Router/firewall vs software
If a series of computers are connected to the internet via a router with a built-in firewall, is the presence of a software firewall on each machine necessary or just a needless redundancy.
Here's the scenario: A network of 7 computers is connected to the internet via a D-Link DI-704P router with a built-in firewall. One linux machine acts as a web server and ftp server, another linux machine serves a battle.net gateway, and the other machines are more or less just mixed OS, local user desktop systems. There are no computers setup in the DMZ, all are behind the firewall. Is this D-Link router doing the job of preventing access to the network via its firewall, or is it necessary that a software firewall be configured on each machine or is this essentially useless?
Re: Router/firewall vs software
Quote:
Originally posted here by Big Jim Slade
If a series of computers are connected to the internet via a router with a built-in firewall, is the presence of a software firewall on each machine necessary or just a needless redundancy.
Here's the scenario: A network of 7 computers is connected to the internet via a D-Link DI-704P router with a built-in firewall. One linux machine acts as a web server and ftp server, another linux machine serves a battle.net gateway, and the other machines are more or less just mixed OS, local user desktop systems. There are no computers setup in the DMZ, all are behind the firewall. Is this D-Link router doing the job of preventing access to the network via its firewall, or is it necessary that a software firewall be configured on each machine or is this essentially useless?
Hey Hey,
I guess that's entirely up to you but here's my take on it...
You've got a Web Server and an FTP server which means you must have ports forwarded (or are they internal only?). Are you comfortable enough with your PC setup that if someone gains access to your WWW/FTP Server... that the other machines have nothing open that would require protection? The last thing you'd want is to have one computer exploited and remotely controlled and then to have that pass to the rest of the PCs on your network.
Also, the D-Link is fine for blocking unwanted inbound attempts, but what about connection attempts that originate on your machine and are destined for the internet? If someone infects one of the computers (accidently or intentionally) with an IRC Bot that joins a server and waits for commands in the channel, you'll never know that it has happened, however a software application-based firewall would prevent this problem.
What about the possibility of a virus spreading internally? Say a machine hasn't been fully patched and you download a virus (Similar to say MSBlast and it's shutdown of the RPC Service). This virus could spread internally because it is already past your firewall and there's nothing stopping it's spreading.
If you asked if I run firewalls on my PCs behind the router/firewall... I'd give you various responses... I have some that do and some that don't.. It all depends on the purpose of the PC and how comfortable I feel with it's setup and it's security... the choice is yours but I definately wouldn't call it a needless redundancy.
Peace,
HT