Slashdot Mirror
Should You Fire Your Firewall?
Gsurface writes "A lengthy article over at Flexbeta.net focuses on firewall applications and how well they perform as far as securing your system. Four typical firewall applications were tested including two routers, one being the Cisco 831 SOHO, which performed rather well. In total, nine security test were conducted to measure how well each firewall performed."
Very interesting, although I'ven never been much for hardware firewalls. I grab an old machine, load it up with Slackware 9.1, and custom-configure the netfilter/iptables rules. I's a lot more versitile, and it's not just a firewall. It can be expanded to run every server known to man, such as ssh for remote control, or FreeS/WAN, for VPN.
But because the Cisco router's price range is awfully steep, we would only recommend it for those who have money to through away
jeez
Any review of security/firewalls using Gibson's crappy analysis tools is beyond flawed. I would take all of this review with a grain or two of salt.
Yes, I am an agent of Satan, but my duties are largely ceremonial.
But the port it shows as closed is 113 which is sometimes needed to authenticate to ftp or web sites. The authors of the review are assuming that the best firewall stealths absolutely everything. But if a product completely protects your system why wouldn't that be good enough? Same for ZoneAlarm4 not stealthing several ports under Advanced Port Scanning.
I like the way they bring up outbound filtering though. Most "personal" firewalls don't do anything with this.
For a long time, I had no firewall. Now I use ZoneAlarm. There is a really large number of thing I don't understand about firewall and while the article was an interresting reading, there is many thing I don't understand. Can somebody give me a little info about internet security?
Leak
--------------------
As I understand it, a leak occur when a firewall don't block a connection that should be blocked. How can this append? This sound like a very basic fonctionnality of a firewall and a firewall failing this sound totally broken to me. Is it more complex than that? How can a firewall effectively block some connection and not other that should be blocked?
Browser test
--------------------
To do cookies check and referrer check, the firewalls need to analyse the contents of the packets and not only their source, port and destination to filter them. Is this really something one should expect from a firewall?
Port scan
--------------------
How can a firewall fail to stealth a specific port? Some ports are harder to stealth than others? To this day, I was thinking of ports like arbitrary numbers conveniently standardized in their usage.
Does this really belong in the Your Rights Online section?
I decided to try some of these tests myself. When testing using TooLeaky, I got a notification that it sent the information to GRC.com and recieved information from GRC.com, even when I disabled my internet connection.
Sounds like BS to me.
It's a good first line of defense for the home user, especially if you're getting tired of keeping up the necessary due diligence for a good sofware firewall. I went with hardware on my home LAN about a year ago, after running software for several years. In this case, I'd been running RedHat and their release strategy change left me unsure of how I wanted to maintain that system. Getting hardware for my front-line meant that I just had to keep the box running for my internal services, though I did feel it necessary to shut down my external ports.
Obviously security criteria are different between home and business, not in resisting attack, but in the users you must accept and services you must offer.
The living have better things to do than to continue hating the dead.
Blocking outbound is an important feature. My kids run MS-Win boxen, and these are sure to get trojanned. One of the nastiest rather quietly acts as a spam relay. AOL (hardly authoritative) has claimed 1/3 of spam inbound is from DHCP broadband. So I'm a responsible netadmin and block outbound 25 from their machines. They get their mail via yahoo anyways.
Now, if my son needs grounding (he hasn't), I may need to find out the AIM ports to block.
In general, you should always use a dedicated device to filter incoming packets. Consider it 'first line' defense.
Where things like ZoneAlarm and Kerio make a difference is that they filter outbound connections. Of particular note is that, if the user pays attention and doesn't randomly approve everything the software shows them, then a firewall application can not only block specific outbound ports, but it can maintain specific application+port rules. That way, rogue malware can't hijack commonly used ports, such as port 80. It also would prevent worms/viruses that use their own SMTP engine.
Data security should always be a layered approach. Take care of different threats with different (appropriate) defenses.
He wasn't being careful in what he said, probably. There is nothing wrong with ShieldsUp! at GRC.com. (Scroll down to ShieldsUp, which cannot be linked directly.)
However, ShieldsUp doesn't go far enough in testing for vulnerabilities. ShieldsUp is perfect for testing systems or LANs that have no servers, because you are only trying to verify that there is no response at a particular port. However, if there is a server, other attacks than those of ShieldsUp should be tried.
Check out http://www.grcsucks.com/ for info debunking GRC/ShieldsUp/Steve Gibson. He's a quack.
Not All Who Wander Are Lost
This is just one more case where an excellent area of inquiry is ruined by the wording of a Slashdot article, and by people trying to show how much they know without saying anything that could actually be used by someone else.
The article at Flexbeta should not be worded, "An In-depth Look at Firewalls", it should be "An In-depth Look at Small System Firewalls". Most single computers or small LANs have no servers.
The parent post is considering an important issue for systems of 100 users. Systems that large are far out of the scope of the Flexbeta article.
We need two Slashdot articles on firewalls, one for small systems, and one for more complex LANS.
The Flexbeta article considered only Linksys (now owned by Cisco) and D-Link small system hardware firewalls. It did not consider Airlink Plus and Netgear.
I got burned with poor technical support from Cisco. Also, Cisco stopped supporting its 675 router. I don't want to be involved with Cisco again, so Linksys is out, especially because of the confused Linksys web site. Cisco has an enormous conflict of interest. If Linksys sells good firewalls, it will mean Cisco sells fewer.
So, which is the better hardware firewall, D-Link DI-604, or the Netgear RP614?
While Steve Gibson is known for overblown language, his ShieldsUp does in fact test for open ports.
One of the questions that this discussion doesn't take into account is just how good does a personal firewall on a home computer have to be in order to be effective?
/t
It seems to me that you have to take the "threat level" into account: are you looking for a solution to keep you one hundred percent safe in the face of a dedicated attack by an expert opponent or do you just want to deter random port scanning dorks from malasia? If you're not a convenient victim and your neighbor runs vanilla windows XP, doesn't have a firewall, doesn't apply security patches and, hey while we're at it, surfs porn from dodgy russian sites all day... chances are you're safe enough... for now.
#!/usr/bin/english
I don't trust the buggers. I am currently running one of my home pc's with Win98SE stock from cd only patch is i run IE6.(though I use Firebird) I have offered for people whom I know to be in security related feilds to "hack me". To this day no one has. Granted I know this doesn't mean it can not be done, anything is possible. I just happen to keep a tight reign on what programs I allow to communicate to the outside world. Scary stuff. I have no anti virus either, and have gotten only 2 virus infections neither of them were serious.
I suppose it's up to the individual user as to how secure they want to think they are.
Keep in mind firewalls can be shutoff from outside by using a common exploit like IE and activex.
Security doesn't mean running anti virus or a firewall for that matter. It means the user needs to be vigilant and know what their machine is doing at all times. One of the main reasons I love Linux is the difficulty of software installation. You have to upgrade 3 or 4 pakages to run that new version of X-chat, on the plus side you know what is bieng installed on your system unlike the point and click GUI world of Windows.
I once read somewhere that out of 100 hackers, all 100 can scan for open ports. Of those 100 maybe less than 10 would know what to do when they found one. I don't know how creditble that statement is, the day may come where my offer of "hack me" leaves me dumbfounded until then I refuse to use anti virus or a firewall. Both seem pointless to me at least.
I am Bennett Haselton! I am Bennett Haselton!
Any more info about Netgear would be helpful.
Cisco 675 modems competed directly with Netgear. Not sure what Cisco is doing now.
If you know the market, I think you would be convinced that there are many cases where Cisco sales people are selling very expensive gear when a $50 Netgear box would do as well.
A 50-person company whose employees occasionally browse the internet, that has no servers, and only sends business email doesn't need much.
So, basically, I can't tell anything from this "review." If it doesn't accurately portray one products capabilities, it may not accurately portray the capabilities of any of them.
Been using sigs for 20 years. Nothing funny left to say.
The advice is very much appreciated.
One model of SMC Barricade
Froogle results: SMC SMC2804WBR Cable/DSL RTR 802.11GW/Switch
"This latest Barricade g Wireless Cable/DSL Broadband Router provides hacker prevention and logging functionalities. For example, when a hacker attempts to access your network, the Barricade g can alert you via email so you can take appropriate action."
Anyone should gladly pay a little more for a good firewall.