too many firewalls?

SteviE · 2004-11-30T03:27:34+00:00

I have a dsl connection, with an 'always on' router running with NATenabled.I have installed on my PCs Zonealarm, 2 free editions and one runs thesecurity suite.I've lately been persuing the idea of a seperate firewall, rather thana (software) firewall on the PCs I'm trying to protect.To this end I've got myself an old P2 400 Mhz and stuck smoothwall onit. Its not yet in the system, need a switch etc.Assuming I manage to get this firewall up and running, between myswitch within my LAN and my router is there any point in continuing torun Zonealarm, other than for the virus protection?I'm assuming that the smoothwall is better because its a directbarrier in the connection.Any thoughts on this appreciated.

Nov 30, 2004 27 Replies

Rate this thread:

. 21 years ago

My 1/50 of a buck fwiw:

A software firewall is better than nothing at all. If all you have is a NAT-ing router, continue to use your software fw.

A dedicated firewall is definitely a preferrable option. While I think SmoothWall is a fine choice, I think a better choice would be a very minimal install of your favorite flavor of Linux.. no Xwindows, no webserver, nod DNS server etc... Just basic Linux with Netfilter (IPtables), routing and a couple of NIC's. There are plenty of good books/websites with all the info you would need to craft an iptables script that will effectively control and log your internet traffic in BOTH directions.. or if you can't quite grasp the syntax, there are plenty of people (including myself) that would be willing to throw together such a script, which you could modify for your specific environment.

As for AntiVirus protection, I'm not familiar with ZA's AV features, but whatever you choose to use, update your virus signature files frequently (ie- daily !!) At the corporate level, we are using McAfee's 8.0i product, which offers an improving level of application intelligence.. it can prevent and/or alert you to various types of egress traffic as well as perform some port filtering at the workstation level.... I'm not sure if this feature-set has found its way into thier consumer-level product line yet, but it certainly will. I'll stress again,,, what ever AV solution you use, UPDATE DAILY!

Best of luck,

Vote

CZ 21 years ago

only allow you to create 10-15 outbound rules. I'm yet to see one that has an implicit Deny any any/Deny all rule for outbound either

Netgear RT 314 "NAT-router" supports packet filtering rules on both LAN and WAN ports for control of both egress and ingress via: Protocol Destination address/port Source address/port (I use it to block some address spoofing)

Also, the RT314 supports logging

Vote

Leythos 21 years ago

Not true, most home users firewalls in your example might do that, but most business class firewalls don't. My WatchGuard appliances only allow DNS, HTTP, and HTTPS (if I remember correctly) outbound from the trusted network, and not from the DMZ, if you install them in routed mode. By default, without any user configuration, they won't pass traffic in any direction at all.

Most of the NAT boxes I've seen allow a "Private" IP and a "Private" Port range definition - with these you can specify IP or PORT ranges that can't leave the local network, but they are often limited to 10 or less ranges in the configuration - you could specify 0-65535 in one range if you wanted.

Vote