MAC or Firewall?

[Ross M. Greenberg]

I recently went wireless with a Netgear wifi interface. For a variety of
reasons I've disabled WEP and WPA security login and mean him to enabled MAC
blocking, allowing only the MACs on my three workstations. "un-blocked"
access to the router.

Do I still need a firewall? I'm running XP PRO SP2, but with restricted MAC
access nobody can access my router aside from my three workstations. As
such, I know I'm protected from "drive-by" types, what am I protected
without a firewall or do I still need a firewall? I know that the MAC-access
blocking protects me from "physical" bad guys, but is the MAC= access
control, combined with XP's SP2's firewall sufficient protection?

I recently upgraded to SP2 and dropped ZoneAlarm (ZoneAlarm added enough
overhead that it dropped my wireless speed by over 60%!)

Thanks!

Ross

 

[Robert Moir]

I recently went wireless with a Netgear wifi interface. For a
variety of reasons I've disabled WEP and WPA security login and mean
him to enabled MAC blocking, allowing only the MACs on my three
workstations. "un-blocked" access to the router.

Do I still need a firewall? I'm running XP PRO SP2, but with
restricted MAC access nobody can access my router aside from my three
workstations. As such, I know I'm protected from "drive-by" types,
what am I protected without a firewall or do I still need a firewall?
I know that the MAC-access blocking protects me from "physical" bad
guys, but is the MAC= access control, combined with XP's SP2's
firewall sufficient protection?

Ross, (not seen that name in a while, are you the Ross that I know?)
Firewalls and locking down the MAC addresses accepted by your access point
perform two different functions.

* The firewall will filter traffic coming into a system against your
chosen set of rules.

* MAC address filtering will stop unauthorised use of your access point
(it isn't regarded as a good method because its all too easy to 'spoof'
MAC addresses these days, but thats a whole other conversation).

I'd argue that you certainly want to keep a firewall running on your
computers in this scenario, because if malicious traffic *is* sent to one
of your computers you'd want to block it. As for how useful XP SP2's
firewall is, you'll get a lot of different opinions here, but for my
money, it's limited in what it does, but perfectly good at doing what it
claims to do. If the limits are acceptable to you then SP2's firewall
ought to be fine.

I'd also personally want to look again at locking down your wireless
connection with WPA, or at least WEP, as well as the MAC filtering.

--
--
Rob Moir, Microsoft MVP for Security
Blog Site - http://www.robertmoir.com
Virtual PC 2004 FAQ -
http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html
I'm always surprised at "professionals" who STILL have to be asked:
"Have you checked (event viewer / syslog)".