Netcomm firewall NB3100 strange port responses? Firewall w..

Archived from groups: comp.security.firewalls (More info?)

Hi all,

I have sent this request to Netcomm, but still no luck in a response
from support other than that they are still looking into it.

I have two Netcomm NB3100 firewalls. If I sit behind the firewall and
use DSL reports, or GRC's Shield's Up -- simple but effective port
scanners, I get strange results.

It's as if it is behaving as an adaptive firewall, and sometimes
responds on upper ports. Shield's Up says that ports over 800-900
(changes) are closed, but not silent (the starting position of the
closed ports are never the same). If I use Zonealarm, I get better
results (silent on all ports)!

If I turn off the "advanced firewall protection" (which I assume just
reverts to NAT) it does remain silent on all ports... and is perfect.
Yet, then I guess I'm not protected from DOS attacks, etc.

However, if I scan from one machine to the firewall's public IP, I
will not find any ports open -- in fact, if I try to get into the
public http server I set up, I find that my IP is now denied by the
firewall, and it's treating me as if I've done a DOS attack? Is this
perhaps because GRC uses multiple IP's to scan from? Who knows....????

There isn't much explanation by Netcom as to the types of firewall
protection it employs, so it's hard to judge what is brewing in this
beast.

Also, the log file gives everything in green, which seems to be port
scans, and also successful port forwards... its highly confusing, and
I still havent had any feedback from Netcomm as to what the color of
the log entry actually means it connected or it was blocked, or is it
both?

One other annoying thing is that you can't determine any statistics
such as data transfer via the WAN , etc.

I agree that the firewall is probably working, I don't see anything
getting past it. The problem is that it does not remain silent under
certain conditions, and port scanners report a "closed" port, thus
giving away that my PC exists.

This happens with both firewalls. Does anyone have similar Netcomm
firewall experiences??

cheers,
Devon