Software Firewalls

Personally I don't bother with software firewalls. They may be useful for people directly connected to the internet, but if you're through at least a router you should be fine without one (unless all ports are forwarded to your computer, of course).

I do own a hardware router/firewall, so all my needs are taken care of there. As for trojans, I'm careful about what I open even though I do have virus protection. Yes, a good AV program will most likely catch anything you get, but some due diligence doesn't hurt and makes the probability of a virus sneaking through near 0.

My opinion is that if you have a program running that will allow someone to connect to your computer and take control of it, it would be a better idea to not have that program running instead of hiding it behind a firewall.

Quote:

(unless all ports are forwarded to your computer, of course).

I don't know to much about this stuff, how would I go about checking that this is not the case?

One issue with software firewalls is that they generally fail open. (In other words, if the firewall fails, anything can get through.)

I prefer firewalls that fail closed. That way you know when the thing isn't working.


Being behind a router, by itself, is not going to help much. If you are talking about a DSL or other broadband router, they generally also have NAT/PAT/DMZ support and built-in firewalls.

frob.

I actually replaced my router (with hw firewall) with a linux server that uses iptables/iproute instead, and I'll never go back. So much more configurable.

If you're paranoid, then a software firewall in addition to a hardware firewall is kinda nice. Most software firewalls will tell you when a certain piece of software is trying to initiate a connection to the intarweb and gives you the option to allow or block the software. Other than that, they're sorta useless.

On the other hand, software firewalls as your only firewall (ISA Server, Monowall, IPCop, etc) is really the way to go as long as you are capable of setting it up. They are infinitely better at what they do and the level of configurability is unparalleled.

When I refer to a 'hardware' firewall solution, I was referring to any middlebox and not necessarily the little box that comes with a broadband starter kit.

I think of a software firewall as something like Windows Firewall, or Symantic's Internet 'We-load-150-MB-of-crap-so-you-can't-access-bad-sites' Security programs.

The software firewall will fail open. Even if you properly configure it, your 12-year-old nephew will come in and fubar the whole thing so they can play their fancy new web game. Disable the firewall and you have unlimited Internet access. Most programs don't notice, unless you start getting Windows XP security warnings -- which can be shut off.


A middlebox, be it a NAT DSL modem, a linux box running IP Masquarading and firewalling, or a DMZ border network, will fail closed. If for some reason your firewall goes down, the whole network knows about it and complain. You can configure it as little or as much as you want to. You can replace it with a more complex or more simple solution and nobody on your network will care.

I prefer the second solution.