Security

Ask something
Discussion Locked

Do I need a software firewall?

0 helpful
12 replies

by starscream

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ok here is the deal. I have a static IP range and I was running all my computers with static IP addresses, so I was using zonealarm free as a firewall for each and it did an amazing job.

However I was expanding my network to greater than the 5 static ip's I have and that combined with the fact that I was using bad network security practise through using all public ip addresses I opted for a high quality/business class router.

I bought a Draytek Vigor 2800 after much research, mainly for its firewall features, cost, VPN and more importantly Multi-NAT support.

So I now have my Vigor 2800 configued so I have a huge private ip range and have my webserver on my private network but rerouted to a public ip address from my range to allow it to work as a server online. I am also considering using another of my static addresses as a VPN gateway to connect my work machine to my home network but I will look into that (and most likely post a question about it) later.

Anyway, my question is this. Do I need zonealarm on my home computers that are on my private network anymore. I have turned on most of the firewall features of the router but do not trust taking off my individual firewall installations, if the computers are on a private range are they protected from hackers?. None of the computers are rerouted using NAT, only my webserver is live on the net, everything else is on my private range but has internet access.

I have a windows 2003 server I use as an mp3 server, it does not have a firewall on it. It has internet access but is not multi-NATed to be live on the net, does this need a firewall?

I am confused as to when a firewall is needed on a private network. Is zonealarm and the like needed mainly for when people have 1 computer connected to the internet or for spyware/viruses that may connect out to the internet for malicious reasons.

Any strong info on this subject and definitive answered would be excellent.

12 replies

by p.j.hutchison

No, if you have configured the firewall on the router you do not need to have s/w firewalls as well. As long as the PCs are regularly updated you are protected!

S/W firewalls are ok for single PCs connected to the internet, for larger networks a seperate firewall is better to protect all pcs on a private network.

by starscream

Will the firewall on the Draytek Vigor 2800 be sufficient to protect my network. Also if that firewall was not correctly configured or not implemented at all, would my private network still have a certain degree of protection through being private. What sort of attacks should I expect? Would they be attacks on my network or directly aimed at my router? I don't want my firewall to be too strict as I need to game online. Would it be better to completely lock down my firewall for web browsing and put my gaming machine in a DMZ or is it the best the way I have it so online gaming can be done from within my private network. As I can connect to gaming servers without any problem does this mean my firewall may not be configured correctly? I was under the impression that a firewall should be totally locked down and various applications allowed access when the need be to ensure no security holes.

by p.j.hutchison

Your PCs are somewhat protected as their IP address is hidden from the outside world, outside users can only see the 'Router'.
For game servers, it depends on what access it requires, you can open/close ports as required and sometimes determine which ports for specific PCs if you need it for one PC. Depends on how configurable the Firewall is.

by gary56789

I would strongly encourage you to keep the software firewalls and keep them properly configured. Your hardware firewall should protect you from all but a concerted hacker attack from the outside, but without the software firewall, how does the router protect you from drive-by downloads?

Properly configured, the software firewalls will alert you if a drive-by download is trying to call out for more of its nasty friends.

by gyrfalcon2138

I agree with the last answer - keep your software firewalls going. A hardware firewall does an excellent job of keeping things out, but if something gets in, it can usually replicate uncontrolled and cause all sorts of trouble. The comparable analogy is having one big lock on the front door, and no keycard readers to the individual offices.

This is your personal network, so part of it is basically how much you trust yourself in avoiding spyware/viruses. You don't *need* a software firewall, but it's a good safety net in case you pick up something nasty (WMF Exploit anyone?) At least this way, you know when, where, and what.

If this is something that other people use (friend/family/whatever), I would say that it's a neccessity. Other people's surfing habits, being completely outside your control, dramatically raises the possibility of someone picking up a random piece of junk out there.

by starscream

You have all given me some really good answers here and I'm happy, :)

Is it ok to split the points?

by greybeard770

You say your web server is "on my private network but rerouted to a public ip address" which I will take to mean either NAT or port 80 forwarding. That would mean that if your web server got compromised it could do mean stuff to everything else inside. That would indicate the continued need for the individual firewall. A properly configured DMZ could help with that too.

I think Zone Alarm makes a log of things it is blocking. You could check that log to see if what is being blocked is of concern.

This discussion is closed to new replies.