PPPoE/PPP0A or Bridge Mode??

Hi friends,

Recently, I took unlimited connection and had many problems regarding the softwares, which I donwloaded from the net (trial version softwares) even I had an encounter (a real fight and finally defeated by AVG) with Trojan Horse Downloader.Zlob.CP. Now that, I have contacted the Internet Connection Provider regarding this and they came up with configuring my connection from Bridge Mode to PPPoE/PPP0A and also they did said that when I connect to internet using PPPoE/PPP0A, I will be online every time (when I switch on my modem) and also said that there are some firewalls "inside the modem" which will keep your computer safe from all the viruses from the internet.

I am here to know whether, how far these people are correct (Internet Providers) compelling me to go for a PPPoE/PPP0A type configuration. Is there any point in connecting through PPPoE/PPP0A? Or do I have to go for the Bride Mode? (?)

Please help me with this FrIeNdS........ ThAnK yOu in advance.

Regards,

Sumesh Paul. (Antionline Newbie)

this is just my experience and yall feel free to correct me if im wrong im a tad rusty and its late. You would be using Bridge mode if you were trying to connect to the internet thru a router. example: you have a Linksys router and a Verizon dsl modem. So, you would bridge the linksys and the dsl modem together.
Now I am assuming you just have 1 dsl modem so your ISP is correct in saying you should stick with PPPoe mode ( which does mean you are always on) but you also may have it configured to where you have to enter a username/password to connect to the internet. Some people do and some dont.
As for your ISP's claim that your modem has an internal firewall I SERIOUSLY doubt that... Most firewalls are programs such as Zone Alarm. They do have external firewalls but that is another piece of equiptment that I doubt you currently have.

In conclusion: keep your modem in PPPoe mode and get yourself some good antivirus/firewall software

try Zone Alarm Firewall and Adaware for antivirus you could go with something like AVG. hope this helps.

Greeting's

Quote:

---

....and also said that there are some firewalls "inside the modem" which will keep your computer safe from all the viruses from the internet...

---

The answer is NO. A modem does not have an inbuilt firewall. Are you sure its a modem and not a ROUTER ? If its a router it will protect you from threats from the internet. But it will not protect you from VIRUSES AND TROJANS getting installed on your PC.

In case of trojans a firewall will detect its attempt to listen on whatever port it is configured too and will prevent it from doing that (If you click on NO rather then just say YES). Second there are some firewall's out there who come inbuilt with Malware scanner but they are okay at the best.

So the answer is that YOU WILL NEED TO BUY AND INSTALL AN ANTIVIRUS

Hi, The Texan and ByTeWrangler

Am using UTstarcom.

I forgot to mention rather I was wrong mentioning about the "modem" I of course have a router with me and what the strange thing about the configuration of the router is "I configured the router myself." I did call the providers or the officials responsible, but they never made up!! So, when I started configuring (I read the installation procedure in the CD provided with the "router") I first went to the internet explorer and logged on to 192.168.1.1, which they mentioned in the CD and gave necessary password and username and entered into that site and configured them as I like (To be frank I dont know anything about configuring a router (apart from google)) and hence had many connection problems and finally I called them (Providers) and they gave me some online instructions, which I followed. Now that, what my real concern is

1. Is there any problem switchin on router for 24 hours? (Since am using PPoE/PPoA)
2. Does switching off the router stops the connection completely?
3. Any problem keeping the line in (ADSL) to the router without unplugging them?


Regards,
Sumesh Paul.

Your Questions:

1. Is there any problem switchin on router for 24 hours? (Since am using PPoE/PPoA)
It's normal to leave the router on 24x7. Personally I use Vonage as a Telephone provider
which goes through the router. So for telephone service I have to have the modem/router on 24x7.
Some precautions - use a surge protector.

2. Does switching off the router stops the connection completely?
Assuming your connection is typically
INTERNET ->> MODEM ->> ROUTER ->> PCs
Disconnecting the Modem or Router will stop the connection completely to a PC.

3. Any problem keeping the line in (ADSL) to the router without unplugging them?
See the answer to question 1 - use a surge protector.

If you feel safer - turn them off. Turning them off will not hurt anything either.
In regards to the surge protector - I recommend one with a battery backup.
The power supplied is cleaner and if you lose power - you'll have time to
shut down your PC. But most power outages in my area anyway are only
a few seconds. Just long enough to make a person mad and crash your PC.
In fact - I even have battery backup on the TV just because the
TIVO is run off of a Disk Drive and I hate hard drive crashes.

<quote>
The answer is NO. A modem does not have an inbuilt firewall. Are you sure its a modem and not a ROUTER ? </quote>

To clairfy, a DSL modem does not have a firewall, but most new-er DSL modems come with a built in switch/nat As such they can perform firewall features. What brandname and model modem do you have?

I currently work for one of those ISP's you speak of, and i can say with all honesty, the DSL modem firewalls are generally crap. I mean they may WORK... but they work like Notepad works... very simple edits/changes.

where as a client side firewall, like Nortan Internet Security (something i DONT recomend), would probably be better for ya.

hope that helps clairify things. Chances are your ISP isnt lying to you, however, they just dont want to tell you the whole truth (unless you ask it :))

hi pcllwftdtm,

Thank you for the post. I have a routher with me. Will you please tell me about some good antivirus that I should use inorder to keep the connection safe from any kind of penetration.

Regards,
Sumesh Paul.

Hi stan0614,

Of course I will use a surge protector from now onwards.

I think my connection to the internet is thorough this kind of link,
INTERNET ->> ROUTER ->> PCs. I dont think a modem will be there in between internet and computer. Of course the routher is there, but nothing else I think.

To be in detail.

My connection to internet from PC goes likes this..

PC-->> D-Link-->> Router-->> Switch-->> Internet.

I think I had mentioned the right thing!!

Other than believing the ISP, how else can I do something more effective to maintain a stable connection. Does a good firewall help me from unwanted malwares? Am now using trying with AVG. Is this a stable antivirus? I have read the thread for the newbies in which it was all about the antivirus softwares which we should not use, but never mentioned which we should use. What you say about this stan0614? What in your point of view is one of the better?

I think I should go for a poll section from which I can get a list of antivirus which I ought to use. I very well know that, other than using antivirus we should have some regulations in surfing...!!

Regards,
Sumesh Paul.

The best security defense is a "defense in depth".

This means nothing is 100% secure. So use multiple layers of security. If something gets past one layer of security hopefully the next layer will block it.
Antivirus
Spyware Detector
Nat Router (secured)
Restrict access to Browsing Warez and Porn sites
Limit Opening Attachments in Email
Use your ISP's Spam Filter

You say your set up is:
"PC-->> D-Link-->> Router-->> Switch-->> Internet"

I think the Dlink is the router and the Router should be a Modem supplied by your ISP.
PC-->> D-Link-->> Modem-->> Internet.

Let's Take it one device at a time -
PC -
Use an antivirus - Most of the commercial ones offer a suite. Not only do they include an antivirus , but it blocks access to porn or warez sites, and can quarantine SPAM in email and block bad code in some websites and spyware. I use Trendmicro PC-Cillin Suite. Best BUY has a great deal on Zone Alarm for $9.99 that expires Sept 30.
http://www.bestbuy.com/site/olspage....=1156607147960

Also on the PC - I run Spybot and Ad-aware. Be sure to get the right ones. Malware people love to make items that look like the original but are indeed evil. Anti-online has a good list of what to avoid.

On your D-Link - Chances are it's wireless. If you have no wireless devices - TURN OFF WIRELESS. If you do have wireless - secure it.
http://www.windowsecurity.com/articl...rity-Home.html
That link has some good information.

You stated on your first post that the modem was set in bypass mode. This means that your D-Link router is your front line of defense. Check the manufacturer's documentation and visit their website for Firmware updates. (Be careful on Firmware updates - I installed one once and lost access to Bellsouth because they had an MTU size set wrong in the firmware.)

So now - pretend like I'm a bad guy - If you check your IP address of your PC it's probably something like 192.168.1.100 or something. (Command prompt ipconfig /all)
192.168.anything is not routable on the internet so I cannot get to you. But I am banging away at your router. If you go to the status web page of your router you have a IP Address other than 192.168...
Check this out by going to https://www.grc.com/x/ne.dll?bh0bkyd2

How routers work is pretty complicated and I love podcasts -
go to http://www.grc.com/securitynow.htm
scroll to the bottom and listen to episode 3.

Use firefox as a browser instead of internet explorer. Firefox has holes too but most attacks are against internet explorer.
I also use thunderbird instead of outlook or outlook express.

Also most ISPs now offer antispam filtering for email - sometimes you have to sign up for it for free.

And one last thing - email address - I use a web based account like gmail or yahoo. - so I if I swap from DSL to cable to DSL again I am not locked into the ISP's email address. I can maintain the same email no matter who my ISP is.

Hi stan0614,

Thank you for the post. I am using AVG 7.1 professional in my system. Is this a good software to be with. The D-Link I mentioned above is the network card that I am using. The router name is UT-300R2U. UTStarCom or something like that. Since my ISP gave me the router, there is no name for the router rather just the name of the ISP. I did go to https://www.grc.com/x/ne.dll?bh0bkyd2 and found the below mentioned things.

I found some ports open and how can I react to this open ports. How can I secure my computer with this open port?

I do expect some good post for this. Thank you for the above post.



GRC Port Authority Report created on UTC: 2006-09-29 at 13:13:45

Results from scan of ports: 0-1055

3 Ports Open
1049 Ports Closed
4 Ports Stealth
---------------------
1056 Ports Tested

Ports found to be OPEN were: 21, 23, 80

Ports found to be STEALTH were: 135, 139, 445, 593

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.


Regards,
Sumesh Paul.

"Ports found to be OPEN were: 21, 23, 80"

Holy Crap!!!

21 = FTP
23 = Telnet
80 = HTTP

If I knew your IP address (which bad people will find soon enough by randomly scanning a range of ip addresses) - I could open a command prompt on your pc by the telnet command - put whatever files I want to on your hard drive via the ftp command - and run a web server on Port 80.

You're screwed dude.

Did you mean to run these services (http/ftp/telnet) on your PC?
Try: http://127.0.0.1 (Your PC) to see if a web page is displayed.

Since port 135, 137, and 139 are not open - I suspect it's your router/modem instead of your PC reporting these open port values.

Maybe it is the router supplied by your ISP running these and I would contact them ASAP to close the ports. Ask them if you can replace their router with a router of your own like a linksys.

The logmein software you have loaded could also be listening to those ports. Could be normal - but anything that leaves you that open is not good and could be bypassed.

Hi stan0614,

So, what would you recommed me to do to disable these ports?

The latest news by from the link https://www.grc.com/x/ne.dll?bh0ciyl2 is like this....

GRC Port Authority Report created on UTC: 2006-09-29 at 15:10:02

Results from scan of ports: 0-1055

3 Ports Open
1053 Ports Closed
0 Ports Stealth
---------------------
1056 Ports Tested

NO PORTS were found to be STEALTH.

Ports found to be OPEN were: 21, 23, 80

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.


Please recommed me with some good measures that I should follow before the "(which bad people will find soon enough by randomly scanning a range of ip addresses)" happens to me.

Regards,
SumesH PauL.

sumesh,

did you run the Microsoft Baseline Security Analyzer? Its a small proggy to help you finetune your pc security.

It is available at http://www.microsoft.com/technet/sec.../mbsahome.mspx

btw, were you browsing in other window while the online scan was going on?

For closing the ports. click start>run>services.msc

Port 21- Stop Application Layer Gateway Service
Port 23- Stop Telnet
Port 80-Stop Windows Media Services, World Wide Web Publishing Service and SharePoint Portal Server

More info about the more obvious ports is at http://support.microsoft.com/kb/832017

cheers

Hai Chizra,

Thanks for the post. I disabled the servies as you mentioned above, but what the strange thing was, I couldnt disable the telnet service. The telnet was already disabled. But one telephony service is still running, "which enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet" is what mentioned in the properties of that telephony service. If I stop this service does the connection to internet stops completely?

Please help me with this tooo!!

Regards,
Sumesh Paul.

The snap shot of this particular services is attached.

You may visit http://technet.microsoft.com/en-us/default.aspx

and find more info about them.

btw, i didnt do much, i just invoked my god (google) for it. And switching on/off services is trail and error. always recoverable. :cool:

Om Shanti!

Turning off telnet will NOT affect your connection to the internet.
What is the status of using SHIELDS UP! now.

Are the ports still open?

Hi friends,

I still have 3 ports open. The details about this is mentioned below.

GRC Port Authority Report created on UTC: 2006-09-29 at 18:43:11

Results from scan of ports: 0-1055

3 Ports Open
1053 Ports Closed
0 Ports Stealth
---------------------
1056 Ports Tested

NO PORTS were found to be STEALTH.

Ports found to be OPEN were: 21, 23, 80

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.

I tried to close the telnet, which is already disabled, but still the port 21 is open.

Am attaching a zip file of the this in detail.

The ports open are the following..

what does https://www.grc.com/x/ne.dll?bh0bkyd2 look like?

After going through the procedures in that link, the final result looks like this..

GRC Port Authority Report created on UTC: 2006-09-29 at 19:30:58

Results from scan of ports: 0-1055

3 Ports Open
1053 Ports Closed
0 Ports Stealth
---------------------
1056 Ports Tested

NO PORTS were found to be STEALTH.

Ports found to be OPEN were: 21, 23, 80

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.

What I think I'm reading is - ports 21,23 and 80 are still open even after disabling the services on your PC....and there are no Stealthed ports

A couple of things are happening -
1) Your PC is connected directly to the internet - there is no router.
2) It is the router that is highly unsecure and should be replaced.
3) We could be missing major information gaps. Such as what other programs/services are running, what are the exact pieces of equipment in place.

Suggest -
Get a very technical friend to physically check out your set up.
Pay a network pro to check your setup.
Disconnect from the internet whenever possible. Do not leave your connection Always on.

Hi stan0614,

Can I get an online help from my friends over there through NetMeeting?