Multiple Firewalls{Software}

Hmm,
As I was reading through a couple of threads I have seen this ^^ topic discussed slightly but never in depth. I have seen multiple AO members frown upon it though, I was curious as to why you would suggest to not use more than one software firewall on a box. The way I always thought of it was that the holes in one firewall will be covered up by another one, henceforth, if you have two firewalls, the probability that the same hole will be in both of them is dramatically reduced. And then this theory adds upon itself for more and more. So, will everyone please post their opinions, and theories on this idea.

Most users that I know frown upon software firewalls....period. I would much prefer a hardware firewall/dedicated box for my firewall. On the few occassions when I have used a software firewall, it is on a network machine where I want to keep an eye on the box from other users on the network. Never had a need for more then 1 firewall their, because I know the users (small group of people), so I know if any of them have any idea how to bipass the firewall.

ok.. so i don't know all that much about software firewalls but from my understanding all they do is just open and close the ports.. so if you had more than 1 software firewall i guess 1 could close a port for something and then the other would open.. seems possible that it could just leave you with all the holes in both firewalls rather than them taking care of each other's holes

i believe..and i have no proof at all...that running 2 firewalls may actually be worse than only one...i could easily see 2 different programs messing each other up trying to do the same thing...so ...i use the hardware/software approach..i use good quality hardware firewalls (watchguard soho's and fireboxes) to help keep unwanted connections out....i use the software firewall as a back up and primarily to deal with OUTGOING traffic...i want to know what is trying to connect out...i used to use za as it did a reasonable job with outbound traffic...but given it's lousy record for inbounds..i switched to tiny...and ooo..it's soo much better...

Well if I have My Hardware Fire Wall On And Enable The Software
FireWall Then Security Check Everything Is Cool But The Only
Log's Of Port Attempts(From The Security Scan) Are
Only In The Software Logs As if The Hardware Firewall
Didnt Get Any Activity?
So now I run Thrreee And Im Still Not Certain

I hOPE im NOT pARANOID

Some software firewalls do things that hardware firewalls can't do

some software firewalls audit applications making outgoing connections. Hardware firewalls have no idea what application is making the connection, only the protocol.

Therefore a hardware firewall cannot distinguish between some types of traffic that a software firewall can.

On the other hand, a hardware firewall gives the network administrator an awful lot more control in one place than trying to put software firewalls on say, a load of desktops or servers, and it is much harder for an attacker to bypass.

I can see why you might want one of each (because they do different jobs), but not >1 of each.

Some big organisations which have very sensitive data and mutual distrust have several hardware firewalls between different parts of them. The example I know of is the UK National Health service, which has everyone's medical records and millions of employees, so it can't really trust them all :)

I expect most examples of these will be governmental.

Two software firewalls running together do nothing but give a flase sense of "extra" security.

And as for the idea that one Firewall's vulnerabilities could be cancelled out by running another Firewall is just plain laughable. As Magus255 pointed out-

Quote:

---

seems possible that it could just leave you with all the holes in both firewalls rather than them taking care of each other's holes

---

Well the last thing you do if you want more protection is put two rubbers on, right? Software firewalls only afford you a certain amount of protection. It's not that it doesn't work but it doesn't buy you anything. Like Conf1rm3d_K1ll says "just pain laughable".

Thanx Thanx Thanx But Still We Ponder Why?
Do They Confuse Each Other

They can cause each other problems by stepping on each other's resources. Some software firewalls are at kernel level some reside at the NDIS layer. It just doesn't buy you a thing.