Creating and configuring firewall rules

To create and configure firewall rules using the Web Plug-in:

1. In the main window of the Kaspersky Security Center Web Console, select Devices → Policies & profiles.
2. Click the policy name you want to configure.
3. In the <Policy name> window that opens select the Application settings tab.
4. Select the Network activity control section.
5. Click the Settings button in the Firewall Management block.

   The Firewall Management window opens.

6. Create and configure an incoming firewall rule for the application.
   1. Select the Applications (inbound connections) tab.
   2. Click the Add button.
   3. In the right part of the window, select the Use the rule check box to enable the rule.
   4. In the Rule name field enter the name of the edited rule.

      The name of the rule, regardless of the case of characters, must not match the reserved names All, ICMPv4, and ICMPv6; it must be unique in the list of all rules for inbound network connections for applications.

   5. In the Rule action list, select one of the options:
      • Allow. If this option is selected, the application allows incoming network connections for the application.
      • Block. If this option is selected, the application blocks incoming network connections for the application.
   6. In the Application path field, manually specify the path to the executable file of the application for which you are configuring the rule.
   7. In the Rule application scope field, specify network addresses. The application monitors incoming connections from the specified network addresses in accordance with the rule settings.

      You can only use IPv4 addresses.

   8. Click the OK button to save the rule.
7. Create and configure a firewall rule for incoming connections for ports.
   1. Select the Ports (inbound connections) tab.
   2. Click the Add button.
   3. In the right part of the window, select the Use the rule check box to enable the rule.
   4. In the Rule name field enter the name of the edited rule.

      The name of the rule, regardless of the case of characters, must not match the reserved names All, ICMPv4, and ICMPv6; it must be unique in the list of all rules for inbound network connections for ports.

   5. In the Rule action list, select one of the options:
      • Allow. If this option is selected, the application allows incoming network connections for the ports.
      • Block. If this option is selected, the application blocks incoming network connections for the ports.
   6. In the Local ports block, specify a port or port range.
      

      For inbound network connections, specify a port or port range for the local device.

      For outgoing network connections, specify a port or port range for remote devices.

      The available values for the port number are 1–65535.

      The available port ranges are 1–10, 20–30000, and 1–65535.

      Windows XP does not support port ranges. Therefore, for devices in the rule scope that run Windows XP, the application applies the rule only to the first port of the specified range.

   7. Select the type of protocol (TCP / UDP) for which the application will control incoming connections.
   8. In the Rule application scope field, specify network addresses. The application monitors incoming connections from the specified network addresses in accordance with the rule settings.

      You can only use IPv4 addresses.

   9. Click the OK button to save the rule.
8. Create and configure an outgoing firewall rule for the application.
   1. Select the Applications (outbound connections) tab.
   2. Click the Add button.
   3. In the right part of the window, select the Use the rule check box to enable the rule.
   4. In the Rule name field enter the name of the edited rule.

      The name of the rule, regardless of the case of characters, must not match the reserved names All, ICMPv4, and ICMPv6; it must be unique in the list of all rules for outbound network connections for applications.

   5. In the Rule action list, select one of the options:
      • Allow. If this option is selected, the application allows outgoing network connections for the application.
      • Block. If this option is selected, the application blocks outgoing network connections for the application.
   6. In the Application path field, manually specify the path to the executable file of the application for which you are configuring the rule.
   7. In the Rule application scope field, specify network addresses. The application monitors outgoing connections from the specified network addresses in accordance with the rule settings.

      You can only use IPv4 addresses.

   8. Click the OK button to save the rule.
9. Create and configure an outgoing firewall rule for ports.
   1. Select the Ports (outbound connections) tab.
   2. Click the Add button.
   3. In the right part of the window, select the Use the rule check box to enable the rule.
   4. In the Rule name field enter the name of the edited rule.

      The name of the rule, regardless of the case of characters, must not match the reserved names All, ICMPv4, and ICMPv6; it must be unique in the list of all rules for outbound network connections for ports.

   5. In the Rule action list, select one of the options:
      • Allow. If this option is selected, the application allows outgoing network connections for the ports.
      • Block. If this option is selected, the application blocks outgoing network connections for the ports.
   6. In the Remote ports block, specify a port or port range.
   7. Select the type of protocol (TCP / UDP) for which the application will control incoming connections.
   8. In the Rule application scope field, specify network addresses. The application monitors outgoing connections to the specified network addresses in accordance with the rule settings.

      You can only use IPv4 addresses.

   9. Click the OK button to save the rule.
10. Click the OK button in the Firewall Management window.

Kaspersky Embedded Systems Security for Windows applies the new settings to the running task. The date and time when the settings were changed are saved in the system audit log.