Re: Linksys router as Firewall

From: Lars M. Hansen (badnews_at_hansenonline.net)
Date: 07/19/03 

Date: Sat, 19 Jul 2003 00:04:15 GMT

On Fri, 18 Jul 2003 14:52:25 GMT, Leythos spoketh

>firewall:
>1. A computer that (
>a) acts as an interface between two networks (e.g., the Internet and an
>private network, respectively), and

The BEFSR41 router does that.

>(b) regulates traffic between those networks for the purpose of
>protecting the internal network from electronic attacks originating from
>the external network.

The BEFSR41 router does that.

> The firewall is capable of handling the following
>tasks: (a) isolating internal and external traffic (a bridge service);

The BEFSR41 router does that.
 
>(b) making internal addresses invisible and directly unaccessible from
>outside and passing through authorized traffic after proper checking (a
>proxy service);

The BEFSR41 router does that.

>(c) facilitating protected (encrypted) connections to cooperative
>parties over public networks (a tunneling service);

The BEFVP41 and BEFSX41 does that.

>(d) filtering outgoing traffic for security and network usage rules
>(filtering or monitoring service);

The Linksys router does that.

>(e) filtering incoming traffic for rogue data (viruses, spam,
>inappropriate data (filtering), or improper actions (port scanning,
>overload prevention, etc.;

Virus scanning and spam filtering is not a function of a firewall.

The BEFSR41 router reports on some "improper actions" (port scanning),
and also protects internal clients from "overload".

>(f) blocking forbidden external services or addresses (blocking,
>"network nanny"-functions);

The BEFSX41 does have URL filtering, but not the BEFSR41

>(g) providing log-in services for authorized outside users and
>simulating the approved outside user as an inside user (proxy, log-in
>server);

None of the Linksys routers does this.

>(h) caching network traffic (cache service);

Caching service is not a feature of a firewall, although some may come
with it.

>(i) converting between different network protocols on different protocol
>levels (bridge when handling lower level protocols, gateway when
>handling higher level protocols);

Got me there...

>(j) traffic diverting (e.g., for cost optimizing, accounting, network
>planning, monitoring);

Nope.

>(k)providing consistent, open entry to the internal network (portal
>service) and facilitating public network address and connection sharing
>(proxy service).

The BEFSR41 does this.

>
>2. [A] system designed to defend against unauthorized access to or from
>a private network. Firewalls can be implemented in both hardware and
>software, or a combination of both. [INFOSEC-99] Synonyms front-end
>security filter, proxy.
>
>
>844-6193
>2117335486146
>
>

So, I guess even the simple little BEFSR41 router fits most of the
criteria for a firewall, doesn't it? Yet, it's hardly considered a
firewall by any standard ...

FWIW, the BEFSR41 is a barrier between a private and public network, and
it does a reasonably good job keeping the public network off the private
network, but not so good the other way around. The lack of granular
control of inbound/outbound connections are one of the biggest downside
to most of these small, cheap NAT routers...

Lars M. Hansen
http://www.hansenonline.net
(replace 'badnews' with 'news' in e-mail address)

Relevant Pages

  • RE: can ping but not browse
    ... I have stopped the firewall. ... # are safed from all (security) hazards. ... firewall/bastion host to the internet ... # internet and to an internal network, ...
    (Fedora)
  • Re: Using a Linksys router, should I also use Zonealarm?
    ... public internet to access corporate network. ... In the "old days" when people used to use Dial-In instead of VPN you ware ... protected by corporate Firewall -- since there was no public Internet ...
    (microsoft.public.security)
  • RE: Hidden Ports
    ... this is done by the firewalls to prevent authenticated files from being replaced by trojans and connecting to the internet. ... kerio firewall ... or a program that already had network access attempted to ... > Depending on the Access setting for a component, ZoneAlarm Pro ...
    (Security-Basics)
  • Re: Entire Network
    ... Internet access is different and just because a firewall isn't ... Second, if it isn't the firewall, then often it is a case of the system ... any way a network guru. ... > The network connection works just fine from both computers for internet ...
    (microsoft.public.windowsxp.basics)
  • Re: Using a Linksys router, should I also use Zonealarm? Internet Acceptable Use Policy
    ... my browser's access to the Internet is restricted. ... I thought it was the company's firewall extending a slap on my ... > public internet to access corporate network. ... > NAT is Network Address Translation. ...
    (microsoft.public.security)