Security

Ask something
Discussion Locked

Best SW firewall around??

0 helpful
18 replies

by thebigbro1

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Greetings IT fellows!

I am going to learn about firewalls.
Can you recommend me a solid and respected SW firewall in IT industry to start with on Windows 2003 server. I want to download demo and install on SOHO network for testing purposes.

In other words : What sofwtare firewalls are popular today ?? Please advise

Thanks !

18 replies

by jbarchitect

It depends on what you want to protect. Are you looking for a software firewall to run on the same server you are trying to protect? (i.e. its job would be to protect the server, not the network.)

Or are you looking for software to turn a server into a perimeter firewall to protect the network?

by thebigbro1

I want to implement a complete firewall solution (just like on the real networks) to protect whole LAN - firewall would be installed on the server machine tho.

by jrice

ISA Server 2003 would be the software of choice. Its a big learn and the configuration can be a chore but it does provide a complete solution that integrates well with other windows products such as exchange server. Be warned its not cheap

by apotheon

If you're running a network with both clients and servers, and the primary server on the network is the one you're planning to use as a firewall, I'm afraid you're doing things all wrong. The firewall for an entire LAN should never be the same machine as the machine(s) you want to protect. There's a certain amount of leeway to be had in terms of possibly combining a router or gateway with a firewall, but combining your firewall and a file server is just begging for trouble. It's not The Right Thing To Do.

Depending on the network size, your best bet might be to buy something like a Linksys or SMC firewall/router appliance. Such a dedicated piece of hardware is simple to set up and configure, extremely reliable (generally), and not as expensive as a new mid- to high-performance computer to use as a router/firewall.

Of course, if all you want to do is run a firewall, you can do so with a computer so old that you'd consider throwing it away otherwise. Get an old Pentium 166MHz machine with two NICs and install something like IPCop on it, and you've got an extremely configurable, extremely secure firewall. Linux makes for some of the best firewalls in the world, and IPCop is a Linux distribution optimized to be easy to set up, configure, and maintain as a firewall.

In fact, many firewall/router appliances you can buy at stores like Circuit City, Fry's, and CompUSA actually run embedded Linux.

by thebigbro1

I am also learning ISA now but I want to implement 3rd party firewall just like in a real IT environment.

ISA server does not seem to be popular (not in places I used to work there :)

Or perhaps SW firewalls are not popular anymore as people prefer to install solid HW firewalls?

Thanks for suggestions!

by netspec

Hi

I found Kerio's firewalls quite good. Both the Server and Personal firewall are good and easy to implement, yet you have the possibility to implement fairly advanced features.

Kerio is found at www.kerio.com

by ou_peter

i think it's symantec.it's easy to define your configuration and achieve it's functions.

by markinios

Even for any beginner it?s quite easy to setup and configure. I have it installed in my LAN and OF COURSE in all pc?s (ONly five) because of its way to work is at a personal LEVEL. Just try it.

by dsc

It is good to search for one that suits your needs, but shareware is not the way to go for anthing more than just testing. I have tried several myself and I have found that Outpost Firewall & Tiny Firewall are about the best on the market. Tiny firewall probably number one. Yes, I believe they have a demo version you may try. But, as far as stateful protection goes they are the best. Yes, I've tryied Symentec's client security, and other from well known makers. Although some offer good features none are as detail as the two I mentioned.

by cg it

Misconception of what constitutes a Software Firewall and a hardware firewall. Personally, imo software firewalls should be categorized as consumer level/SOHO where the bugger is put on a computer directly connected to the internet [or like a consumer level router, has some form of port closing]. Windows XP firewall that is now a mandatory item with Service Pack 2 is a "software" firewall as well as Symantecs Norton Personall Firewall, or programs akin to these. Enterprise level firewalls on the other hand have far more configuration flexibility network level. Firewalls appliances like Cisco's PIX 501 a Symantec hardware firewall are examples but then you have to know how to configure it hense learning the software part of the hardware solution. ISA server is an Enterprise firewall software/hardware solution [if the admin is smart, they put ISA server on its own box]. It acts as a proxy server and a firewall. Works with Windows Based Active Directory for securing who can do what, when, where and with what workstation. Especially the newest version 2004 which can act as a perimeter firewall appliance/router/proxy for multiple network segments.

Security from the internet imo should be approached in a layered defense method. A perimeter defense: something that can close all ports until specifically opened; Network defense : allow/deny traffic at application, Network and data-link level; individual computer defense: allow deny workstation / user traffic.

Don't be fooled that a software firewall solution can be an Enterprise level solution. Enterprise level security solutions need to take in consideration multiple remote access users, site to site service level WAN communications, WAN connectivity fail-over, to mention just a few of a long list of enterprise WAN/LAN communications.

by apotheon

For enterprise level firewalls, I recommend getting to know ipchains functionality under Linux. Build a dedicated firewall using Linux -- there are already several firewall-specific distros out there, including the ever-popular (though somewhat entry-level, in dedicated hardware firewall terms) IPCop. There's also the strict and tiny Coyote Linux firewall, which runs from a floppy, and (better yet) a number of firewall distributions that run from a CD so that you have true non-writable security for your firewall's operating system and configuration files. That may well be the future of firewall technology, in fact.

by apotheon

By the way, ipchains can also be used to protect a desktop system, or even a server, in much the same way as a software firewall. The only real difference is that ipchains will generally do a better job.

by zaltech

I have a router connected to my cable modem which let's me close or redirect ports etc, and I use ZoneAlarm on all the systems on my SOHO.

I use AdAware and McAfee also for tracking of other malicious items.

This setup works extremely well for me as I rarely get any worms or viruses, and the biggest problem I have is people trying to break into and/or hijack my ftp or website.

by jdclyde

Here are two perfect processes to run on Linux instead of Windows.

There isn't a single best server platform our there and anyone who tells you differently has no idea what they are talking about and has just bought into all the hype.

This is one case when the Linux server can run on 1/3 the system and still be more secure than a windows server. Save the Windows licensing and processor power for feeding out windows based apps.

Another way to keep your data on the web site from getting modified is to burn it to CD and point your server at the CD as the home directory.

by jdclyde

When you are looking to protect your LAN from the outside, a dedicated hardware solution will be your best bet.

If you put software on a server, the exploits and weaknesses of the OS running the software will be the weakness of the firewall.

Also, this isn't taking away server resources as well so it doesn't impact LAN performance.

I have used SonicWall. It is easy to setup and administer.
Weak points with it is their AV they use and difficulty setting up VPN's in a mixed environment. But as a firewall it rocked, and all the worms that took the internet down over the last few years never got through it.

Checkpoint and firebox are also supose to be real good.

I would only use software firewalls on individual systems I am taking off my LAN (laptops).

Just my humble opinion. Good luck.

by apotheon

It's nice to see someone suggesting commercial products other than Symantec's miscarriage.

I actually find that the free version ZoneAlarm does a good enough job in instances where a software firewall is called-for, though. Those instances, on the other hand, consist only of one-computer setups using Windows as a basic desktop system. In any network setting, a separate firewall (or firewall/router/NAT device) is a definite must, as you've suggested.

by jdclyde

Remember that the free version, while very good, is for home / personal use only.

Illegal and unethical to use in a business without forking out for the "pro" versin.

I do run it on my personal PC's at home.

by apotheon

You're absolutely right: it is illegal to use ZoneAlarm's free edition in a business environment.

I disagree rather strongly about the suggestion that it's unethical, but I understand that my perspective on such matters is not commonly accepted. Since this thread isn't the proper forum for the topic, and I don't have the energy for a lengthy debate right now, I won't go into details. Suffice to say: I disagree.

This discussion is closed to new replies.