1 1 00:00:00,170 --> 00:00:02,450 In this video, I'm going to show you how to configure 2 2 00:00:02,450 --> 00:00:04,860 the Windows firewall and the Mac firewall, 3 3 00:00:04,860 --> 00:00:07,780 so whichever system you're using, you'll know how to do it. 4 4 00:00:07,780 --> 00:00:09,670 Let's start with the Windows firewall. 5 5 00:00:09,670 --> 00:00:11,560 We're going to use the Windows Defender Firewall 6 6 00:00:11,560 --> 00:00:12,940 with Advanced Security. 7 7 00:00:12,940 --> 00:00:15,740 To load this up, simply go down to your Windows key 8 8 00:00:15,740 --> 00:00:18,158 or your start menu, scroll all the way down 9 9 00:00:18,158 --> 00:00:21,277 to where you see Windows Administrative Tools, 10 10 00:00:21,277 --> 00:00:24,280 and then, scroll down again, once you click on that, 11 11 00:00:24,280 --> 00:00:26,780 and you will find the Windows Defender Firewall 12 12 00:00:26,780 --> 00:00:28,033 with Advanced Security. 13 13 00:00:29,120 --> 00:00:31,500 Once you click on that, it will open. 14 14 00:00:31,500 --> 00:00:34,330 From here, you can create all of the policies you want, 15 15 00:00:34,330 --> 00:00:36,930 setting up inbound rules, outbound rules, 16 16 00:00:36,930 --> 00:00:38,790 monitoring it, et cetera. 17 17 00:00:38,790 --> 00:00:40,430 Once you have it set just the way you like, 18 18 00:00:40,430 --> 00:00:42,790 you can actually export that policy 19 19 00:00:42,790 --> 00:00:44,090 so you'll have it as a back-up 20 20 00:00:44,090 --> 00:00:46,220 any time you need to go back to it. 21 21 00:00:46,220 --> 00:00:48,690 Right now, you can see my domain profile 22 22 00:00:48,690 --> 00:00:51,440 shows Windows Defender Firewall is off. 23 23 00:00:51,440 --> 00:00:53,930 My private profile shows that it's on, 24 24 00:00:53,930 --> 00:00:56,440 and my public profile shows that it's on. 25 25 00:00:56,440 --> 00:00:59,070 What this means is that in my private network 26 26 00:00:59,070 --> 00:01:00,100 and my public network, 27 27 00:01:00,100 --> 00:01:02,540 I do have the Windows firewall turned on. 28 28 00:01:02,540 --> 00:01:04,800 In the private network I don't allow 29 29 00:01:04,800 --> 00:01:07,660 any inbound connections that don't match my rules, 30 30 00:01:07,660 --> 00:01:11,000 but I will allow outbound that don't match my rules. 31 31 00:01:11,000 --> 00:01:14,180 In my public network, I have it set the exact same way. 32 32 00:01:14,180 --> 00:01:15,700 Now, if I want to change that, 33 33 00:01:15,700 --> 00:01:18,800 I can go into my inbound rules or my outbound rules, 34 34 00:01:18,800 --> 00:01:21,060 and decide how I want that to be done. 35 35 00:01:21,060 --> 00:01:23,240 Let's take a look at some of these rules. 36 36 00:01:23,240 --> 00:01:26,380 For example, we have this one here, which is SSH, 37 37 00:01:26,380 --> 00:01:28,150 which is Secure Shell. 38 38 00:01:28,150 --> 00:01:31,590 All of my profiles allow it, it's enabled for all of them, 39 39 00:01:31,590 --> 00:01:32,944 it will do an allow action, 40 40 00:01:32,944 --> 00:01:35,850 and it's going to allow any program to be run 41 41 00:01:35,850 --> 00:01:38,940 from any address locally to any address remotely 42 42 00:01:38,940 --> 00:01:41,150 over port 22. 43 43 00:01:41,150 --> 00:01:42,680 That may be what you want to do, 44 44 00:01:42,680 --> 00:01:44,511 or it may be something you want to block. 45 45 00:01:44,511 --> 00:01:46,753 Let's go ahead and look at some other ones. 46 46 00:01:46,753 --> 00:01:49,230 Down here, we have App Installer. 47 47 00:01:49,230 --> 00:01:51,625 For App Installer, it's allowing it to go 48 48 00:01:51,625 --> 00:01:54,890 any local address to any remote address, 49 49 00:01:54,890 --> 00:01:57,050 any protocol, and any port. 50 50 00:01:57,050 --> 00:01:58,630 This type of an any/any rule 51 51 00:01:58,630 --> 00:02:00,540 allows it to have a lot of ability, 52 52 00:02:00,540 --> 00:02:02,770 and so, this is going to allow a lot of things through 53 53 00:02:02,770 --> 00:02:03,920 that we might not want. 54 54 00:02:05,160 --> 00:02:06,520 Now, let's say you have a program 55 55 00:02:06,520 --> 00:02:07,750 that you want to add to this. 56 56 00:02:07,750 --> 00:02:09,490 Maybe you have a new web server on this 57 57 00:02:09,490 --> 00:02:11,450 and you're going to run it on port 80. 58 58 00:02:11,450 --> 00:02:14,766 You can hit new, you can then select a program, 59 59 00:02:14,766 --> 00:02:18,090 a port, a pre-defined, or a custom. 60 60 00:02:18,090 --> 00:02:19,660 In this case if it's a web server, 61 61 00:02:19,660 --> 00:02:22,110 we would want to do it based on port 80. 62 62 00:02:22,110 --> 00:02:23,890 Then, we'll click on next. 63 63 00:02:23,890 --> 00:02:26,770 Do we want it for TCP traffic or UDP traffic? 64 64 00:02:26,770 --> 00:02:29,220 If it's a web server, again, it's TCP. 65 65 00:02:29,220 --> 00:02:30,900 If it's something else that might use UDP, 66 66 00:02:30,900 --> 00:02:32,060 you could set that up. 67 67 00:02:32,060 --> 00:02:34,190 And then, what ports is that going to work for? 68 68 00:02:34,190 --> 00:02:36,840 For all of your local ports, or specific ports? 69 69 00:02:36,840 --> 00:02:40,200 Well, if it's a web server, it again should be port 80, 70 70 00:02:40,200 --> 00:02:43,024 and for secure, port 443. 71 71 00:02:43,024 --> 00:02:46,460 Then, we can go next, we can allow that connection, 72 72 00:02:46,460 --> 00:02:48,330 we can allow the connection if it's secure, 73 73 00:02:48,330 --> 00:02:49,810 meaning it has to use something like 74 74 00:02:49,810 --> 00:02:53,100 a VPN tunnel with IPSec, or we can block the connection 75 75 00:02:53,100 --> 00:02:55,010 and not allow any web traffic in. 76 76 00:02:55,010 --> 00:02:57,770 In our case, we want to allow the connection. 77 77 00:02:57,770 --> 00:02:59,910 Then, we click on next, and you can see 78 78 00:02:59,910 --> 00:03:01,970 which of those three networks it's going to apply to. 79 79 00:03:01,970 --> 00:03:03,230 I'm going to allow all three of them 80 80 00:03:03,230 --> 00:03:06,023 to have it applied to it, and then I'll give it a rule. 81 81 00:03:07,090 --> 00:03:08,253 Jason's Web Server. 82 82 00:03:10,670 --> 00:03:13,040 And that's it, now you can see that Jason's Web Server 83 83 00:03:13,040 --> 00:03:16,370 is now going to allow traffic from any program 84 84 00:03:16,370 --> 00:03:18,920 from any local address and any remote address 85 85 00:03:18,920 --> 00:03:23,320 over protocol TCP, and on port 80 and 443. 86 86 00:03:23,320 --> 00:03:27,160 Now, conversely, if I want to block things from getting in, 87 87 00:03:27,160 --> 00:03:28,530 we would do the exact same thing, 88 88 00:03:28,530 --> 00:03:31,270 except we would set it up as a block or a deny. 89 89 00:03:31,270 --> 00:03:33,390 For example, I don't want to allow anybody 90 90 00:03:33,390 --> 00:03:37,090 to do Telnet into my network, because Telnet is unsecure. 91 91 00:03:37,090 --> 00:03:39,230 So, I would set up a new rule, 92 92 00:03:39,230 --> 00:03:42,450 and from there, I can block anything on port 23, 93 93 00:03:42,450 --> 00:03:45,316 which is TCP traffic on port 23, 94 94 00:03:45,316 --> 00:03:48,930 and then, I'll hit Next, I'll block that connection, 95 95 00:03:48,930 --> 00:03:51,430 and I'll block it for all three of those networks, 96 96 00:03:51,430 --> 00:03:53,283 and I'm going to say Blocking Telnet. 97 97 00:03:55,267 --> 00:03:56,580 And that's it. 98 98 00:03:56,580 --> 00:03:58,870 You could see how easy it is to set up these rules. 99 99 00:03:58,870 --> 00:04:02,790 If somebody says I want to block TCP on port 23 100 100 00:04:02,790 --> 00:04:05,030 or I want to block Telnet, then you should be able to say 101 101 00:04:05,030 --> 00:04:06,600 I want to block it from this area, 102 102 00:04:06,600 --> 00:04:08,730 and let it go to that area. 103 103 00:04:08,730 --> 00:04:10,540 Now, one more area of the Windows firewall 104 104 00:04:10,540 --> 00:04:13,110 that I want to show you is down here in Monitoring. 105 105 00:04:13,110 --> 00:04:15,550 Down in Monitoring, you can see which profile is active 106 106 00:04:15,550 --> 00:04:16,800 as I showed you before, 107 107 00:04:16,800 --> 00:04:18,820 but you also have access to the log file, 108 108 00:04:18,820 --> 00:04:19,653 and if you click on that, 109 109 00:04:19,653 --> 00:04:21,960 you'll be able to see what's currently there. 110 110 00:04:21,960 --> 00:04:24,740 What is being logged, right now is it logging drop packets 111 111 00:04:24,740 --> 00:04:25,900 and successful connections? 112 112 00:04:25,900 --> 00:04:29,530 Right now, it's not, but we can change that if we wanted to. 113 113 00:04:29,530 --> 00:04:32,520 Now, we can also view our active rules. 114 114 00:04:32,520 --> 00:04:35,330 This again brings us back to what those inbound rules are 115 115 00:04:35,330 --> 00:04:38,540 and seeing which ones are actually active on this profile. 116 116 00:04:38,540 --> 00:04:40,670 So, you'll notice, anything that's all or public 117 117 00:04:40,670 --> 00:04:41,970 is being shown here. 118 118 00:04:41,970 --> 00:04:45,270 Anything that was just private or domain is not 119 119 00:04:45,270 --> 00:04:48,950 because they're not active for this particular connection. 120 120 00:04:48,950 --> 00:04:52,140 Next, we're going to configure a firewall on a Mac machine. 121 121 00:04:52,140 --> 00:04:55,050 To do that, simply go to the apple in the upper left corner 122 122 00:04:55,050 --> 00:04:56,810 and go to System Preferences. 123 123 00:04:56,810 --> 00:04:59,997 From here, you're going to click Security and Privacy 124 124 00:04:59,997 --> 00:05:03,110 and then, you're going to click on the Firewall tab. 125 125 00:05:03,110 --> 00:05:05,450 You can notice that my firewall is on, 126 126 00:05:05,450 --> 00:05:08,150 but I can't click any of the firewall options right now. 127 127 00:05:08,150 --> 00:05:10,546 That's because you have to unlock it by clicking the lock 128 128 00:05:10,546 --> 00:05:13,923 and adding your username and password for the Admin account. 129 129 00:05:15,840 --> 00:05:18,310 Once you do that, you can turn off your firewall, 130 130 00:05:18,310 --> 00:05:19,800 or you can turn on your firewall, 131 131 00:05:19,800 --> 00:05:22,400 and you can configure the options. 132 132 00:05:22,400 --> 00:05:25,430 In here, you can block all incoming connections, 133 133 00:05:25,430 --> 00:05:27,040 you can see what applications 134 134 00:05:27,040 --> 00:05:28,420 have been allowed through the firewall. 135 135 00:05:28,420 --> 00:05:31,130 In my case, Skype and Google Drive are allowed 136 136 00:05:31,130 --> 00:05:33,290 to have connections into my computer. 137 137 00:05:33,290 --> 00:05:35,717 And then, you can automatically allow built-in software, 138 138 00:05:35,717 --> 00:05:38,760 meaning Apple software, to receive incoming connections, 139 139 00:05:38,760 --> 00:05:40,940 things like iTunes and iMessage, 140 140 00:05:40,940 --> 00:05:42,930 and you can automatically allow downloaded 141 141 00:05:42,930 --> 00:05:45,350 signed software to receive incoming connections, 142 142 00:05:45,350 --> 00:05:47,280 meaning this is software that you trust. 143 143 00:05:47,280 --> 00:05:49,320 And finally, we have Stealth Mode. 144 144 00:05:49,320 --> 00:05:51,780 What Stealth Mode does is it makes your firewall 145 145 00:05:51,780 --> 00:05:54,820 not respond and not acknowledge any attempts 146 146 00:05:54,820 --> 00:05:56,690 from somebody to ping your network. 147 147 00:05:56,690 --> 00:05:58,690 So, if somebody is doing a ping sweep of your network, 148 148 00:05:58,690 --> 00:06:01,010 my computer is simply not even going to answer, 149 149 00:06:01,010 --> 00:06:03,740 so you won't know if it's up, down, or even there. 150 150 00:06:03,740 --> 00:06:06,050 So, how do we add an application to this list 151 151 00:06:06,050 --> 00:06:07,860 to allow incoming connections? 152 152 00:06:07,860 --> 00:06:09,900 Well, Mac makes it fairly easy. 153 153 00:06:09,900 --> 00:06:12,960 You click on the plus sign, you find the application, 154 154 00:06:12,960 --> 00:06:16,610 for example, my Chess application, and then hit Add. 155 155 00:06:16,610 --> 00:06:18,380 When you do that, it by default 156 156 00:06:18,380 --> 00:06:20,440 is going to allow incoming connections. 157 157 00:06:20,440 --> 00:06:23,011 Now, if I don't want that anymore, I can simply click on it 158 158 00:06:23,011 --> 00:06:26,160 and subtract it, and it won't answer up. 159 159 00:06:26,160 --> 00:06:28,720 As you can see, you don't have the level of fidelity 160 160 00:06:28,720 --> 00:06:32,120 that you have on a Windows machine here in a Mac machine. 161 161 00:06:32,120 --> 00:06:34,270 To get that level of fidelity, you'd have to use 162 162 00:06:34,270 --> 00:06:36,980 the command line firewall tools that are provided, 163 163 00:06:36,980 --> 00:06:39,463 such as PF or IPFW.