Slashdot Mirror
Should You Fire Your Firewall?
Gsurface writes "A lengthy article over at Flexbeta.net focuses on firewall applications and how well they perform as far as securing your system. Four typical firewall applications were tested including two routers, one being the Cisco 831 SOHO, which performed rather well. In total, nine security test were conducted to measure how well each firewall performed."
Very interesting, although I'ven never been much for hardware firewalls. I grab an old machine, load it up with Slackware 9.1, and custom-configure the netfilter/iptables rules. I's a lot more versitile, and it's not just a firewall. It can be expanded to run every server known to man, such as ssh for remote control, or FreeS/WAN, for VPN.
Any review of security/firewalls using Gibson's crappy analysis tools is beyond flawed. I would take all of this review with a grain or two of salt.
Yes, I am an agent of Satan, but my duties are largely ceremonial.
But the port it shows as closed is 113 which is sometimes needed to authenticate to ftp or web sites. The authors of the review are assuming that the best firewall stealths absolutely everything. But if a product completely protects your system why wouldn't that be good enough? Same for ZoneAlarm4 not stealthing several ports under Advanced Port Scanning.
I like the way they bring up outbound filtering though. Most "personal" firewalls don't do anything with this.
Does this really belong in the Your Rights Online section?
Leak:
1) Hardware firewalls _rarely_ block outbound traffic, so they implictly allow out (since they can't predict what you'll need).
2) Internal software firewalls work by intercepting a request to send a packet if it matches a rule. If the rogue software actively looks for a way to bypass the filter (by talking directly to the network card itself and bypassing the operating system), then there is nothing that can stop it.
Hence the all fail the leak test. That's to be expected. In general you cannot expect to be connected to the internet at all and NOT be _somewhat_ vulnerable about information being transmitted without your knowledge.
Browser test:
You're right. Firewalls shouldn't double as a content/URL filter. That's the job of an "application proxy". Many firewall vendors are functioning as both... which is fine for a consumer who doesn't know the difference.
However, this is partially due to the fact that windows has this API called "NDIS".
Firewalls are implemented by placing filters in the NDIS chain that check for incoming/outgoing IP addresses and stuff, and can process them. But the NDIS chain also allows you to intercept URLs and how they are parsed, control DNS lookup, and more. (This is a Windows-specific feature). So most firewall developers naturally decided to add URL/content filtering because it was an easy step from IP filtering, since they were using the same programming interfaces.
It wasn't rocket science... it was right there in the programming manuals next to the other stuff.
Port scan:
By default, ZoneAlarm is configured to allow ports 135-139 in (but ONLY for the "Local Zone", if they bothered to check) so you can use Windows File Sharing between computers. It's easily turned off making the computer invisible to everyone just like the rest of them.
ZoneAlarm wanted to be friendlier to people who wanted to share files or printers inside their house.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
I decided to try some of these tests myself. When testing using TooLeaky, I got a notification that it sent the information to GRC.com and recieved information from GRC.com, even when I disabled my internet connection.
Sounds like BS to me.
In general, you should always use a dedicated device to filter incoming packets. Consider it 'first line' defense.
Where things like ZoneAlarm and Kerio make a difference is that they filter outbound connections. Of particular note is that, if the user pays attention and doesn't randomly approve everything the software shows them, then a firewall application can not only block specific outbound ports, but it can maintain specific application+port rules. That way, rogue malware can't hijack commonly used ports, such as port 80. It also would prevent worms/viruses that use their own SMTP engine.
Data security should always be a layered approach. Take care of different threats with different (appropriate) defenses.
This is just one more case where an excellent area of inquiry is ruined by the wording of a Slashdot article, and by people trying to show how much they know without saying anything that could actually be used by someone else.
The article at Flexbeta should not be worded, "An In-depth Look at Firewalls", it should be "An In-depth Look at Small System Firewalls". Most single computers or small LANs have no servers.
The parent post is considering an important issue for systems of 100 users. Systems that large are far out of the scope of the Flexbeta article.
We need two Slashdot articles on firewalls, one for small systems, and one for more complex LANS.
The Flexbeta article considered only Linksys (now owned by Cisco) and D-Link small system hardware firewalls. It did not consider Airlink Plus and Netgear.
I got burned with poor technical support from Cisco. Also, Cisco stopped supporting its 675 router. I don't want to be involved with Cisco again, so Linksys is out, especially because of the confused Linksys web site. Cisco has an enormous conflict of interest. If Linksys sells good firewalls, it will mean Cisco sells fewer.
So, which is the better hardware firewall, D-Link DI-604, or the Netgear RP614?