Re: to PFW or not to PFW

JIP wrote: 
Greetings

As a non-techie I am confused. Whilst lurking in this and related groups I see a debate that goes on as to whether there is any point in using PFWs, in particular to monitor outgoing traffic. Some say it's essential (as do most magazines, and of course all companies marketing such products) and others say that they are so easily circumvented that it's a waste of time - and if I understand correctly, some even say that they actually open up further vulnerabilities.

Get yourself a FW packet filtering router that meets the specs below in the link.

http://www.firewall-software.com/firewall_faqs/what_does_firewall_do.html

And you can get something like Walwatcher (free) and review the logs.


So, what may be a naive question - is there any point in using a PFW to at least stop badly written nasties from kiddy vandals who haven't learned yet how to do it properly?

I use a personal FW on the laptop while on the road and it's supplemented by IPsec. I have a PFW that doesn't have the snake-oil crap in it and turn off the one snake-oil crap that it does have in it -- Application Control.

For the laptop on the road, I go where I am supposed to go and that's to the O/S and close holes and shutdown services I don't need.

While at home and the machines are sitting behind the FW appliance, I don't use any PFW(s) on the machines, which would be the same if I was using a packet filtering FW router that could stop inbound and outbound.

http://labmice.techtarget.com/articles/winxpsecuritychecklist.htm

The key to me is using common sense and not clicking on unknown links at websites or in emails, don't accept unknown emails don't let them reach the machine, secure the O/S as much as possible, go look for yourself as to what's running or happening on the machine by using tools like Process Explorer, Active Ports, and review router or FW appliance logs for dubious connections to remote WAN IP(s).


If the NAT router couldn't stop outbound, the I would a PFW to supplement it. The rest of the snake-oil crap is PFW(s) is basically worthless IMHO and can be defeated so don't lean on it like a crutch.

Duane :)







.

Relevant Pages

  • Re: Do I have enough or a (or the right) firewall?
    ... >> If you don't have any problems with malware, ... >> Linksys router so you can review inbound and outbound connections. ... >> malware reaching the machines due to IE, ... >> FW and you won't need a PFW solution on each machine. ...
    (comp.security.firewalls)
  • Re: Networking problem
    ... now for the router configuration. ... Run/open the routers web based configuration. ... Shut down all of the machines. ... >>> I finally got it to the point that from the desktop i can ping the ip ...
    (microsoft.public.windowsxp.general)
  • RE: wirless connection security issues
    ... wrt54gl only has a single port for the incoming network. ... I would set up the router to use the Class C private IP range ... for your machines. ... Subject: wirless connection security issues ...
    (Security-Basics)
  • Re: TCP 3389 and Remote Desktop
    ... conflict using a Linksys wireless router for a peer to peer network ... provided instructions for changing the remote port using RegEdit, ... firewall you utilize on said computer *and* have Remote Desktop turned on ... One method of accessing several machines behind a single router is to change ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: I cant understand Windows Explorer
    ... see offline computers to be left 'visible' in 'Network Places' either. ... I think that being able to see machines that are shut ... static addresses or on their lease duration from the router. ...
    (microsoft.public.windowsxp.general)