Router firewall vs Software firewall

peejay · #1 (**permalink**) 09-26-2004, 09:45 PM

With the router firewall enabled, do I still need a software firewall ie Zonealarm and if so, any suggestions on improvements to Zonealarm?
Running a wireless LAN by the way.

Thanks.

puddingpimp · #2 (**permalink**) 09-26-2004, 09:58 PM

Windows Firewalls provide next to no security anyway read the frontpage article, besides most routers setup correctly will provide sufficient security, the only way to keep your windows machine completely secure is to turn it off/ unplug it from the network forever.

Trvln Nalzmn · #3 (**permalink**) 09-27-2004, 10:04 AM

The inbuilt Windows XP firewall is very good and I have heard good things about zonealarm.

Skink · #4 (**permalink**) 09-27-2004, 11:39 PM

according to the chat on PDC++ last night, there are some severe holes, including those covered by the cover-story, in the SP2 firewall.. Zonealarm is impervious to worm attacks, afaik.

whetu · #5 (**permalink**) 09-28-2004, 03:13 AM

Quote:

Some firewalls are software firewalls. They reside on the machine that is connected to the Internet, and act as a filter for information going in and out. The major drawback to a software firewall is that they have already connected to your box. It is like the difference between locking your front door, and locking your jewellery box. Both are meant to keep your jewels
safe, but one is obviously more effective.
A hardware firewall (like a machine running SmoothWall) is between your network and the Internet. It forces anyone who wants to break in to have to go through an extra machine. The more work you make them do, the less likely they are going to want to spend the time on you. After all, the person down the street isn't protected at all. They are an easier target.

Quote:

"The main difference is a hardware firewall is a separate hardware unit that blocks attempts before they enter the system/network and a software firewall sits in the back of a system and reacts when an attempt has been made. A software firewall is no match for a hardware appliance's performance."

Plus software firewalls are messy and waste resources.. get an external box doing dedicated security tasks IMO

Trvln Nalzmn · #6 (**permalink**) 09-28-2004, 10:41 AM

An external box is a pain in the arse to config and monitor. I can just tick a couple of boxes on my machine and voila! I don't bother to though because I do NAT on my DSL router.

An external box also won't pickup backdoors and spyware but niether will ICF. Zonealarm is good at that.

whetu · #7 (**permalink**) 09-29-2004, 03:57 AM

a good external box should be designed to be set and forget, anyone with a linux/bsd based firewall appliance can attest to that

Mine takes 15-20 minutes to install and configure, and I only have to remote into it on occasion to check up on it. The average amount of time spent remotely accessing is about 3 minutes a fortnight, just to check the logs for attack patterns and make sure it's all updated..

As for backdoors - all non-requested incoming traffic is blocked, very simple
spyware - Again, properly configured an external box will deal to most spyware, and spybot can deal with the rest

And by the way, NAT isnt an entirely effective layer of security, so dont depend on it

Trvln Nalzmn · #8 (**permalink**) 09-30-2004, 06:13 AM

I'm not an expert on spyware but if I programed some I'd initiate a connection from the machine I'm spying on. I'd also make the request look like a perfectly normal web request (or whatever) so that any firewall in the way would not be able to tell.

A fair amount of time has past since Telecom rolled out DSL in NZ and NAT has proven itself to be a very effect layer of security.

whetu · #9 (**permalink**) 10-01-2004, 12:55 AM

Broken record...

properly configured an external box will deal to most spyware, and spybot can deal with the rest

Nil_Einne · #10 (**permalink**) 10-04-2004, 06:04 AM

Ideally, for a Windows computer you would want an external firewall (using the term losely here, a decent Linux or *BSD box will do) and a personal firewall. Stay away from the latest version (v5) of ZoneAlarm, causes no end of problems (does things it shouldn't, even when disabled) from what I've heard. Personally, I would stay away from ZoneAlarm all together and get something better like Kerio but it's up to you.

SP2 firewall is okay but there are a few issues and more importantly in my opinion since it's Microsoft and the Windows default, regardless of whether it has more security flaws or not, they are more likely to be found and more likely to be exploited when found.

As I said, ideally for a Windows comp, you would want an external firewall and a personal firewall. However, if you have to choose between them, I would choose a personal firewall. But make sure you keep it up to date!

Ragnor · #11 (**permalink**) 10-04-2004, 09:15 AM

I find it depends who is using the computer. For less geeky family and friends I never rely on just NAT or a gateway / firewall / proxy. It always pays to install say the free copy of Zone Alarm on their PC's. Sure it chews a bit of memory but it's an excellent tool and very easy for joe six pack to use. The amount of headaches is saves is well worth it.

On my own machine I just rely on NAT and smoothwall (linux firewall / gateway) and use my jedi like geek sense.

:P

Trvln Nalzmn · #12 (**permalink**) 10-04-2004, 10:55 AM

What are the issues with Windows ICF?

Warwaste · #13 (**permalink**) 10-26-2004, 02:53 AM

IF you know/like command line I would use a Linux box for the security of the system.

ELSE IF you have a family environment I would stick with Windows and its GUI.

As for the firewall software to uses, I wouldnt just stick with the SP2 udate to windows firewall. I still cant block the ICMP (ping) from my computer using SP2 but with Norton I can atleast limit which computers I will allow an echo to.

SP2 firewall does have some advantages in that the user can now allow or stop certain replys on the network. It also has a log that can be enabled to monitor network traffic on different ports(not that I use it).

As for public knowledge and teaching of the product, microsofts help files are not to detail by what I have found(unless someone has found good documentation on how to use it?).

Any way thats just my opinion.