Firewall for Laptop

ZoneAlarm is no firewall, it's a pretty lousy host-based packet filter.

Single-User or not Windows XP: Win-IPFW

XP: Windows Firewall

Why not using the Windows-Firewall?

Yours, VB.

Linksys has come out with a portable single node router for laptops, consider it, since you would not have to worry about unsolicited inbound connections, which is much of the problem.

Recommending several options you can choose from:

Take some energizer.

Don't follow their usage.

Don't glance back at the screen.

don't be on the road.

start "wanting" it.

don't be in quiet rooms.

control your irritation. take some yoga classes.

if you have xp, use windows firewall.

if you don't have xp, use some older version of zonealarm. say,

4.5 or earlier.

Much appreciated V S Rawat. haha. I guess I just never had much confidence in the Windows XP firewall. Im an advanced user, so it wasnt an issue of not understanding the interface, I just didn't feel Windows firewall built into XP was up to par with the rest. Guess I was wrong. I would live to switch to linux, but several programs which I rely on are Windows only programs, and win4lin has given me issues in the past. Thanks much for the posts, windows firewall is officially enabled and zonealarm is kaput.

If you're not trusting in Microsoft software, you're not trusting in Windows. No "Personal Firewall" can control Windows' kernel. Think about it.

Probably.

Yours, VB.

You can supplement XP's FW with IPsec like I do with BalckIce on my laptop while I am on the road.

I just implemented the AnalogX rules and made some slight modifications.

Duane :)

Interesting Idea of yours, but I've seen SOFT-PLC applications that load before windows kernel and will continue to process logic after a BSOD... Seems that it can be done, even if some don't do it.

So what? This is still just following the assumption that the kernel is not evil.

It's just that you can try, being successful is another question.

Hmmm, I've never seen my monitor spin around in circles, never seen my laptop puke green pea soup, etc... Nothing evil in there as far as I can see.

I've used Windows, Linux, AIX, CPM, and several other OS's, and I've not seen anything that makes Windows worse than the others - each has a place and target.

Strange thing is that while it's easy to compromise a Windows machine because users remain ignorant, the same is true of Linux and Unix machines - ignorance and stupidity will always do a machine in.

I've used many different personal firewall solutions on my laptops over the years, and I've never found them to break anything or to allow access to my laptops that I didn't permit. I've also installed them on home-users computers, where they run as a "user", and found that after more than a year, that they have not been compromised, not had any more malware than people protected by other means, etc....

Yes, I do not like PFW solutions for the common person, as the common person has no clue and no interest in learning about the alert or what it means before the blindly kick PERMIT.

Given a user with a computer, on dial-up, I would rather they have a PFW solution than just using Windows firewall.

Given a user without a NAT Router, on broadband I would rather they have a PFW than just Windows Firewall.

Given a user with some sense of security, I would rather than utilize a NAT device instead of Windows firewall or a PFW solution.

You have a strange understanding of evil software.

You don't want to get the point: If you mistrust Windows in general, then you also need to mistrust the kernel and then nothing can stop the kernel from doing something it intends. I do trust the NT kernel, well at least with drmk.sys and drmkaud.sys stripped.

You never took a closer look, eh?

So you really didn't do any serious auditing.

And I did the same without a PFW. Your point being?

Why?

Why? And what's the matter with the NAT Router?

Hm... any idea for a serious non-selfbuild NAT device for less than $150?

You can check at

- they provide most vendors NAT Routers.

I'm not sure what a "serious" non-selfbuild NAT device is defined as - please provide a little more detail on what you're asking.

- doesn't impose any heuristic for packet forwarding, including Application Layer Protocol fuckups

- has a packet filter that allows specification of TCP and NAT states, has more than 30 rules and isn't vulnerable to common TCP/IP problems

Just the first argument disqualifies almost any low- and medium-cost NAT router. So far the only known exception is a Linksys WRT54*-series with an alternative firmware, but this is already considered as self-build.

Depending on what you call "Rules", the BEFSX41 unit, the BEFVP41 unit and the Netgear FVS318 along with several others by Netgear/D-Link are under $150. I would rather see people use a firewall, but those are the NAT Routers I would use if cost was an issue.

accept tcp,udp from $dnsserver to me 53 related,etablished keep-state deny tcp from any to me 1-1023 setup deny tcp from any to not me,$broadcast,$localbroadcast in via eth1

Almost no low- or medium-cost router and no PFW allows me just to reference TCP states. And this is a very simple and necessary requirement for almost any usable ruleset.

Why? A NAT router is no serious security measure, if any at all.

At the router level, I can allow DNS outbound while blocking 1-1023 from the network, and depending on the router, I can block it from specific machines while allowing from others.

Even the Linksys BEFSR41 will allow users to block outbound TCP or UDP from inside the network outbound to the WAN - I always block 135~139,

445, 1433, 1434 and several others in all home settings.

Because a NAT Router will allow them to go online before the have all their patches, before their firewall (if used) is properly configured, before they do anything that might protect them, and get their patches, updates, av updates, security updates....

My mother-in-law is a perfect example - her son (about 40) setup her Road Runner on her new Dell system - directly connected to the Internet, and in under 4 hours the machine was compromised.

When I installed a NAT Router, wiped/reinstalled the system, then finished configuring the system, security, etc... It's been two years now and she's still using the same system, no malware, no problems, etc...

NAT, by it's nature, in these home routers, provides a great level of protection from unsolicited sources. This means that should another exploit be found in the OS or firewall, that it's very likely that the public will never reach the computer behind the NAT to take advantage of it.

Works for Windows 2000 and later.

What do you have against 136?

Hello? It's trivial to get an empty netstat output even on Windows without breaking anything.

Anyway, it's luck. NAT Routers are kinda trivial to circumvent.

You'd wish.

But it allows any user to modify the ruleset, so it doesn't qualify for a multi-user environment.

So far, this one is the least dangerous and working alternative I know.