DSL routers w/ firewall - effective?

Considering all the sites that are totally unprotected, yes the Broadband DSL/Cable router/firewall combination seems to work fine for small businesses. These are not difficult to setup and maintain and thus do not require extensive IT staff.Sure, a separate hardware based firewall would be more secure and more flexible, but it would also require technical staff to setup, support and maintain and monitor. It would therefore require more $'s all around.

Software-based firewalls are considered less secure than hardware-based firewalls.

Symanted makes a couple of inexpensive (a few hundred $) firewall appliances designed for small businesses. There are probably competitors with similar devices. As ANNA noted, since they're designed for a single function they should be more securethan a multi-function device and certainly more secure than a software solution. A software solution can be thwarted by attacking the OS it runs on in addition to the firewall software itself.

Having a firewall (of any sort) isn't enough. You need to properly configure it, apply patches and updates, analyse audit logs and such.

A current best practice is to setup a "defense in depth". The DSL router's internal firewall being the first layer, a 'real' firewall the second and possibly using Win-2k's IPSEC as a third. Each of these barriers is constructed differently and would require a different attack. You can't completely eliminate the possibility of a breach. With care, you can delay an attacker long enough to detect and counter the attack.

Selecting the "enable firewall" check box on your DSL router and running with the default settings provides some protection but default settings tend to become well known and are much easier to defeat than a tailored, multi-level solution.

If the business data or continuity of operations are worth $500 I would spring for the hardware firewall too and establish a second barrier.

The firewall that comes with DSL is only good against layer 3 hacks which involves hacking your IP address, since most firewalls use NAT (which works on layer 3) the only protection you have from those firewalls are only to access your computer fromthe outside using IP to IP connections. However it is still possible to access your computer by making your computer intiating a request to the Internet. This is usualy done using a trojan horse which can arrive on your computer either via web sitesor email.
In this case layer 4 and 5 are used. Most DSL firewalls do provide some security regarding TCP port which is on layer 4, however they are usually only to open port directly to be accessed from the Internet and not to block anything from the inside.
To protect your computer against trojan horse and other security problems which are done via layer 4 and 5 you have 2 options:
1. Use a hardware firewall, which usually sits between your DSL router and your LAN, and configure it to blockany ports besides what you use (FTP 21, HTTP 80, SMTP 25, and POP 110, and maybe also KAZA 1214) for both incoming and outgoing request. This is usually very expensive.
2. Use a software firewall, which will acomplish the same thing however it willsit in the backgroud and use some of your computers resources to run.
The layers I mention is the logical terms on which each network packet that is transmitted runs.
To find out more information on the layers and what each layer is responsible for, you can check out Windows 2000 resource kit. Or you can visit:
http://www.uwsg.iu.edu/usail/network/nfs/network_layers.html
remove all spaces.

One solution to consider is the use of a cisco 827 or 1721 router for the business. The IOS that comes with the routers has a firewall feature and can also terminate secure VPN connections. It is important to have it configured properley. By default a firewall will let out all connections but will block inbound. If a user initiates a connection to Kazaa or a messenger program, it will allow the outside to come in via that port. One solution is to completely block all ports that are not required. Just leave ports for www and mail in and out.

This question was auto closed due to inactivity