BleepingComputer.com: Hardware Vs. Software Firewalls

Hi,
I've made many posts on this board and you run an awesome site. I've learned more about computer stuff in the past 6 months then I did the previous 10 years and beyond.

Quick question:
I have a broadband D-Link router which hooks up my home network (1 desktop, 2 laptops). The router comes with a built in configurable firewall. So far that firewall is OFF because I use ZoneAlarm on each of the comps.

Would it hurt if I enabled the hardware firewall within D-Link as well as ZoneAlarm or should I just keep one, and if so, which one?

2 computers use XP SP2 and the other uses Win2000, SP4. All computers are fully patched to this month.

Cheers.

Generally speaking, a hardware firewall is the best defence; theoretically, a hardware firewall should be enough. However, having each computer with an independent software firewall helps to prevent any cross-infections, and adds just another layer to your computers' defences.
I would certainly use both.
Cheers,
John

Yep I'm with jgweed on this one. I use Sygate firewall as well as my router firewall. I just like the fact that Sygate will ask my permission , should anything new on my PC want Internet access. This way if i inadvertently download something really nasty and it tries to "phone home", I'm going to be alerted.

I have DSL with a 2WIRE modem. The 2wire has a firewall and I had it turned off for a while because I have a software firewall on my TM pc-cillin. I ran the Gibson Research tests on my system and it failed. A couple of people on here told me to run the 2wire hardware firewall along with the software firewall. I started running both and the system has passed the Gibson and Stygate tests numerous times. Since I've been using both it has never failed.

For a while I used DLINK 624, something Verizon was giving out. I hated the incomprehensible user interface.
But the firewall there was superb. Zone Alarm had little to do.

Having said that, I'm back to my Linksys router, and its firewall, but I continue using Zone Alarm which is loafing but watching things a firewall can't catch - trash trying to change programs and registry, and has email watch.

Keep both. And on the D-Link, if you use wireless, make sure to use a very LONG key with goofy non-words for the WPA encryption and shut off SSID until you need to use it. To enable SSID is a little nasty step on Dlink, but easy to do on the Linksys router - just push a button.

Thanks tos for that information on DLINK routers, as I just set up my DI 524 wireless router, nice for a dorm room to get off the desk..


But also because some ass has been porscanning my ass, and it isnt computer tech people, so I'm using it for the extra hardware firewall...

Time to go fix


Note: Disabling SSID on DI524 is a simple click and 'apply'...so it seems to be fixed


Also the DI524 has some nice features, such as allowing only computers with za to connect to it, dosent really help me...But the firewall passed all the gibson research company Shield Up! tests, except for IDENT 135 being on...So its a nice addition...Norton hasent had a reported 'attack' since I turned it on.

Ngarskel, on Sep 16 2006, 07:55 PM, said:

624 was the same and Linksys has that as well. Do use it! It's a good method. Just list the IP address of your computer(s) in allowed list and nobody will be able to go through the router in the wireless mode. You can also clone IP address there. I think it was under Filter tab or some other deeply buried place. Like I said I didn't like the GUI there, but it sure worked well.

I use ATT/SBC's 2Wire Home Portal DSL modem along with McAfee PFW 8.0. Never could get all my ports to show "stealth" on GRC test using McAfee 7.1 or newest 8.0 using default settings, even with the hardware fw. Stealthing via Mcafee FW alone caused it to turn itself off! So I reset McAFee to defaults.

But after asking for opinions on DSLBroadbandReports forum, I recently did this: I opened the 2Wire Monitor, Advanced Firewall Settings & checked the "stealth mode" box, & rebooted of course. McAfee FW was unaffected by the change & still on. Did a GRC test & ports were all showing "stealth". And McAfee inbound events log is showing absolutely 0 hacker attempts ever since! That's a switch!

I have left the 2Wire's "block ping" option unchecked because I am afraid ATT's server needs this ping reply to identify me & allow me to connect. One of these days I'm gonna call them & ask if blocking the ping would be OK, too......just haven't gotten around to it. DSL forum thought it would be OK, but I'd rather get ATT Tech support's blessing on that one, because you have to be able to GET on-line to go back and reverse that one!

tos226, on Sep 16 2006, 11:12 PM, said:

This is my first router, so the GUI dosent bother me, even if it did take a moment to figure out..As for the ZP only firewall, I tried to use it, and added an exception for my ip...Nah..Didnt work to well...I did turn SSID and have a nice long password...I'm also on the 6th floor of a college dorm, with plenty of unsecured routers in the building..So I'm not to worried about it.

Setting the bleep up was a pain though...It took 5 tries for the thing to detect the router (Inital router setup with the cd and crud)

But I like it, the firewall on there even without the ZAP filter is excellent.