firewall behind router

[Lou]

Is there a need for a firewall behind a router. My home network is
configured with private addresses (i.e. 192.168.x.x). The router ip
address which connects to the internet via cable modem is also private
(192.168.0.142).

Reason for question is I seem to recall private addresses are not
accessible from the internet.

Lou

 

[Lanwench [MVP - Exchange]]

NAT "acts as a firewall" but isn't a firewall. Either put in a decent SPI
firewall (such as a NetGear FR114P) or install firewall software on all
clients and allow the local subnet free access if you need file/printer
sharing.

 

[Lou]

Thanks for reply.

FYI. I do have file/printer sharing activated and use it on all my lan
computers. On one of my lan computers I am running XP Home with SP2
installed and the Windows firewall activated.. The others lan
computers run Windows 98 with no firewall. All have an active
anitvirus program activated. All run behind the router with private
addresses for all IP addresses. I do not need protection between my
lan computers. I have no problems connecting to internet from any
computer nor between lan computers.

What does NAT "acts as a firewall" but isn't a firewall mean in terms
of exposure to problems relative to unsolicited activity from internet
sites?

I do understand that Windows firewall provides protection for incoming
but not outgoing net traffic.

Thanks again.

Lou

 

[Chuck]

Is there a need for a firewall behind a router. My home network is
configured with private addresses (i.e. 192.168.x.x). The router ip
address which connects to the internet via cable modem is also private
(192.168.0.142).

Reason for question is I seem to recall private addresses are not
accessible from the internet.

Lou

Lou,

A NAT router is the first layer in a good layered defense. Each layer is
necessary because no layer produces complete protection.

A NAT router "acts as a firewall" in that it passes only requested traffic back
to the computer that requested it. It won't selectively filter traffic from
hostile addresses, nor selectively filter bad protocols or programs, however.

See <http://www.firewall-software.com/firewall_faqs/what_is_a_firewall.html>

One NAT router protects your entire LAN.

The second layer is a software firewall, or a port monitor like Port Explorer
(free) from <http://www.diamondcs.com.au/portexplorer/index.php?page=home>. See
various discussions in comp.security.firewall for good advice on choosing a
firewall. A software firewall can selectively block incoming or outgoing
traffic, and a port monitor can at least let you know that it's going on.

You need a software firewall on each computer in your LAN, in case one gets
infected a software firewall on the others could save you.

The third layer is good software, also on each computer. This layer has
multiple components.

AntiVirus protection. Realtime, plus a regularly scheduled virus scan.
Regularly updated. AV protection is not all that's needed today.

Adware / spyware protection. Realtime, plus a regularly run adware / spyware
scan. Regularly updated.
Complete instructions, using Spybot S&D and HijackThis (both free) are here:
<http://forums.spywareinfo.com/index.php?showtopic=227>.

Harden your browser. There are various websites which will check for
vulnerabilities, here are three which I use.
http://www.jasons-toolbox.com/BrowserSecurity/
http://bcheck.scanit.be/bcheck/
https://testzone.secunia.com/browser_checker/

Block Internet Explorer ActiveX scripting from hostile websites (Restricted
Zone).
<https://netfiles.uiuc.edu/ehowes/www/main.htm> (IE-SpyAd)

Block known dangerous scripts from installing.
<http://www.javacoolsoftware.com/spywareblaster.html>

Block known spyware from installing.
<http://www.javacoolsoftware.com/spywareguard.html>

Make sure that the spyware detection / protection products that you use are
reliable:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Harden your operating system. Check at least monthly for security updates.
http://windowsupdate.microsoft.com/

Block possibly dangerous websites with a Hosts file. Three Hosts file sources I
use:
http://www.accs-net.com/hosts/get_hosts.html
http://www.mvps.org/winhelp2002/hosts.htm
(The third is included, and updated, with Spybot (see above)).

Maintain your Hosts file (merge / eliminate duplicate entries) with:
eDexter <http://www.accs-net.com/hosts/get_hosts.html>
Hostess <http://accs-net.com/hostess/>

Secure your operating system, and applications. Don't use, or leave activated,
any accounts with names or passwords with trivial (guessable) values. Don't use
an account with administrative authority, except when you're intentionally doing
administrative tasks.

The fourth layer is common sense. Yours. Don't install software based upon
advice from unknown sources. Don't install free software, without researching
it carefully. Don't open email unless you know who it's from, and how and why
it was sent.

The fifth layer is education. Know what the risks are. Stay informed. Read
Usenet, and various web pages that discuss security problems. Check the logs
from the other layers regularly, look for things that don't belong, and take
action when necessary.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Lanwench [MVP - Exchange]]

Thanks for reply.

FYI. I do have file/printer sharing activated and use it on all my lan
computers. On one of my lan computers I am running XP Home with SP2
installed and the Windows firewall activated.. The others lan
computers run Windows 98 with no firewall. All have an active
anitvirus program activated. All run behind the router with private
addresses for all IP addresses. I do not need protection between my
lan computers.

Then you probably don't need the windows firewall enabled. But I do suggest
you put a firewall in place between your internet router & your LAN.

I have no problems connecting to internet from any
computer nor between lan computers.

What does NAT "acts as a firewall" but isn't a firewall mean in terms
of exposure to problems relative to unsolicited activity from internet
sites?

NAT is network address translation. It doesn't inspect packets. See
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci212125,00.html
for one definition of what a firewall is....

I do understand that Windows firewall provides protection for incoming
but not outgoing net traffic.

Yep....if you get a hardware firewall, you can set it up to allow only those
outbound ports you wish (80, 443, 110, 25) as well as blocking all inbound
ports, and no computer will receive pesky popup notifications like "do you
want to allow X to access the Internet?". Of course, a firewall is not a
panacea, and should be only one part of your security strategy. Keeping all
computers patched to the gills with the latest critical updates and perhaps
upgrading the 9x PCs to XP as well would be a good step....as well as
keeping all antivirus software updated.

 

[Steve Winograd [MVP]]

Is there a need for a firewall behind a router. My home network is
configured with private addresses (i.e. 192.168.x.x). The router ip
address which connects to the internet via cable modem is also private
(192.168.0.142).

Reason for question is I seem to recall private addresses are not
accessible from the internet.

Lou

On computers running any version of Windows before XP Service Pack 2,
I don't recommend running a firewall behind a typical broadband NAT
router. In my opinion, the difficulty of configuring a firewall to
allow access by other LAN computers outweighs any benefit.

On computers running XP Service Pack 2, I recommend running the new
Windows Firewall, with exceptions for File and Printer Sharing and for
whatever other programs and services (e.g. Remote Desktop, VNC) that
you use on the local area network.

I'm not a fan of firewalls that block undesired outgoing traffic to
the Internet, but some people are.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Lou]

On computers running any version of Windows before XP Service Pack 2,
I don't recommend running a firewall behind a typical broadband NAT
router. In my opinion, the difficulty of configuring a firewall to
allow access by other LAN computers outweighs any benefit.

On computers running XP Service Pack 2, I recommend running the new
Windows Firewall, with exceptions for File and Printer Sharing and for
whatever other programs and services (e.g. Remote Desktop, VNC) that
you use on the local area network.

I'm not a fan of firewalls that block undesired outgoing traffic to
the Internet, but some people are.

Steve, thanks for the reply.

Based on what I know and your response I have decided not to run the
firewall.

My lan is for home use only; immediate family members. I am the only
one who installs applications or does any configuration; the family
members merely use their computer. Use includes surfing the net and
email with well understood rules about not downloading anything nor
opening any attachments without my permission.

I am not concerned with security within the lan for the above
mentioned reasons.

I am not concerned with blocking undesired outgoing traffic. I do use
Adaware and sysbot occasionally to check the systems. I've found
tracking cookies but never any spyware.

My only concern is unsolicited access to the lan from unscrupulous
folks on the internet. The broadband NAT appears to offer the same
security as a firewall negating the need for the XP firewall.

If you see a flaw in my thinking, let me know.

Again, thanks for the help.

Lou

 

[Steve Winograd [MVP]]

Steve, thanks for the reply.

Based on what I know and your response I have decided not to run the
firewall.

My lan is for home use only; immediate family members. I am the only
one who installs applications or does any configuration; the family
members merely use their computer. Use includes surfing the net and
email with well understood rules about not downloading anything nor
opening any attachments without my permission.

I am not concerned with security within the lan for the above
mentioned reasons.

I am not concerned with blocking undesired outgoing traffic. I do use
Adaware and sysbot occasionally to check the systems. I've found
tracking cookies but never any spyware.

My only concern is unsolicited access to the lan from unscrupulous
folks on the internet. The broadband NAT appears to offer the same
security as a firewall negating the need for the XP firewall.

If you see a flaw in my thinking, let me know.

Again, thanks for the help.

Lou

You're welcome, Lou. If the other family members are as knowledgeable
and cautious as you are, all should be well.

However, we all make mistakes, so I'd be sure to run an antivirus
program on each computer and to update it with the latest virus
definitions every day. I'd install Service Pack 2 on all of the XP
computers.

You could have Windows enforce the prohibitions on installing programs
by giving other family members limited user accounts.

I run Windows Firewall on all of my family's XP computers. I see no
disadvantage to it, and I see a big advantage: blocking undesired
traffic that originates on the LAN. If a computer gets infected with
something like the Blaster worm, Windows Firewall will keep it from
spreading to the other computers. A NAT router on the edge of the
network can't do that.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Lou]

You're welcome, Lou. If the other family members are as knowledgeable
and cautious as you are, all should be well.

However, we all make mistakes, so I'd be sure to run an antivirus
program on each computer and to update it with the latest virus
definitions every day. I'd install Service Pack 2 on all of the XP
computers.

You could have Windows enforce the prohibitions on installing programs
by giving other family members limited user accounts.

I run Windows Firewall on all of my family's XP computers. I see no
disadvantage to it, and I see a big advantage: blocking undesired
traffic that originates on the LAN. If a computer gets infected with
something like the Blaster worm, Windows Firewall will keep it from
spreading to the other computers. A NAT router on the edge of the
network can't do that.

Steve,

Points well taken and understood.

Thanks again. Till next time.....

Lou

 

[Lou]

You're welcome, Lou. If the other family members are as knowledgeable
and cautious as you are, all should be well.

However, we all make mistakes, so I'd be sure to run an antivirus
program on each computer and to update it with the latest virus
definitions every day. I'd install Service Pack 2 on all of the XP
computers.

You could have Windows enforce the prohibitions on installing programs
by giving other family members limited user accounts.

I run Windows Firewall on all of my family's XP computers. I see no
disadvantage to it, and I see a big advantage: blocking undesired
traffic that originates on the LAN. If a computer gets infected with
something like the Blaster worm, Windows Firewall will keep it from
spreading to the other computers. A NAT router on the edge of the
network can't do that.

Points well taken. XP SP2 firewall activated.

Till next time.

Lou