Firewalls

Gyck · 05-01-2003 2:00am #1

This is linked to my other thread relating to wisps.

What kind of firewalls are generally used with always on domesitc connections? I've got Zone Alarm on my modem and even with modeate secruity settings I'm getting quite alot of alerts.

I'm assuming that with broadband you'll get an increased number of alerts with any s/f firewall. Is it any use to use a proxy or hardware firewall, or is it worth it? Or do you just put up with it?

carrotcake · 05-01-2003 4:09pm

the only firewall i ever used with dial-up was the one that's built into xp, but now i'm using norton which seems to do the trick. i get an alert every few days, so it's not much of an interruption

Lenny · 05-01-2003 6:10pm

I use that norton security too.
I used to use signal9 conseal pc firewall for years, but mcaffee bought them out and I don't know whats happening now..
I get scanned for trojans a few times a day..

Keyser Soze · 05-01-2003 10:52pm

I've found that the best Firewall to use is a stand alone one on a seaptate PC. I have Smoothwall or IPCop running on an old Pentium90 I got for nothing.
It's a small Linux distro which takes over an entire pc but it's defult settings are to deny all incoming access (Bastion settings) and even if the firewall box somehow gets compromised, the security on your own pc will then have to be hacked.

Doddle to set up and administer using a WebBrowser from your surfing machine. Also has a web proxy for chaching files and Internet connection sharing is transparent.

Have only tried it on DialUp but it supports BB modems.

Kevok · 05-01-2003 11:46pm

If its a software one you want to use i've found that Norton Personal Firewall is the best one. I've used them all. And its the only one that you can configure properly to let you accept connections for running a Game server while at the same time secure.

kamobe · 05-01-2003 11:52pm

The Norton one is indeed great, and the alerts are very subtle. A little menu slides out from the bottom left of your screen, noticeable, but not annoying in the least.

I changed recently (for the sake of changing) to Deerfields Vis Netic firewall (i believe it's the follow-up to Conseal) and it's very good too. There are no alerts, simply what's allowed and what's not. There is of course a live log that's easily accessible at all times to view what's being allowed and what's not. There's also 'activity' section which allows you to see every IP currently connected to your computer. Very useful.

Gyck · 06-01-2003 9:53am

That's interesting. I'm happy enough with ZA, but the alerts are very in your face.

John2002 · 06-01-2003 2:55pm

Any opinions on Sygate's Personal Firewall?

I've been using it for a while but I don't know much about it and the only alerts I've got from it were when I tested it on some website.

MoSeS_. · 06-01-2003 4:12pm

been using Tiny personal firewall, haven't had any problems.
Annoying for the first day or so, but once I had all my applications set up I put in rules blocking all incoming traffic outside of that and haven't had a bit of bother since.

The firewall status window is handy too to look at all the different connections, what port they're on, whether they're connected in or out and how much traffic has gone in/out on those ports.

I have it running as a service so it's always on.

Aye and 'tis free for personal use.

Typedef · 06-01-2003 4:34pm

One man, one 486, one copy of IPCop Linux should do just fine for you.

Cost of the above.
Why nothing .... nothing that is except your immortal soul.
*bwhahaha

John R · 17-01-2003 2:37am

Originally posted by Gyck
That's interesting. I'm happy enough with ZA, but the alerts are very in your face.

Why don't you just switch them off? ZA will still block the same connections and you can always check the log whenever you want.

Gyck · 17-01-2003 5:46pm

True, but I do like to see the alerts, it's just that they're BIG. A quick sort of 'hey, you've been pinged by X.X.X.X' kind of message without having to hit OK each time it appears would be just fine.
As I say, I have no problem with ZA in general, and the way it presents it's alerts wouldn't give me enough grief to ditch the app for that reason.

daveirl · 18-01-2003 7:28pm

This post has been deleted.

Keyser Soze · 19-01-2003 11:31pm

Originally posted by daveirl
I must get around to using this or Smoothwall someday!

Which is better?

BOth are almost exactly the same product.

Smoothwall was there first but the English company that produced it had the reputation for being...well to put it mildly..unreceptive to suggestions on how to develop the product. They then launched a commerical product which annoyed a share in the GPL Linux community.

So a group basically took all the Smoothwall GPL code and changed the frontend to read IPCop. Since then both have developed their products, and at the moment in my opinion IPCop is the better and more supported of of the two, but Smoothwall have a very impressive beta of Smoothwall 2 out.

daveirl · 20-01-2003 7:14pm

This post has been deleted.

MyPerfectCousin · 22-01-2003 12:55pm

I'm a newbie to DSL and firewalls so forgive the basic questions.

ZA periodically blocks a UDP session from my PCs to what looks like my ISP's DNS server.

It seems random. Is it harmless?

What's a trojan scan look like?

Does having a LAN router between my DSL modem and PCs increase security?

thanks

Ardmore · 27-01-2003 4:21pm

Have you considered somethink like the DLink DI-804V? It's about GBP100.

Or this Netgear box? About €115 delivered to Ireland?

Typedef · 27-01-2003 4:40pm

I'd say IPCop is probably 'better'.

I did use one commercial distro e-smith, which I found to be a fairly fully functional server, never mind firewall.

... but, I like to control exactly what happens on my servers and e-smith had a bit too much of the 'as if by magic' about it for my tastes.

Kali · 27-01-2003 4:54pm

Originally posted by Ardmore
Or this Netgear box? About €115 delivered to Ireland?

That netgear box is a hideous firewall, we have one in work, absolutely no logging facilites, no port blocking, no ip blocking, very little in the way of port forwarding, little or not control basically. Besides which it constantly dies due to overheating.. (i'll put in a fan eventually in its cabinet).
Currently putting together a strong iptables setup on a debian box to sit behind it, far from a simple solution, but by far the most secure and the most controllable firewall/routing solution.

Kevok · 27-01-2003 5:07pm

Get yourself Norton personal firewall. It's a doddle to set up and allow/disallow programs.

Alerts are subtle and you will see nothing you don't want to. I;ve tried ZA myself, but it has trouble with incoming connections so will not allow you to host servers, even when you set the ports correctly.

If you don't want to shell out for it, you may want to consider Tiny Personal firewall or BlackICE defender, both do the job but i'd still go with NPF.

As for your other question, it's impossible to tell with ZA as it doesn't provide enough info. BlackICE and NPF tell you if it is a trojan scan, port scan, ping etc.

Most alerts are harmless random scans and shouldn't be worried about.

Ardmore · 27-01-2003 5:11pm

Originally posted by Kali
That netgear box is a hideous firewall, we have one in work, absolutely no logging facilites, no port blocking, no ip blocking, very little in the way of port forwarding, little or not control

In other words, it's perfect for the average user (the ones that really need firewalls, because if they were smarter, they wouldn't be as wide open to attack in the first place!)

Currently putting together a strong iptables setup on a debian box to sit behind it, far from a simple solution, but by far the most secure and the most controllable firewall/routing solution.

And absolutely guaranteed not to be seen in the average users setup.

The DLink does have Syslog support, port blocking and forwarding. Eircom and ESAT should sell these things at cost to help ensure that their customers don't end up as zombies in the next Slammer outbreak!

Typedef · 27-01-2003 5:15pm

Originally posted by Ardmore
And absolutely guaranteed not to be seen in the average users setup.

I'm running a Slackware box, with iptables and another box with IPCop and ipchains and if you were to believe some people floating around boards, I'm just an end-luser.

/troll

Ardmore · 27-01-2003 5:36pm

Originally posted by Typedef
I'm running a Slackware box, with iptables and another box with IPCop and ipchains and if you were to believe some people floating around boards, I'm just an end-luser.

Sure, anyone can, in theory do that. Frankly, I couldn't be arsed, and I'm a hell of a lot more motivated than 90% of the people who will be getting ADSL.

What proportion of the ADSL customer basis will be using Linux, and what proportion will be using Windows? Will your mother use Slackware with iptables, and a second box with IPCop and ipchains?

More to the point, will any else in her bridge club use it?

(Not a slam against mothers - my mother used to send me e-mail in 1990 from an Amstrad CPC 6128).

Firewalls

Comments