer

3) you have more advanced home network needs such as media sharing between Cable TV tuners and a multimedia PC

Also, if you have no router, absolutely pick 'public' (IE: the PC is directly connected to a DSL modem or Cable modem with only one ethernet jack).

I hope this clarifies things

[Gatorbait]

You will always have better protection with 'public', but for a standard home network that is behind a router, 'standard' is fine

Go with 'trusted' if any of the following are true:

1) you need to share files with another PC on the network

2) You need to print to a network-attached printer

3) you have more advanced home network needs such as media sharing between Cable TV tuners and a multimedia PC

Also, if you have no router, absolutely pick 'public' (IE: the PC is directly connected to a DSL modem or Cable modem with only one ethernet jack).

I hope this clarifies things

Thanks so much for the clarification, that really helps. I guess the only other questions is that with "public" I get a lot of requests for registry changes on System Guard. Should I just be accepting these carte blanc?

Thanks again

[inzanity]

Hi,

No, as you might inadvertently give permission to an infection. This is where research on your part is crucial.

[PedroHin]

Thanks so much for the clarification, that really helps. I guess the only other questions is that with "public" I get a lot of requests for registry changes on System Guard. Should I just be accepting these carte blanc?

Thanks again

For the most part, yeah; you'll be running into a lot of 'accept changes' 'allow program' type questions for the next couple of days.

If you're uncertain about a process name, or if one comes up out of the blue an hour after the computer starts and no programs have just been launched, then you might want to do a little bit of quick research.

Most of the times a legitimate event will be obvious. If you launch a program that you haven't launched since the installation of the firewall, you'll get questions if the program uses the internet or if it automatically checks for updates upon program startup. Also, after installing or updating a program you'll be asked about changes. Things like HP print drivers, Adobe updates etc...

If you are just browsing the web, and are asked about a change out of the blue (except for maybe media plugins QT, Adobe, Macromedia) then a quick search on the process name would be prudent.

I wish there was an easier way. I deal with many different software firewalls day-to-day, and they can get annoying when you're in a hurry to get something done/installed then you're hit with questions.

If you're behind a router, then I would go for the standard firewall if the 'public' setting is too much in your face.

[Gatorbait]

For the most part, yeah; you'll be running into a lot of 'accept changes' 'allow program' type questions for the next couple of days.

If you're uncertain about a process name, or if one comes up out of the blue an hour after the computer starts and no programs have just been launched, then you might want to do a little bit of quick research.

Most of the times a legitimate event will be obvious. If you launch a program that you haven't launched since the installation of the firewall, you'll get questions if the program uses the internet or if it automatically checks for updates upon program startup. Also, after installing or updating a program you'll be asked about changes. Things like HP print drivers, Adobe updates etc...

If you are just browsing the web, and are asked about a change out of the blue (except for maybe media plugins QT, Adobe, Macromedia) then a quick search on the process name would be prudent.

I wish there was an easier way. I deal with many different software firewalls day-to-day, and they can get annoying when you're in a hurry to get something done/installed then you're hit with questions.

If you're behind a router, then I would go for the standard firewall if the 'public' setting is too much in your face.

Thanks for your help on these questions. I guess one last question on this thread, where would you point to do "research" on a reigistry change request?

Thanks again!