Security

Ask something
Discussion Locked

Do I need a firewall?

0 helpful
38 replies

by jardinier

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Some years ago I learnt the hard way of the necessity of anti-virus software. Now I am hearing a lot about Firewalls.
I would appreciate any suggestions as to whether a firewall is now considered essential on a home computer not connected to any network.
If the answere is "yes," then any suggestions for a good value-for-money program would also be greatly appreciated.
By "value for money" of course I mean cheap cost, but does a satisfactory job.
Also, is it necessary to have a very recent version of the product?

38 replies

by thechas

As to the 'need' for a firewall on a home PC, it mainly depends on how you connect to the internet, and how you use the internet.

If you have a broadband connection, you need a firewall.

If you have dial-up, a firewall is not necessary, but may be a good idea.

If you are connected for long periods of time, with a static IP address, then you should install a firewall.

There is a very good (but hard to configure) free firewall.
Zone Alarm from Zone Labs www.zonelabs.com
will take care of all your personal firewall needs.

You can test a firewall, and find firewall reviews at

http://grc.com/lt/leaktest.htm

Chas

by oldefar

Chas has provided some excellent advice. I would only add that anyone happy with a Volvo 4-banger will likely want to go with a firewall, and perhaps a DMZ regardless of connection type. Just as a safety thing, you understand. :-)

by jardinier

Sorry to learn that such an intelligent person is weighed down with anti-Volvo garbage. I bought my Volvo because I got it at a bargain price from a deceased estate. And you might try owning one for six months or so before you dismiss them so off-handedly.
I really would have expected better from you Oldefar.

by jardinier

Yesterday I purchased a computer magazine which compared various firewalls. Norton, Kerio and Zone Alarm Pro each scored 4/5.
However the free downloadable version of Zone Alarm scored 3/5, which was noticeably better than some commercial versions.So I guess this may be the way for me to go.

by cactus pete

I think you should have considered it a ribbing, not bare sarcasm. At least, that's how I took it...

by jardinier

Hi. The Duck has already clarified me on this matter in another posting. Your advice is greatly appreciated. Gradually I am learning the ground rules of techrepublic discussions.
But as smart-arsed repartee (AKA dreadful puns)is a way of life for me, you may just have opened a can of worms by inviting me to contribute my humour.

by lordinfidel

While I will agree that having some sort of firewall is better then having no firewall at all.

The beef I have with personal firewalls is that they will not stop someone who has targeted your machine.

I say that because although you have a personal firewall installed on your machine, does not protect you from the underlying OS.

I treat personal firewalls the same way I do virus protection software. It is necessary, but I don't rely on it for protection.

Personal firewalls can easily be circumvented.

The other problem is that most people will set up the personal firewall to do the "intelligent" filtering. Basically allowing anything outbound. This does no good when dealing with trojans that make outbound connections on their own.

So my advice is, yes get a personal firewall. But don't rest thinking you are 100% protected, because your not.

There is a reason why firewalls are their own bastion hosts that do nothing but filter traffic in both directions.

by cactus pete

That's why some complexity must be involved with a decent firewall.

To cover that aspect, I believe [it's been a while since I've used it] ZoneAlarm requires you to first 'OK' a new [or changed] outbound application.

If for nothing else, usinga personal firewall like this should get you more familiar with what is going on in your computer.

by dcosgrove

One of the banes of my existance is the less experienced home user with mild paranoia. I have several customers who insist on using 2 or more antivirus programs and zone alarm. Yet they have to open ports for LimeWire, Kazaa, Morpheus and any other file sharing / chat program you can think of. I have recently had my first experience with loss of information. I have yet to track the exact cause of the loss, but I doubt a firewall would have helped. I think, as with anything, diligence is the key. Most of the vulnerabilities are invited in, bonzai buddy, gator et al. I actually had a customer get upset becaus I disabled gator and offer companion, yes, they had Zone Alarm. Go figure.

by oldefar

Experts in social behavior have noted that a large amount of communication (80% ?) is non-verbal. Of course, in this forum we miss the non-verbal piece.

No sarcasm was intended, only acknowledgement that your postings have been read in other discussions and associated with you as an individual. Had my intent been to disagree with your position on Volvo I would have done so in that discussion.

I do apologize for the misundertanding.

by jardinier

Hi there Oldefar.
The Duck has kindly explained to me that the anti-Volvo postings were just ribbings. So it is probably I who should apologise to you.
I am gradually learning the ground rules for techrepublic discussions.
But could you do something about your alias? How can any reasonable person look at "Oldefar" without automatically reading "Old Fart?" (Just kidding, of course).

by oldefar

I didn't recognize half the alternatives to "cool" posted by the GuruOfDos, so I probably qualify by that alone.

And I have been in this industry longer than many of the posters have been alive.

:-)

by madroxxx

If you have dial up it is a good idea but not as critical becuase you are a moving target of sorts.

If you have any kind of always on internet connection then the answer is YES YES YES you NEED a firewall. In this case I recomend a device like the lynksys router firewall. For about $70 you can get a device that sits between you and the internet rather than on your machine. It also does NAT which makes you harder to hack.

by mrafrohead

Alright, first. Park yer tank and lets talk;)

Muwahahaha, just kidding. I just couldn't resist the Volvo crack ;) It just seemed fitting. But so ya know, I actually like the cars, I just can't afford one yet:p

Newho - back to reality.Firewall, yes you should still have one. It's not as important as you're on Dial-Up. But then again, it wouldn't hurt. Personally, I recommend getting Norton Internet Security 2003. I use that and it is pretty nice. Very customizable. I have used probably ten different types from different companies and I found Norton to be the nicest.

Although it does cost money. If you go to ZoneAlarm, they have one for free. As does Sygate and even Tiny Personal Firewall.

In all honesty, unlessyou see yourself going to broadband or an always on connection any time soon, I would probably abstain from a hardware setup as I think it will be more of a hassle for you, than anything. Hardware is the best, but at the same time, you are on a dial up connection and your IP changes each time you log on. That makes you a hard target to stick with. So software should be more than adequate.

Just remember this. Where there's a will there's a way. So if you get your setup, which personally I recommend, you still can get hacked. It's just that the odds of it happening are quite a bit smaller.

Mrafrohead

by guruofdos

I just upgraded to an ADSL connection from Dial-Up, and my provider almost insisted on me installing a firewall. I had a copy of Norton Personal Firewall on a cd that came with a new mobo, so ran it up the flagpole to see who saluted!

With 'always on' connections, you visibility on the internet increases dramatically, not only because you are on-line permanently, but your IP address becomes static for the duration of your connection, so rather than a moving target, you become a 'sitting duck' for anyone happening to be sat there pinging IP's at random. Of course, trojan horse virii sit transmitting away on your computer and hackers sit listening to these transmissions to find backdoors into your computer.

Apps like WinMX, ICQ, AIM and Yahoo Messenger all open up ports in TCP/IP and known ports can be attacked by hackers. It doesn't take much programming to write software to randomly ping IP addresses, and note what's open and what's vulnerable.

Using ADSL, my wife connects via 100baseT to my PC and runs AOL over the top of my connection. In the space of under an hour, we had 1254 privacy warnings and 13421 attempted accesses to our 'private network'.

I'm convinced!

by guruofdos

Sling her alongside me Peugeot mate! The 345 was a god-awful car and a delicacy for tin-worms, but most UK police forces use Volvos (850-T5's mostly!) for traffic cars because they are reliable, robust, handle extremely well at speeds in excess of 120mph and if ya hit a 'roo doing 95, you stand a bloody good chance of walking away with nothing more than a few bloodstains on the front bumper :-) I wouldn't give ya Buckleys chance in a Ford!

by jardinier

Now here's the punch-line: my silver Volvo 244GL sports the black-on-yellow numberplate "JULIAN."
It is my proudest possession, and everyone comments on how great it looks.
Currently I would not consider parting with it for less than $100,000 but I am hoping that Julian Lennon may decided to settle in New South Wales and offer me a million bucks!

by admin

before, but got no response. (Maybe it wasn't funny?)

I'll try one last time though (promise!) since we are on the subject of cars and humor...

Did you see the Volkswagon SuperBeetle with the vanity plate that reads: "Feature"?

If you are laughing, congrads: u r a geek :)

by deadly ernest

What you get and use will depend on the type of Internet connection. With a dial-up service most people use a 'personal firewall' like Zone Alarm. However, the system itself is still at some risk. Some people install an older PC that works as the firewall and an Internet relay, this means that the relay/firewall may get hit, but usually not your personal system.

If you are connected to the Internet via ADSL, a good ADSL router usually has a built in firewall and Networ Address Translation service, these are usually sufficeint for most people.

by guruofdos

'twas the bloke who replied to me!

However, the quote should be....

I'm pink, therefore I'm Spam!

:-)

by jardinier

Thanks one and all for posting answers covering all possible scenarios.
However in the original post I also asked "Is it necessary to have a very recent version of the software?"
The reason I ask this is that, unless someone else had nabbed it, Ican get a pre 2000 copy of MacAfee Firewall for $AU 5 at an op-shop.
As I collect software of any kind at bargain prices from op-shops and garage sales, I am quite likely to come across an even more recent version.

by lordinfidel

but I always stay away from the latest and greatest or bleeding edge.

bleeding edge technology and security do not go hand in hand.

reason being, is that older versions have been time tested and exploited. Where a brand new release has not had it's time in the field to be exploited.

So I say, get the 2000 copy, it is still recent enough to be viable, and configured it properly.

When it comes to personal firewalls, The biggest thing you want to do is really to block all incoming requests. You are not running any services so no one needs to make any initial requests to your machine.

While I am not a big believer in allowing all outbound connections, unless you are going to spend the time and learn how outbound connections work and what you need to have open. You should set it so that any outbound connections outside of tcp 80(web), 443(ssl), 110(pop e-mail), 25(smtp), udp/tcp 25(DNS). FTP is a little harder because it requires a inbound initial connection to your machine from the ftp server.

With ftp I always say it is better to say allow initial requests from tcp 20 to ports over 1024 then it is to say from tcp <1024 to tcp <1024, which is how passive ftp works.

I know that I probably just got ahead of youand I apologize. It really depends on how paranoid you want to be.

I personally keep a extremely high level of paranoia. But I also know that there are other people out there like me who understand how to circumvent and exploit security devices.

by mrafrohead

Maybe you missed my post, but yes, I would get a current version. Meaning from this year. Older versions will more than likely miss out on newer attacks.

by guruofdos

Many mobo's come with a driver CD and often they include OEM versions of antivirus and firewall software. Gigabyte cds have Norton AV and Pesonal Firewall 2001 and Live Update keeps these Symantec products up-to-date. PC Chips mobo driver CDs have PC-Cillin 2002 which has built-in firewall capability. I acquire these by the dozen and always have a few spare copies floating around just in case. These often turn up in boxes of 'odd' cd's at jumble sales and junk shops!

by thechas

I don't know how 'generous' McAfee is being these days.

They used to be very generous on allowing you to download the latest version so long as your older version had NEVER been registered.

I can walk into one of the Office Max stores here, and pick up a copy of McAfee 6 that they were bundling with XP when it first came out.
They are selling them for $9 US.

Chas

by jardinier

In my posting on this discussion referring to Zone Alarm, of the current firewalls tested by the magazine, McAfee scored worst of all: I think it was 1 1/2 out of 5.
As for the free upgrade, the offer date has long ago expired on the particular second-hand copy I saw.
However taking into account your statement that they prefer to give you the upgrade if you have NOT registered, I still might buy the $AU 5 copy while it is available.

by dogfolife69

try Zone Alarm Pro. or may even Norton Firewal or Norton Interent securirty which is a firwall and antivirus all in one.

you can also try black ice defender.

these are all god choices!

by admin

1. Knowledge\Creative Thinking. It's been said many times b4, but reading "Hacking Exposed" etc. and hanging out at Security Focus etc. will help a lot IMO. If you can be creative and do it a little different than everyone else it helps IMO.

2. Hardware. If I can use a hardware solution I will do this b4 software. I am aware that hardware works with software, but physical solutions are preferable to me. Stateful Inspection, as evangelized by LI is what to get with your HW firewall. I bought a Webramp and flashed it with Sonicwall software for less than 40$ a little while ago. Stateful Inspection and a great host of features. BBIagent is another great cheap solution LI showed us. It's 36$ US and needs any old free box to run on. Personally I'm not big on most home small routers as firewalls.

3. Software. I like ZoneAlarm. It's free (or cheap if you want more features). For me, running a box with ethereal gives me all the logging I want, but registered Zonalarm and Black Ice etc. do this for you.

Personally I would not use software that was out of date because people that read about (especially as opposed to think up on their own) particular exploits search for these. Many Many successful exploits are against machines for which updates are available, but the users\admins don't keep updated IMO. Why take the hard narrow road when there are so many greener pastures demonstrates the thinking there.

The short answer? Personally, if I would at least put Zonealarm on it.

:)

by jardinier

I am now fully conversant with the fact that "comments" posted to discussions are funny and not sarcastic.
However I am not laughing as regrettably I must be too dumb (naive?)to make the connection between SuperBug and "Feature."
However a popularbumper sticker on such cars in Australia was: "This is my second car: The Mercedes is in the garage."
Incidentally one of only two brand new cars that I have purchased in my life was a 1972 SuperBug. It ran like a dream until I put it in for its compulsory 600 mile service.
It came back sounding like a chaff-cutter, and never did recover from whatever they did to it.

by jardinier

Sifting through the various postings, it is obvious that different people have different points of view.
Whilst on the one hand I have been advised that a firewall is essential for an always-on connection, but not particularly necessary for a dial-up connection, I have also been advised that it is absolutely essential.

Whilst on the one hand I have been advised that an earlier version of software is preferred because it is time-tested, I have also been advised that a totally up-to-date version is necessary.

Anyhow I have purchased for $AU 4 a 2,000 version of McAfee. Perhaps the Guru, being a fellow AOL user, might find the time to email me a few tips on configuring the thing before I install it.

Thanks again, one and all.

by jkaras

Hello all. I would like your opinions for Kerio vs. zone alarm. My roomate and I asked this of our most experienced friend and he recommended Kerio due to it's free and some what easily configurable. Due to our inexperience with firewalls, we would like a better more rounded opinion to assist in deciding because we dont know how to compare them against each other. Please input any and or all reasons for or against or we will have to use the ol' coin flip.

by admin

it's a "Feature" :)

Oh well, everyone tells me my sense of humor is terrible! I laughed my head off over this one though! I must be telling it wrong.... :(

by jardinier

Hi admin: Your humour definitely is on a wavelength outside the range of my funny bone tuner.

Are you quite sure you're not related to Star Trek's Mr Data?

by admin

I prefer "Mr. Spock" who I was always asked to and rather proudly enjoyed playing as a kid, but "Data" isn't far removed from the original Vulcan :)

Oh well, I won't burden you all with a repeat of the "Bug" joke anymore :)

by zlitocook

Nortons internet security because I thought my home computer was just a little network and no one would want to hack it! HA HA I was hacked and lost most of my files! But I back up byweekly so I just reinstalled and bought nortons. It seems to work fine so far and with all the internet offers I got it for $29.00. It allows you to setup what you want to get through the firewall and seems a good deal.

by jacklinamo

My father called me the other day to report that when he sends mail, he receives a strange reply back saying that he was unable to send to an email address he has never seen before. The email address seems to be a string of random characters plus "@aol.com" and it changes every time.

Is this a trojan, and if so, which one?

by dbgirl

I like that joke admin. I've always been a fan of Volkswagens, especially the bug, and as a programmer I love the joke. I only wish I had come up with it first, or that I could use that many letters on a vanity plate here.

This discussion is closed to new replies.