Firewall

The Kaspersky Security functionality described in this section is available only if the application is installed on a virtual machine with a Windows desktop or server operating system.

During use on LANs and the Internet, your virtual machine is exposed to viruses, other malicious applications, and a variety of attacks that exploit vulnerabilities in operating systems and software.

Firewall protects personal data that is stored on protected virtual machine, blocking network threats while the protected virtual machine is connected to the Internet or a local area network. Firewall detects all network connections of protected virtual machine and provides a list of IP addresses, with an indication of the status of the default network connection.

When a remote connection to a protected virtual machine is established after installation of the application, Firewall is enabled by default, blocking the RDP session. To prevent the session from being blocked, you need to change the Firewall action for the "Remote desktop network activity" network packet rule to Allow.

During operation of the Firewall component, the Windows Firewall is disabled to prevent conflicts. If a domain policy is being used for the Windows Firewall, you must disable the Windows Firewall in the domain policy during operation of the Firewall component.

Firewall component controls all network connections on protected virtual machine and automatically assigns a status to each detected network connection.

The network connection can have one of the following status types:

• Public network. This status is for networks that are not protected by any anti-virus applications, firewalls, or filters (for example, for Internet cafe networks). When the user operates a protected virtual machine that is connected to such a network, Firewall blocks access to files and printers of this virtual machine. External users are also unable to access data through shared folders and remote access to the desktop of this virtual machine. Firewall filters the network activity of each application according to the network rules that are set for it.

  Firewall assigns Public network status to the Internet by default. You cannot change the status of the Internet.

• Local network. This status is assigned to networks whose users are trusted to access files and printers on the secured virtual machine (for example, a LAN or home network).
• Trusted network. This status is intended for a safe network in which the virtual machine is not exposed to attacks or unauthorized data access attempts. Firewall permits any network activity within networks with this status.

You can change the statuses that the Firewall component assigns to detected network connections.

In addition, when working via Kaspersky Security Center, you can redefine the settings of networks whose activity is monitored by the Firewall: add a network, change network settings, or delete a network from the table.

When working with the Firewall, please keep in mind the following special considerations:

• Network activity at the application level via the TCP and UDP protocols is not blocked if the IP address of the sender matches the IP address of the recipient, under the condition that the packet was sent via RAW socket.
• The Firewall does not check the application rules and allows network activity if the remote computer has the following IP address:
  • for IPv4: 127.0.0.1
  • for IPv6: ::1

  under the condition that the packet was sent via RAW socket.

• The local address from which or to which data is sent may be undefined in the following cases:
  • The application that initiated the network activity via the TCP or UDP protocols did not specify a local IP address.
  • The application initiated the network activity via the ICMP protocol.
  • The application receives an incoming packet via the UDP protocol.
• The Firewall does not filter loopback traffic at the network level. Decisions on loopback packets are made at the application level.
• When filtering network activity at the application level via the ICMP protocol, the Firewall supports only an outgoing ICMP Echo-Request.
• There is no filtering of incoming ICMP packets at the application level.
• For outgoing network activity via RAW socket, there is no filtering based on packet rules at the application level.
• Packets that are filtered out by the Network Attack Blocker component are not scanned by the Firewall.
• If an SVM has tunneling network interfaces, filtering of tunneling traffic based on packet rules is repeated for the same packet as the packet propagates between interfaces.

This section describes how to configure Firewall settings using the Administration Console and the Light Agent for Windows local interface. You can also configure the Firewall settings using the Web Console when creating or modifying the Light Agent for Windows policy settings (Application Settings → Anti-Virus protection → Firewall). Configuring network rules for an application or application group using the Web Console is not supported.

In this Help section About network rules Enabling or disabling Firewall Changing the network connection status Managing network packet rules Managing network rules for applications and application groups

Page top