Windows Forum

Ask something
Discussion Locked

Getting VirusScan through a firewall

0 helpful
8 replies

by cfletcher

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am running NAI's VirusScan Enterprise 7.1 and a Kerio Firewall on a Windows 2000 server. With the firewall running, my virus updates can't connect to the NAI server. With the firewall disabled, they do. I have created a firewall rule that enables traffic in both directions on ports 20, 21, and 80 when MCUPDATE.EXE is executed (which is what NAI said to do). But it doesn't work. I also have an FTP server running successfully on the same server. So I tried duplicating it's firewall rule for VirusScan. But again, no luck. Any ideas on how to resolve this?

8 replies

by curacao_dejavu

check within the log file of Kerio.
I think after the antivirus connects to the server to update the defintions its creating secondary connections on other ports. Also make sure that you selected the appropiate traffic, tcp or udp or both.

Leopold

by cfletcher

The Kerio log didn't have anything regarding the connection attempts. I don't think the firewall is allowing me to connect to NAI's server at all. With the firewall running, if I use the DOS ftp program to connect, it says connection refused, and it doesn't ask for a username and password. But I can connect if the firewall is turned off. I have tried TCP, UDP, and both. I've tried every possible combination of parameters (ports, protocol, application, network address, etc.) in the rule setup. But nothing seems to make any difference.

by cg it

try this ....turn off the FTP server, then try downloading...long shot but might work. I think the packets get confused about where to go the FTP or your NAI, If you use packet filtering and direct packets inbound port 21 to FTP then that's where they are going.

by cfletcher

Still nothing. Disabling the FTP server had no effect. I also tried moving the VirusScan firewall rule above the FTP rule. Nothing. Setting VirusScan to only use http on port 80 didn't work either even though I can get out to the net fine with IE.

by cg it

if it was me i would chuck the Kerio firewall out the window if it's causing that much problem.

I use ISA server. Pricey but I don't problems with programs not getting what they need. A less expensive option would be PortGate by Xramp.

by cg it

what I really use is a Linksys router, has a ton of configurable filtering options & ISA server behind that. I run Symantec Corporate Antivirus 8.1 and have absolutely no problems downloading virus definitions thought the router and ISA server.

This discussion is closed to new replies.