Firewall Settings fr AVG 7.5 Dcument revisin 75.2 (8.2.2007) Cpyright GRISOFT, s.r.. All rights reserved. This prduct uses RSA Data Security, Inc. MD5 Message-Digest Algrithm, Cpyright (C) 1991-2, RSA Data Security, Inc. Created 1991. This prduct uses cde frm C-SaCzech library, Cpyright (c) 1996-2001 Jarmir Dlecek <dlecek@ics.muni.cz> This prduct uses cmpressin library zlib, Cpyright (C) 1995-2002 Jean-lup Gailly and Mark Adler All ther trademarks are the prperty f their respective wners.
Cntents 1. Intrductin... 3 2. Windws XP built-in firewall (Security Center)... 4 3. Keri Persnal Firewall... 8 3.1. Run Keri Persnal Firewall... 8 3.2. Netwrk Security... 8 3.3. System Security...10 4. Zne Alarm Pr... 13 5. Micrsft ISA Server... 16 6. Agnitum Outpst Firewall... 23 6.1. Allwing Activities fr an Applicatin...23 6.2. Cnfiguring the Firewall at Once...23 7. Sygate Persnal Firewall... 26 7.1. Allwing Activities fr an Applicatin...26 7.2. Cnfiguring the Firewall at Once...26 8. Keri Winrute Firewall... 30 9. Technical Supprt... 31
3 1. Intrductin In case yu have installed AVG n yur cmputer, and yu are running a firewall at the same time, yu might be experiencing prblems while sending/receiving email messages and/r dwnlading AVG updates. This dcumentatin refers t the firewall settings required fr prper AVG functinality and it cvers the settings instructins and recmmendatins fr the fllwing firewalls: Windws XP built-in firewall (Security Center) Keri Persnal Firewall Zne Alarm Pr firewall Micrsft ISA Server Agnitum Outpst Firewall Sygate Persnal Firewall Keri Winrute Firewall
4 2. Windws XP built-in firewall (Security Center) Typically, the Windws XP built-in firewall default settings crrespnd very well t AVG cnfiguratin. Mst prbably, n prblems will ccur at all. Hwever, shuld yu run up against prblems, please fllw these steps: Windws XP Firewall Settings Open the Windws Firewall settings dialg windw: Start / Settings / Cntrl Panels / Windws Firewall. On the General tab make sure the D nt allw exceptins ptin is nt selected. Define Exceptins Switch t the Exceptins tab with the list f applicatins that are blcked t access t the internet. Yu need t allw access t internet fr all AVG applicatins. T d s, mark each check bx related t an AVG applicatin in the list f prgrams and services (see the fllwing screensht).
5 The AVG applicatins t be selected frm the list and marked as allwed are as fllws: AVG fr Windws AVG Cntrl Center avgemc.exe (nly when the AVG EMS applicatin is installed) avginet.exe If these applicatins are nt listed in the list f exceptins, yu need t add them manually. This can be dne using the Add Prgram buttn (see the abve screensht). Add a New Prgram A new dialg windw pens prviding a list f prgrams that can be added t the previusly seen Windws Firewall list f exceptins. Select the AVG applicatins frm the list, and cnfirm adding them t the Windws Firewall list f exceptins by pressing the OK buttn (see the fllwing screensht).
6 In case yu are nt able t see any AVG applicatin in the prgram list, yu have t add them manually. Click the Brwse buttn, and find the abve listed files (avgw.exe, avgcc.exe, avginet.exe and avgemc.exe) in the AVG7 prgram flder (by default C:\Prgram Files\Grisft\AVG7): Cnfirm adding the selected files by pressing the OK buttn in the Add a Prgram dialg windw. AVG Remte Administratin In case the statin yu are wrking with is a part f the AVG Remte Administratin, and it is: running as an AVG client cnnected t the AVG DataCenter; running AVGADMIN and AVG TCP Server at the same time; running AVGADMIN;
7 it is necessary t specify prts t be pened thrugh the Windws XP builtin firewall. T specify the prts numbers use the Add a prt dialg that can be pened via the Add a prt buttn in the Exceptins tab: Yu need t add ne by ne the fllwing prts: 4156 6051 6052 6053 6150
8 3. Keri Persnal Firewall With the Keri Persnal Firewall yu will prbably need t cnfigure the settings t allw AVG (and its applicatins) t cnnect t the internet (send/receive data), and t launch ther applicatins (t update). T cnfigure the Keri Persnal Firewall settings, fllw these steps: 3.1. Run Keri Persnal Firewall Yu shuld see the Keri Persnal Firewall shield icn in yur system tray duble-click n it t pen the Keri Persnal Firewall cnfiguratin windw. If yu cannt see such an icn, yu have t launch the Firewall Engine frm the All Prgrams / Keri / Persnal Firewall X flder f the Windws Start menu. The X stands fr the versin f yur prduct (fr example 4). The Keri Persnal Firewall icn in the system tray will be present then. 3.2. Netwrk Security In the Netwrk Security item (left menu), Applicatins tab (tp menu) yu are able t verview a list f prgrams with the infrmatin n whether these are allwed t cnnect t the internet. In the list, verify that all AVG applicatins are labeled as permit in all fields present (Trusted In/Out and internet In/Out). Here is the list f all AVG applicatins that must always be allwed t cnnect t the internet: avginet.exe applicatin fr perfrming AVG nline updates (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgemc.exe AVG E-mail Scanner fr anti-virus scanning f e-mail (lcated in the Prgram Files/Grisft/Avg7 directry by default) Fllwing tw applicatins must be allwed t access the netwrk when the wrkstatin is a part f AVG Remte Administratin: avgmsvr.exe AVG Alert Manager cmpnent (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgcc.exe AVG Cntrl Center (lcated in the Prgram Files/Grisft/Avg7 directry by default) And finally, when there are installed the cntrl cmpnents f AVG Remte Administratin n the wrkstatin, the fllwing applicatins must be als allwed t cmmunicate ver the netwrk: avgadmin.exe the main cntrl applicatin f AVG Remte Administratin, AVGADMIN (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/AvgAdmin7 by default) avgtcpsv.exe AVG TCP Server applicatin fr AVG Remte Administratin (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/AVG TCP Server by default) avginetl.exe AVG InetLite applicatin (if installed, it is lcated in the Prgram Files/Grisft/Avg TCP Server by default)
9 If any AVG applicatin yu need t be allwed t access the netwrk is nt permitted, yu have t change its status. T d s, right click n every item and select the Permit ptin frm the cntext menu: Press the Apply buttn in the Keri Persnal Firewall / Netwrk Security windw after finishing the netwrk security cnfiguratin t cnfirm the changes perfrmed (yu will be asked fr it therwise). If sme applicatin is missing n the list, it will be added when yu attempt t launch it and/r when the applicatin will try t cnnect t the netwrk. Keri Persnal Firewall warning related t the particular AVG applicatin will be displayed then:
10 Press the Permit buttn there and refresh the list in the Keri Persnal Firewall / Netwrk Security cnfiguratin windw then (by pressing the Refresh buttn in the right-dwn crner). After ding this, yu can label the applicatin as permitted in all fields present as described in the beginning f this sectin. 3.3. System Security In the System Security item (left menu), Applicatins tab (tp menu) yu are able t verview a list f prgrams with the infrmatin n whether these are allwed t launch ther applicatin. Again, yu need t make sure all AVG applicatins listed are labeled as permit t launch ther applicatins (e.g. updates). If nt, yu need t change the AVG applicatins status. T d s, right click n every field present (Starting, Mdifying and Launching thers) and select the Permit ptin frm the cntext menu.
11 Press the Apply buttn in the Keri Persnal Firewall / System Security windw after finishing the netwrk security cnfiguratin t cnfirm the changes perfrmed (yu will be asked fr it therwise). If sme applicatin is missing n the list, it will be added fr example when it attempts t launch anther applicatin. Keri Persnal Firewall warning related t the particular AVG applicatin will be displayed then:
Press the Permit buttn there and refresh the list in the Keri Persnal Firewall / System Security cnfiguratin windw then (by pressing the Refresh buttn in the right-dwn crner). Then yu can label the applicatin as permitted in all fields present as described in the beginning f this sectin. 12
13 4. Zne Alarm Pr With the Zne Alarm Pr yu will prbably need t cnfigure the settings s that it is allwed fr the AVG (and its applicatins) t cnnect t the internet (send/receive data), and t launch ther applicatins (t update). T cnfigure the Zne Alarm Pr settings, fllw these steps: Run Zne Alarm Pr Yu shuld see the ZneAlarm Pr icn in yur system tray duble-click n it t pen the ZneAlarm Pr cnfiguratin windw. If yu cannt see such an icn, yu have t launch the Zne Labs Security applicatin frm the All Prgrams / Zne Labs flder f the Windws Start menu. The ZneAlarm Pr icn in the system tray will be present then. Prgram Cntrl In the Prgram Cntrl sectin (left menu), Prgrams tab (tp menu) yu are able t verview a list f prgrams with the infrmatin n whether these are allwed t cnnect t the internet. In the list, verify that all AVG applicatins are labeled as allwed (green cnfirmatin mark). If nt, yu have t change the AVG applicatins status. T d s, right click n every item and select the cnfirmatin mark frm the cntext menu. Here is the list f all AVG applicatins that must always be allwed t cnnect t the internet: avginet.exe applicatin fr perfrming AVG nline updates (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgemc.exe AVG E-mail Scanner fr anti-virus scanning f e-mail (lcated in the Prgram Files/Grisft/Avg7 directry by default)
14 Fllwing tw applicatins must be allwed t access the netwrk when the wrkstatin is a part f AVG Remte Administratin: avgmsvr.exe AVG Alert Manager cmpnent (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgcc.exe AVG Cntrl Center (lcated in the Prgram Files/Grisft/Avg7 directry by default) And finally, when there are installed the cntrl cmpnents f AVG Remte Administratin n the wrkstatin, the fllwing applicatins must be als allwed t cmmunicate ver the netwrk: avgadmin.exe the main cntrl applicatin f AVG Remte Administratin, AVGADMIN (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/AvgAdmin7 by default) avgtcpsv.exe AVG TCP Server applicatin fr AVG Remte Administratin (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/Avg TCP Server by default) avginetl.exe AVG InetLite applicatin (if installed, it is lcated in the Prgram Files/Grisft/Avg TCP Server by default) Add a Prgram If any f the needed applicatins described in the list abve is missing in the Prgrams tab f the ZneAlarm Pr / Prgram Cntrl windw, yu have t add it manually. Press the Add buttn in the right-dwn crner f the windw:
15 Chse the desired applicatin in the fllwing dialg: By default, the files are lcated in the Grisft prgram flder (Prgram Files/Grisft/AVG7, Prgram Files/Grisft/AvgAdmin7 r Prgram Files/Grisft/Avg TCP Server), as described in the list in previus sectin. E-mail Prtectin In the E-mail Prtectin item (left menu), Main tab (tp menu) yu need t disable the built-in inbund/utbund email prtectin prvided by the Zne Alarm Pr. By switching the Zne Alarm Pr implemented email verificatin ff yu will enable the mre cmprehensive AVG email cntrl.
16 5. Micrsft ISA Server Any netwrk traffic is blcked by default after installatin f ISA Server. If yu want t allw AVG applicatins t cnnect t the netwrk, yu must create at least ne rule in the ISA Server envirnment. T create a rule, fllw the steps belw: Open the Micrsft ISA Server Main Cnfiguratin Windw Launch the New Access Rule Wizard Chse the Micrsft Internet Security and Acceleratin Server 2004 item in the main navigatin tree lcated in the left side f the windw. The name f yur cmputer shuld be displayed here. Unpack it (fr example by duble-clicking n the cmputer s icn in the navigatin tree) and chse the Firewall Plicy item: G t the Tasks tab in the right side f the windw then and chse the Create New Access Rule actin. The wizard s windw displays then. Prceed with the New Access Rule Wizard Fill in the name f the new rule (e. g. AVG):
17 Chse the Allw ptin in the next windw (the rule s purpse is t allw the AVG applicatins t cmmunicate ver the netwrk): In the fllwing Prtcls windw chse the Selected prtcls ptin in the This rule applies t field:
18 Use the Add buttn t pen the tree menu with prtcls available t add: Chse the HTTP and HTTPS prtcls in the Add Prtcls windw using the Add buttn.
19 When the statin is a part f AVG Remte Administratin, r when there are the AVGADMIN and/r the AVG TCP Server applicatins running n the statin, yu have t add als the TCP prtcl as well. Hwever, any statin may be in need f use f the TCP prtcl under sme circumstances (fr example when perfrming an update frm a lcal web server), s it is always recmmended t add the TCP prtcl cnnectin! The prtcl is nt in the list, s yu must create a new prtcl cnnectin using the New buttn in the upper area f the Add Prtcls windw. A New Prtcl Definitin Wizard launches then. Chse a name fr the new prtcl cnnectin (e.g. AVGADMIN). Press the New buttn then. A New/Edit Prtcl Cnnectin windw appears: Chse the fllwing values fr the fields present: TCP Prtcl type Outbund Directin Prt Range frm 4156 t 4156 Press the OK buttn t cnfirm the changes. D the same prcedure f creating a new prtcl cnnectin nce mre then. All values remain the same except fr the Prt Range, which will be frm 6051 t 6053 nw. The New Prtcl Definitin Wizard windw with the prtcl listing will nw lk like this:
20 Press the Next buttn t cntinue. In the next windw with secndary cnnectins prmpt chse N and cntinue pressing the Next buttn. Cmplete the New Prtcl Definitin Wizard by clicking n the Finish buttn. Nw yu can add the newly created prtcl cnnectin in the Add Prtcls windw:
21 Yur prtcl is in the User-Defined flder f the tree menu here. Use the Add buttn t add it. The Prtcls windw f the New Access Rule Wizard shuld lk like this nw:
22 Press the Next buttn t cntinue. Chse the surces and destinatins f data n selected prts in the next tw windws. Use the Add buttn and select the External, Lcalhst and Internal (in case yur ISA Server acts as gate fr internet cnnectin f ther cmputers in yur netwrk) in the tree menu again. Bth f the surces and destinatins windws shuld lk like this then: Press the Next buttn t cntinue and cmplete the wizard by clicking n the Finish buttn. Save the changes in the Firewall plicy by clicking n the Apply buttn that is lcated abve the rule list. Micrsft ISA Server shuld be cnfigured prperly in rder t allw all AVG applicatins t cmmunicate ver the netwrk nw.
23 6. Agnitum Outpst Firewall Yu may be asked t allw netwrk cnnectin fr sme applicatins during their start up after installatin f the prduct. This is related t AVG prducts as well. Yu can set up the firewall s that it will permanently allw netwrk cmmunicatin fr all AVG applicatins. Ding this yu will definitely nt decrease the level f prtectin f yur system. On the cntrary, AVG will be enabled t fully emply all f its functins then, bringing the reliability f yur anti-virus prtectin t maximum. 6.1. Allwing Activities fr an Applicatin The firewall will react whenever an unknwn applicatin is trying t make a netwrk cnnectin. This hlds even fr AVG applicatins befre setting them up manually. The fllwing windw is displayed (fr AVG Cntrl Center in this example): Chse the Allw all activities fr this applicatin ptin and press the OK buttn. Perfrm the same actin whenever a similar AVG related windw appears. 6.2. Cnfiguring the Firewall at Once Hwever, yu shuld allw the AVG applicatins t access the netwrk even befre they try t pen a cnnectin. If yu want t allw the netwrk cmmunicatin fr AVG applicatins (recmmended!) at nce, pen the Agnitum Outpst Firewall main windw:
24 Add the allwed applicatins by right-clicking n the Plugins item in the main navigatin tree. Chse the Optins menu item then. A new windw will pen then. G t the Applicatins tab in the windw: Add all AVG applicatins currently installed n yur cmputer using the Add buttn. Here is the list f all AVG applicatins that must always be allwed t cnnect t the internet:
25 avginet.exe applicatin fr perfrming AVG nline updates (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgemc.exe E-mail Scanner fr anti-virus scanning f e-mail (lcated in the Prgram Files/Grisft/Avg7 directry by default) Fllwing tw applicatins must be allwed t access the netwrk when the wrkstatin is a part f AVG Remte Administratin: avgmsvr.exe AVG Alert Manager cmpnent (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgcc.exe AVG Cntrl Center (lcated in the Prgram Files/Grisft/Avg7 directry by default) And finally, when there are installed the cntrl cmpnents f AVG Remte Administratin n the wrkstatin, the fllwing applicatins must be als allwed t cmmunicate ver the netwrk: avgadmin.exe the main cntrl applicatin f AVG Remte Administratin, AVGADMIN (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/AvgAdmin7 by default) avgtcpsv.exe AVG TCP Server applicatin fr AVG Remte Administratin (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/Avg TCP Server by default) avginetl.exe AVG InetLite applicatin (if installed, it is lcated in the Prgram Files/Grisft/Avg TCP Server by default) Cmmit yur selectin by pressing the OK buttn. All AVG applicatins requiring the netwrk cmmunicatin shuld be fully peratinal then.
26 7. Sygate Persnal Firewall Yu may be asked t allw netwrk cnnectin fr sme applicatins during their start up als after installatin f the Sygate Persnal Firewall prduct. This is related t AVG prducts as well. Yu can set up the firewall s that it will permanently allw netwrk cmmunicatin fr all AVG applicatins. Ding this yu will definitely nt decrease the level f prtectin f yur system. On the cntrary, AVG will be enabled t fully emply all f its functins then. 7.1. Allwing Activities fr an Applicatin The firewall will react whenever an unknwn applicatin is trying t make a netwrk cnnectin. This hlds even fr AVG applicatins. The fllwing windw is displayed (fr AVG Cntrl Center in this example): Check the Remember my answer field and press the Yes buttn. Repeat the actin fr any AVG applicatin that tries t cnnect the netwrk. 7.2. Cnfiguring the Firewall at Once If yu want t allw the netwrk cmmunicatin fr AVG applicatins at nce (recmmended!), pen the Sygate Persnal Firewall main windw:
27 Select the Advanced Rules menu item in the Tls flder f the main applicatin menu. A new windw will pen then: Yu can create a new rule fr the AVG applicatins using the Add buttn in the Advanced Rules Settings windw. G t the Applicatins tab first:
28 Add all AVG applicatins currently installed n yur system using the Brwse buttn. Here is the list f all AVG applicatins that must always be allwed t cnnect t the internet: avginet.exe applicatin fr perfrming AVG nline updates (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgemc.exe AVG E-mail Scanner fr anti-virus scanning f e-mail (lcated in the Prgram Files/Grisft/Avg7 directry by default) Fllwing tw applicatins must be allwed t access the netwrk when the wrkstatin is a part f AVG Remte Administratin: avgmsvr.exe AVG Alert Manager cmpnent (lcated in the Prgram Files/Grisft/Avg7 directry by default) avgcc.exe AVG Cntrl Center (lcated in the Prgram Files/Grisft/Avg7 directry by default) And finally, when there are installed the cntrl cmpnents f AVG Remte Administratin n the wrkstatin, the fllwing applicatins must be als allwed t cmmunicate ver the netwrk: avgadmin.exe the main cntrl applicatin f AVG Remte Administratin, AVGADMIN (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/AvgAdmin7 by default)
29 avgtcpsv.exe AVG TCP Server applicatin fr AVG Remte Administratin (if the prduct is installed n yur cmputer, it is lcated in the Prgram Files/Grisft/Avg TCP Server by default) avginetl.exe AVG InetLite applicatin (if installed, it is lcated in the Prgram Files/Grisft/Avg TCP Server by default) G t the General tab then: Yu have t allw any netwrk cmmunicatin fr the selected AVG applicatins by selecting the Allw this traffic ptin. Cmmit the rule creatin by pressing the OK buttn. All AVG applicatins requiring the netwrk cmmunicatin shuld be fully peratinal then.
30 8. Keri Winrute Firewall AVG update dwnlading and email scanning is wrking prperly with the default settings f Keri Winrute Firewall. Hwever, if the statin is incrprated int AVG Remte Administratin r if AVGADMIN with AVG TCP Server are running n the cmputer, it is necessary t create a new rule f traffic plicy then: Fr full functinality f AVG Remte Administratin yu have t allw any surce and destinatin fr the fllwing prts: 4156, 6051, 6052, 6053.
31 9. Technical Supprt Shuld yu have any further prblems with yur AVG prduct, please refer t the FAQ sectin f the Grisft website at http://www.grisft.cm. If yu d nt succeed in finding help this way, cntact the technical supprt department at technicalsupprt@grisft.cm. Be sure t include yur AVG license number in the bdy f the e-mail.