This module controls all network (TCP/IP) traffic of the computer on which Kerio Personal Firewall is installed. Two types of rules can be defined for network communication:

Kerio Personal Firewall includes set of predefined network security rules (i.e. for DNS, DHCP, etc.). These rules are separated from user-defined rules and they can be enabled or disabled.

Whenever Kerio Personal Firewall detects traffic which does not meet any rule, user will be asked to permit or deny the communication. Optionally, a corresponding application or packet filter rule can be created automatically upon this decision.

The Behavior Blocking module controls running applications in the operating system. The following event types are controlled:

Like in case of network traffic, rules for individual applications can be defined. These rules either permit or deny the event, eventually they ask user. If a communication does not meet any rule, Kerio Personal Firewall automatically asks user to permit or deny running the application.

Note: Kerio Personal Firewall 4.x (unlike older versions) controls running of all applications, regardless of the fact whether they participate in network communication or not. When infected, the firewall is more reliable than any antivirus (if the virus is new and it is not included in a particular virus database, antivirus is not able to detect it — Kerio Personal Firewall detects replacement of the executable file and warns user).

The Network Intrusion Detection and Prevention System (NIPS) can distinguish, block and log known intrusion types. For this purpose Kerio Personal Firewall uses database of known intrusions. This database is updated regularly (updated database is included in new product versions).

Host intrusion detection and prevention system (HIPS — Host Intrusion Prevention System) detects attempts for misuse of running applications and processes to execute malicious code.

This module enables the following features:

Exceptions (specific settings) can be defined for trustful servers and for cases when filtering might cause malfunctions.

Kerio Personal Firewall's low-level driver protects the computer even when the firewall is not running (e.g. during the operation system reboot or during an installation of a new version of the firewall). This implies that the computer is protected all time it is available to external stations.

Use this button (or the option in the menu) to stop all traffic on the computer on which Kerio Personal Firewall is installed (so called network lock). This function may be very helpful especially when an undesirable or a queer network activity is detected — traffic can be restored when appropriate actions are taken.

Each firewall module creates an independent log which is stored into a text file. Logs can be viewed in Kerio Personal Firewall configuration dialog. Optionally, logs can be stored on a Syslog server.

The overview provides information on established connections and ports opened by individual applications. Information on current speed and size of transmitted data in both directions is also provided for active connections. The overview is refresh automatically in predefined time intervals.

Statistics inform user on number of objects blocked by the Web content filter and number of detected intrusions per a certain time period.

Kerio Personal Firewall performs regular checks for new versions. Whenever a new version is detected, download and installation is offered. Checks for new versions can be also performed by hand.