Sygate Personal Firewall PRO 5.0 provides the most in-depth low-level tools for protecting PCs from attacks, including Registry modifications. Unfortunately, it requires more training to use than the other firewalls in this roundup and gives mere mortals little help along the way.
Installing Sygate's firewall involves walking through a standard application setup routine. After a reboot, the firewall is up and running in the background. Rather than giving you a useful wizard, it throws you straight into the trenches, bombarding you with Internet access alerts. Worse, while the alerts provide detailed technical data about programs attempting to access the Internet, they provide no practical advice. Users without training will likely make poor decisions.
The firewall works by blocking or allowing specific services and applications rather than specific network ports; the other products we reviewed do both. Like McAfee Internet Security 5.0, Sygate's firewall has security settings that can automatically allow everything, allow nothing, or ask you every time (which is the default setting). Sygate's firewall is the only one other than McAfee.com's that by default even requires you to permit IE to access the Internet.
The firewall is crammed with little features that add up to a comprehensive package. A Test icon on the main control panel directs you to Sygate Online Services and runs a series of security tests, from basic scans to such advanced tests as checking whether port 135, used by Microsoft DCE, is open. Other options include anti-MAC and anti-IP spoofing (which makes certain kinds of attacks much harder to execute), a feature we found only in this firewall.
Another useful option treats individual program drivers as network applications. This prevents programs from being tricked into loading malicious drivers. For instance, if Microsoft Outlook loads a fake plug-in that hijacks your address book, Sygate's software can detect it. In testing, we hacked an Outlook DLL, and the firewall was able to detect our interference.
The program can send e-mail notifications when attacks are logged. We also tried the program with VPN and dial-up connections, and after querying the applications used with them (some obvious, like the AOL client, some less so, like Windows' Generic Host Process), the firewall worked without additional retraining.
Sygate's firewall uses a fingerprinting system to determine whether programs have changed since being registered. If a fingerprint changes?because of a virus or a security patch, for example?the firewall queries the user again about whether to block or allow it. In the same way, the firewall can separately inspect and fingerprint DLLs that are loaded by each app. The truly paranoid can even forcibly reset the fingerprints and start retraining from scratch.
If you want fine control over your traffic, you'll need to go to the Advanced Rule Settings window. You can set rules for specific ports, applications, network interfaces, protocols, and hosts. You can, for instance, block outgoing port-80 traffic for the IISINFO app from everything in the 192.168.x.x subnet of your network from 9:00 P.M. to 6:00 A.M. Setting up a rule takes almost no time and is highly intuitive.
As with Tiny Personal Firewall 3.0, we had difficulty getting the program to understand ICS, making it hard to share access. Also, the documentation doesn't have any step-by-step information for setting up the program with ICS. When we used the Sygate firewall with a Linksys hardware router, however, it worked correctly.
