Firewall v. NAT

The only possible answer to "am I safe?" is "No." You are reasonably protected against infiltration attacks against all stations except your mail server, where such attacks depend on ports being open. You are as safe as most firewalls could make youagainst incoming attacks.

You are also not protected (by NAT at least) from mail-bourne virus attacks, denial of service attacks, or attacks on your mail server coming in on the SMTP port (25) which might take over your server and cause it to runsome intruder's code. Then again, a firewall would not help this either.

What you do not have that most firewalls could give you is protection from machines inside your network visiting "evil" locations and downloading dangerous things. Your NAT box will not give you a list of sites hit, nor will it prevent your night shift from visiting entertainment sites.

I suggest that you call a high-end firewall vendor, like Checkpoint, and ask their salesperson the question you asked here. They will be happy to tell you all the reasons you "need" their product. Go over their list, and see if what they add to the party is worth the price of admission.

Good luck.

I'm of the philosophy that a firewall should not be thought of as "extra" or a "bonus" to your network. Firewalls should be "standard equipment".

I disagree with the other poster, but only because he/she wasn't specific. An Internet monitoring solution (locks out users from sites or categories like entertainment, XXX, sports, etc.) is not actually a firewall. It could care less about the packets or the packet types it's monitoring at the base protocol level only (most of them only do the standard ones even like FTP, SMTP, HTTP and ASP). One such product is Super Scout.

If your router, by chance is leased and management by an outside company, you may already have a firewall and don't even know it. Most companies who lease out and managment network equipment (most often they are the ones that install your router and set up your leased lines) will configure and setup a firewall on their end (ie. your Internet gateway) as a standard protection.

Verify this if you do lease out your router services. If not, shop around for a decent firewall product ASAP.

also, to protect against mail born virus attacks I suggest installing a network anti-virus program. My favorite is a product from Computer Associates' called Inoculan IT. It scans at the gateway, so effectively all attachments are scanned before they are even delivered to your users' mail boxes.

Finally for stepping up protection even further look into a program called "Black Ice" its good for monitoring your system against hack attacks. I call it a lite IDS (Intrusion Detection System). Finally two other tools to give would be hackers a hard time - RotoRouter (which provides fake information to hackers) and Snort (available through snort.org). Snort is an actual Network Intrusion Detection System (NIDS).

later.

Yes, you are relatively safe. There is no "absolute" safe position in the internetworking world. A firewall won't help you against Denial of Service or Viruses etc. any more than what you have. Don't believe the hype from the vendors.

On the other hand, it wouldn't hurt you to run a firwall either, and it would be good if you logged activity so that if you were attacked you could figure out what was going on and remedy it. I suggest ZoneAlarm:

http://www.zonelabs.com/

I highly do not recommend BlackIce defender. If you want more information, e-mail me.

Now i'm curious how many servers?____For only 22 user ??I'm trying to picture your settings.I have done Network Designing,so i'm trying to visualize this..
I mean every company needs a firewall.If anything ever happens to your database you are the first to be blame..I can recomend a few firewalls that i work with in the past.just give me an overview of your setup.

This question was closed by the author