are all cable modems external?

You mentioned in another message that you're on Comcast. Note that the Zoom

If you want to go the zoom 5001 route like me, rather than external...

Here are some review links I've found:

If you're using windows, you can get a firewall like black ice or zone alarm, and have it filter traffic for all traffic on the modem. If you're using Linux you usually make (read: code in a script) a firewall based on iptables, assuming you have your kernel and sysctrl.conf configured correctly.

A firewall is not always a physical box between a computer and "the net", sometimes, in the case of internal modems, a firewall is configured in the software.

If you get one, please share your experiences.

Cheers, David

Jen wrote:

If you're running a software-based firewall on the same machine you're trying to protect, it's like locking the bedroom door while leaving the house's door to the outside unlocked. You may protect the stuff in the bedroom, but they've made it into the house.

While most people don't have systems that need real, heavy-duty firewalls, a software firewall is simply a joke. This is especially true when a NAT router will provide better protection for about the same, and sometimes lower cost than software firewalls.

Of course a "hardware" firewall is really a dedicated box running software. But you're taking that paragraph out of the context of the message. The context is that "software" firewall means software running on the same box it's trying to protect, and "hardware" firewall means a separate piece of hardware from the one being protected. Whether that separate box is a single purpose microprocessor, or a microprocessor controlled by special purpose software is not germane to the discussion. If you wish it to be, then put my comment back into the context that was clearly intended prior to your editing.

Any time you're running a software on the same box that you're trying to protect, you're letting the attackers in. The packets still go past the interface on the NIC, onto the bus used by the NIC (usually the PCI bus), and then has to get the attention of the software running on the same OS that is running other software. Depending on the OS and the software being run, there is a vulnerability that exists here that does not exist with a hardware firewall, even if that "hardware" firewall is simply a *nix box running the same firewall software.

As I said, a software firewall (running on the same box you're trying to protect) is like locking an interior door to protect your house. It makes more sense to keep people out of the house in the first place.

I think you'll find "hardware" firewalls are simply dedicated computers, running software, often Linux or Unix. Also, my firewall is an old PC, running Linux. Are you saying that IPTables on Linux is a joke?