Should You Fire Your Firewall? 50
Gsurface writes "A lengthy article over at Flexbeta.net focuses on firewall applications and how well they perform as far as securing your system. Four typical firewall applications were tested including two routers, one being the Cisco 831 SOHO, which performed rather well. In total, nine security test were conducted to measure how well each firewall performed."
I don't appreciate the hardware very much... (Score:5, Interesting)
Re:I don't appreciate the hardware very much... (Score:5, Insightful)
"An In-depth Look at SMALL SYSTEM Firewalls" (Score:5, Interesting)
This is just one more case where an excellent area of inquiry is ruined by the wording of a Slashdot article, and by people trying to show how much they know without saying anything that could actually be used by someone else.
The article at Flexbeta should not be worded, "An In-depth Look at Firewalls", it should be "An In-depth Look at Small System Firewalls". Most single computers or small LANs have no servers.
The parent post is considering an important issue for systems of 100 users. Systems that large are far out of the scope of the Flexbeta article.
We need two Slashdot articles on firewalls, one for small systems, and one for more complex LANS.
The Flexbeta article considered only Linksys (now owned by Cisco) and D-Link small system hardware firewalls. It did not consider Airlink Plus [airlinkplus.com] and Netgear [netgear.com].
I got burned with poor technical support from Cisco. Also, Cisco stopped supporting its 675 router. I don't want to be involved with Cisco again, so Linksys is out, especially because of the confused Linksys web site. Cisco has an enormous conflict of interest. If Linksys sells good firewalls, it will mean Cisco sells fewer.
So, which is the better hardware firewall, D-Link DI-604, or the Netgear RP614?
Re:"An In-depth Look at SMALL SYSTEM Firewalls" (Score:1)
Any more info about D-Link? (Score:2)
Any more info about Netgear would be helpful.
Cisco 675 modems competed directly with Netgear. Not sure what Cisco is doing now.
If you know the market, I think you would be convinced that there are many cases where Cisco sales people are selling very expensive gear when a $50 Netgear box would do as well.
A 50-person company whose employees occasionally browse the internet, that has no servers, and only sends business email doesn't need much.
Re:"An In-depth Look at SMALL SYSTEM Firewalls" (Score:1)
Re:"An In-depth Look at SMALL SYSTEM Firewalls" (Score:2)
Even if Linksys is a sperate entity from Cisco I won't buy one. Linksys has always made crap. A local ISP
Thanks. (Score:2)
Thanks again for the advice. SMC firewall/modem (Score:2)
One model of SMC Barricade [smc.com]
Froogle results: SMC SMC2804WBR Cable/DSL RTR 802.11GW/Switch [google.com]
"This latest Barricade g Wireless Cable/DSL Broadband Router provides hacker prevention and logging functionalities. For example, when a hacker attempts to access your network, the Barricade g can alert you via email so you can take appropriate action."
Anyone should gladly pay a little more for a good firewall.
Re:I don't appreciate the hardware very much... (Score:5, Interesting)
With your example, once that nice PCI bus gets saturated... Game Over. Too bad they dont make a 1 GBps card for the AGP slot
Re:I don't appreciate the hardware very much... (Score:5, Interesting)
I agree with you, to a point. For a medium sized network like mine [slashdot.org], where there are _no_ hubs except for the one at the firewall (so the snort [snort.org] box can listen) the switches will take care of keeping the bandwidth that the firewall actually hears to a minimum. The PCI bus can handle 127-ish MB/s nad 64 bit PCI can handle 508-ish. So unless you have a really high traffic system[1] this setup is not even noticable between a Cisco, or other heavy duty router.
[1] I have a really high traffic FTP server on my DMZ that is accessed a lot from systems on one of my NAT's and from the internet. What I did was move this system (OBSD) in _front_ of the firewall, enable PF on the FTP server to firewall it. Then I added a 2nd NIC to the FTP server so it plugs directly into the LAN. This makes sure that almost _no_ traffic from that system actaully hits the firewall. If I didn't do this, the PCI bus, like you say, would slow things to a crawl.
Re:I don't appreciate the hardware very much... (Score:4, Informative)
Re:I don't appreciate the hardware very much... (Score:3, Insightful)
Linux isn't bad because the OS can't handle the job, but rather because they just don't have the really wide backplane like the Cisco's have. If you were able to get a linux box with a backplane like what cisco uses linux would be jsut as effective, albeit perhaps not as robust as IOS.
Good thing about hardware... (Score:2)
Crap (Score:4, Insightful)
ShieldsUp doesn't go far enough to test servers. (Score:3, Interesting)
He wasn't being careful in what he said, probably. There is nothing wrong with ShieldsUp! [grc.com] at GRC.com. (Scroll down to ShieldsUp, which cannot be linked directly.)
However, ShieldsUp doesn't go far enough in testing for vulnerabilities. ShieldsUp is perfect for testing systems or LANs that have no servers, because you are only trying to verify that there is no response at a particular port. However, if there is a server, other attacks than those of ShieldsUp should be tried.
Re:ShieldsUp doesn't go far enough to test servers (Score:3, Interesting)
Overblown language, but ShieldsUp tests ports. (Score:3, Interesting)
While Steve Gibson is known for overblown language [grcsucks.com], his ShieldsUp does in fact test for open ports.
Re:Overblown language, but ShieldsUp tests ports. (Score:1)
However, it even fails at that [jluster.org].
Re:Crap (Score:2)
The Shields Up! Test (Score:5, Interesting)
But the port it shows as closed is 113 which is sometimes needed to authenticate to ftp or web sites. The authors of the review are assuming that the best firewall stealths absolutely everything. But if a product completely protects your system why wouldn't that be good enough? Same for ZoneAlarm4 not stealthing several ports under Advanced Port Scanning.
I like the way they bring up outbound filtering though. Most "personal" firewalls don't do anything with this.
Re:The Shields Up! Test (Score:2, Insightful)
(For reference port 113 is the 'ident' identification protocol. Anyone using this for serious authentication should be shot.)
Re:The Shields Up! Test (Score:2)
It's "taken outside and shot". We don't want them bleeding all that stupid blood on the carpeting, now do we?
Re:The Shields Up! Test (Score:4, Interesting)
For reference, it's used by sendmail.
Before learning this firewall users who read their logs (me!) will have a paranoia induced moment or two when they notice their host/ISP apparently scanning their ports, and will be even more bemused when they notice the scanning follows a regular period matching the period of their email client's polling.
Fun stuff!
Re:The Shields Up! Test (Score:2, Informative)
Re:The Shields Up! Test (Score:3, Informative)
Re:The Shields Up! Test (Score:1)
Basically it says it doesn't adequately block outbound traffic (which I don't care to block) but does a great job of blocking incoming traffic.
For the price, what more could you want? I bought it before I bought an XP box to put on my LAN. (Actually, before I bought the DI-604, I didn't have a LAN per se.)
Re:The Shields Up! Test (Score:3, Interesting)
The Zone Alarm results are confusing too. I just installed the free version on a friends machine, but had to disable it temporarily because it blocked the outbound request to access my file server. I assume there are many options you can configure to secure any hardware or software firewall, but you nee
Re:The Shields Up! Test (Score:3, Informative)
Re:The Shields Up! Test (Score:1)
Re:The Shields Up! Test (Score:4, Insightful)
A lot of ISPs block certain ports, but which ones? Where are they blocked? Are they blocked all the time, or only during peak hours? You may be safe from a Shields Up scan, but are you safe from the 3|337 hax0r down the street?
Trusting my ISP to keep my computer secure is like trusting public transportation to be on time. If I *must* be somewhere at a certain time, I'd rather leave a little early or drive just in case.
asdfas (Score:1)
Leak
--------------------
As I understand it, a leak occur when a firewall don't block a connection that should be blocked. How can this append? This sound like a very basic fonctionnality of a firewall and a firewall failing this s
Re:asdfas (Score:4, Informative)
Leak:
1) Hardware firewalls _rarely_ block outbound traffic, so they implictly allow out (since they can't predict what you'll need).
2) Internal software firewalls work by intercepting a request to send a packet if it matches a rule. If the rogue software actively looks for a way to bypass the filter (by talking directly to the network card itself and bypassing the operating system), then there is nothing that can stop it.
Hence the all fail the leak test. That's to be expected. In general you cannot expect to be connected to the internet at all and NOT be _somewhat_ vulnerable about information being transmitted without your knowledge.
Browser test:
You're right. Firewalls shouldn't double as a content/URL filter. That's the job of an "application proxy". Many firewall vendors are functioning as both... which is fine for a consumer who doesn't know the difference.
However, this is partially due to the fact that windows has this API called "NDIS".
Firewalls are implemented by placing filters in the NDIS chain that check for incoming/outgoing IP addresses and stuff, and can process them. But the NDIS chain also allows you to intercept URLs and how they are parsed, control DNS lookup, and more. (This is a Windows-specific feature). So most firewall developers naturally decided to add URL/content filtering because it was an easy step from IP filtering, since they were using the same programming interfaces.
It wasn't rocket science... it was right there in the programming manuals next to the other stuff.
Port scan:
By default, ZoneAlarm is configured to allow ports 135-139 in (but ONLY for the "Local Zone", if they bothered to check) so you can use Windows File Sharing between computers. It's easily turned off making the computer invisible to everyone just like the rest of them.
ZoneAlarm wanted to be friendlier to people who wanted to share files or printers inside their house.
My hw FW blocks outbound! (Score:3, Interesting)
Blocking outbound is an important feature. My kids run MS-Win boxen, and these are sure to get trojanned. One of the nastiest rather quietly acts as a spam relay. AOL (hardly authoritative) has claimed 1/3 of spam inbound is from DHCP broadband. So I'm a responsible netadmin and block outbound 25 from their machines. They get their mail via yahoo any
Re:My hw FW blocks outbound! (Score:2)
Know the feeling!
I'm running Smoothwall Express 2 (GNU/Linux components) on my old PC, which is a tad overkill to protect a couple of machines. It would probably serve a small department or a couple of labs pretty well; it has snort, squid and so on and has a ssl-secured web interface for admin. Nice interface, good logging and traffic graphs, enough facilities to make it p
YRO? (Score:5, Insightful)
TooLeaky test is BS (Score:5, Interesting)
Sounds like BS to me.
'personal' firewalls...and why you want one (Score:4, Informative)
Where things like ZoneAlarm and Kerio make a difference is that they filter outbound connections. Of particular note is that, if the user pays attention and doesn't randomly approve everything the software shows them, then a firewall application can not only block specific outbound ports, but it can maintain specific application+port rules. That way, rogue malware can't hijack commonly used ports, such as port 80. It also would prevent worms/viruses that use their own SMTP engine.
Data security should always be a layered approach. Take care of different threats with different (appropriate) defenses.
how good is good enough (Score:3, Interesting)
It seems to me that you have to take the "threat level" into account: are you looking for a solution to keep you one hundred percent safe in the face of a dedicated attack by an expert opponent or do you just want to deter random port scanning dorks from malasia? If you're not a convenient victim and your neighbor runs vanilla windows XP, doesn't have a firewall, doesn't apply security patches and, hey while we're at it, surfs porn from dodgy russian sites all day... chances are you're safe enough... for now.
I follow no firewall (Score:1)
Default settings (Score:1)
So, basically, I can't tell anything from this "review." If it doesn't accurately portray one products capabilities, it may not accurately portray the capabilities of any of them.