Multiple Firewalls{Software}

Hmm,
As I was reading through a couple of threads I have seen this ^^ topic discussed slightly but never in depth. I have seen multiple AO members frown upon it though, I was curious as to why you would suggest to not use more than one software firewall on a box. The way I always thought of it was that the holes in one firewall will be covered up by another one, henceforth, if you have two firewalls, the probability that the same hole will be in both of them is dramatically reduced. And then this theory adds upon itself for more and more. So, will everyone please post their opinions, and theories on this idea.

Most users that I know frown upon software firewalls....period. I would much prefer a hardware firewall/dedicated box for my firewall. On the few occassions when I have used a software firewall, it is on a network machine where I want to keep an eye on the box from other users on the network. Never had a need for more then 1 firewall their, because I know the users (small group of people), so I know if any of them have any idea how to bipass the firewall.

ok.. so i don't know all that much about software firewalls but from my understanding all they do is just open and close the ports.. so if you had more than 1 software firewall i guess 1 could close a port for something and then the other would open.. seems possible that it could just leave you with all the holes in both firewalls rather than them taking care of each other's holes

i believe..and i have no proof at all...that running 2 firewalls may actually be worse than only one...i could easily see 2 different programs messing each other up trying to do the same thing...so ...i use the hardware/software approach..i use good quality hardware firewalls (watchguard soho's and fireboxes) to help keep unwanted connections out....i use the software firewall as a back up and primarily to deal with OUTGOING traffic...i want to know what is trying to connect out...i used to use za as it did a reasonable job with outbound traffic...but given it's lousy record for inbounds..i switched to tiny...and ooo..it's soo much better...

Well if I have My Hardware Fire Wall On And Enable The Software
FireWall Then Security Check Everything Is Cool But The Only
Log's Of Port Attempts(From The Security Scan) Are
Only In The Software Logs As if The Hardware Firewall
Didnt Get Any Activity?
So now I run Thrreee And Im Still Not Certain

I hOPE im NOT pARANOID

Some software firewalls do things that hardware firewalls can't do

some software firewalls audit applications making outgoing connections. Hardware firewalls have no idea what application is making the connection, only the protocol.

Therefore a hardware firewall cannot distinguish between some types of traffic that a software firewall can.

On the other hand, a hardware firewall gives the network administrator an awful lot more control in one place than trying to put software firewalls on say, a load of desktops or servers, and it is much harder for an attacker to bypass.

I can see why you might want one of each (because they do different jobs), but not >1 of each.

Some big organisations which have very sensitive data and mutual distrust have several hardware firewalls between different parts of them. The example I know of is the UK National Health service, which has everyone's medical records and millions of employees, so it can't really trust them all :)

I expect most examples of these will be governmental.

Two software firewalls running together do nothing but give a flase sense of "extra" security.

And as for the idea that one Firewall's vulnerabilities could be cancelled out by running another Firewall is just plain laughable. As Magus255 pointed out-

Quote:

---

seems possible that it could just leave you with all the holes in both firewalls rather than them taking care of each other's holes

---

Well the last thing you do if you want more protection is put two rubbers on, right? Software firewalls only afford you a certain amount of protection. It's not that it doesn't work but it doesn't buy you anything. Like Conf1rm3d_K1ll says "just pain laughable".

Thanx Thanx Thanx But Still We Ponder Why?
Do They Confuse Each Other

They can cause each other problems by stepping on each other's resources. Some software firewalls are at kernel level some reside at the NDIS layer. It just doesn't buy you a thing.

So,
They might open up the holes in all both of them? How could they do this? Please elaborate.

>>Korp, what do you mean by 'stepping on each other's resources'?
>>Korp, well, if you put on more than one rubber, that is just another layer of protection, rite?

>>Conf1rmed, how would they not stop what one missed? I would think of it as having two different types of walls around my computer, a brick one, and a cement one. How is it 'laughable'?

It's just pointless, The3ntropy. Think about it. I'd only recommend running two if one of the firewalls is XP's built in firewall....Why? Read this cut and paste from grc...

Quote:

---

Just so you know, WinXP's built-in firewall does not attempt to manage or restrict outbound connections at all. It appears to be a useful firewall for hiding the machine from the Internet (it has "stealth mode" unsolicited packet handling), but you will still need to use a good third-party personal firewall if you wish to manage and control outbound connections from your system.

---

If you want to run two Firewalls than go right ahead. Once you have them installed and set up try the numerous tests that you can run online. Also, download leaktest from grc and see what results you'll get. You'll be very disappointed.

Hmm,
I have done a lot of tests before, but upon your request I have just done them again. From grc, all of my ports are stealthed, a few are just blocked, from LeakTest, <<it failed, from scan.sygate.com's test, they all turned up blocked, even complete scanning, and lastly I scanned my box from a remote box and ports 1-1024 all turned up blocked, and were unresponsive, {Excluding 139 NetBios, responded to the probe from a remote box}. Now, I would believe that, that is the proof of a couple properly configured firewalls that are working fine together. {If there are any other tests you would like me to try, I will do so willingly, just post it here.}

In case you are wondering, I am running BlackICE, Tiny, SygatePRO, and Outpost.

LOL..4 firewalls! You're a freak! I don't know if I'd put that in the "overly paranoid" box or the other box labelled "stupidity"............


Uninstall them all and do run the same tests using only one at a time. You'll find very little difference..a difference so minute you'll soon see how ridiculous it actually is to be running 4 software firewalls similtaneously....

On a side note, how many anti virus products do you run? Four? Five? Maybe ten!?


You never know....Norton might pick up something Mcafee, AVG and AntiVir missed.... :D

Thread's Purpose Rapidly Deteriorating.
I am not replying, I do not want to start a flame war.

Good idea.....let's just agree to disagree. No harm done.


KorpDeath (and perhaps freeon?) know a hell of alot more than me on why multiple software firewalls are pointless. I'll let them slug it out with you if they feel so inclined. Game over....

One properly configured firewall will serve your needs just fine. If you do want to use multiple firewalls, use the hardware/software combination previously mentioned in this thread. There is no point to using multiple software firewalls. My question to you is what to do you think the benefit is? Does one software firewall miss something that another catches? Uninstall all but one and re-run all those tests. If you are 'less secure' at that point, configure the one firewall you are using until you are secure - if you can't configure it right, get another one. Hardware is a better alternative than software, but if you must use software only use one.

Thanx EveryBody At Least Im Not "AS" Confused as i Was
Because Now That I feel Comfortable With a Hardware/Software
Firewall Combo Conf1rm3d_k1ll Has Me Pondering The Multiple
Virus Thing Now

Multiple Firewalls well if somthing happens to 1 of them at least your not S.O.L. and you have a backup. That could be the only advantage I see of using more then one.

Quote:

---

Originally posted by Confirmed_Kill
On a side note, how many anti virus products do you run? Four? Five? Maybe ten!?


You never know....Norton might pick up something Mcafee, AVG and AntiVir missed....

---

I'm sorry to say that that could not be possible. The dynamic link libraries (.dll) are used by all AntiVirus Kits and would interfere with each other if more than one were installed, making both AV Kits totally useless.

On the other hand, I myself, am with The3ntropy on this one. I have three firewalls running at this very moment:

• ZoneAlarm Pro
• Sygate
• Tiny

I think this is necissary, while all programs have bugs and holes. One example is my ZoneAlarm keeps giving me a TrueVector error, every once in a while. This, I beleive, was discussed a few posts back, check on that for further input. But yeah,...where others fault, I have backups to save me. Better safe than sorry, I say. But then again, if I had money to burn for some nice hardware...I doubt I would be giving such an argument for this... but on a second note, I really don't find hardware protection that neccissary for a personal computer, IMO.

It was sarcasm, WebCarnage.....you know, the lowest form of humour.

Hehehehe, NO Conf1rm3d_K1ll, THAT's the lowest kind of humor! LOL :) ;) :D

Well i can scratch that mission off my list then.
(multiple anti virus programs that is)
Guess it was funnier than the god joke i just
finished reading.

Quote:

---

Originally Posted by Confirmed_Kill
It was sarcasm, WebCarnage.....you know, the lowest form of humour.

---

<sarcasm> NO ****?! </sarcasm>

That s why i use 1regular virus-scanner and 1 sandbox[surfinguardpro 5.6]to cover it all!

I think this is necissary, while all programs have bugs and holes. One example is my ZoneAlarm keeps giving me a TrueVector error, every once in a while. This, I beleive, was discussed a few posts back, check on that for further input. But yeah,...where others fault, I have backups to save me. Better safe than sorry, I say. But then again, if I had money to burn for some nice hardware...I doubt I would be giving such an argument for this... but on a second note, I really don't find hardware protection that neccissary for a personal computer, IMO. [/B][/QUOTE]

WebCarnage your so right!!!!!!!!!!!!!!!!!

Found out when i installed my second firewall [Sygate]

Sygate found microsoft windows kernel core component

c:\windows\system\kernel386.exe

Norton did not detect it.....................until about 10 day s ago.[after an update]


Now Norton also detects it!!!!!



This is not nice when you paid for it,and also a security breach!


BUT MY SECOND FIREWALL BLOCKED IT!!!!!!!!!!!!!

Well,
I am very glad that someone, webcarnage, agrees with me. But I have been looking through on a lot of topics with firewalls and filtering software, and I have decided to make my final decision, I am running Tiny, and BlackICE. Just those 2. I have gone through and have done several online tests. Took me even a couple of days, all the while I was configuring and disbling and enabling different features and even different firewalls. I found out that, Sygate will cover a lot of things in general, tiny will cover out bound filtereing very well, BlackICE will cover several forms of incoming attakcs and scans, and Outbound is the same as sygate only with less things that it covers. So, with this figured out I went out and started running different combinations and such. I choose as I did because when together, Tiny and BlackICE, will cover everything sygate does, and that Outpost covers less than sygate, so it too was out. The other combination that I was leaning to was sygate and Tiny, but I found out that sygate does not work quite as good as BlackICE on incoming pings, and such. So, to conclude, Tiny, and BlackICE > Sygate > Outpost.
Sygate > Tiny.
Sygate > BlackICE.

{Remember, that my findings are only for a properly configured and greatly tested firewall, that has been configured beyond belief. Results WILL difer based upon your configurations, but upon mine, that ^^ was what they were.}

Quote:

---

Originally posted here by [WebCarnage]


<sarcasm> NO ****?! </sarcasm>

---

If you were so sure it was sarcasm than why did you reply so seriously? For example-

Quote:

---

Originally posted by WebCarnage
I'm sorry to say that that could not be possible. The dynamic link libraries (.dll) are used by all AntiVirus Kits and would interfere with each other if more than one were installed, making both AV Kits totally useless.

---

If you're looking for a flame war.......you've found it. Better still, let's do this in pm's so we don't bore everyone to death.

Quote:

---

Originally posted by The3ntropy
Well,
I am very glad that someone, webcarnage, agrees with me.

---

:D I see that has more of a hinderence. Anyway, it's your box The3ntropy....you can run as many firewalls as you like.....good thread.

Quote:

---

If you're looking for a flame ware.......you've found it. Better still, let's do this in pm's so we don't bore everyone to death.

---

Call me willing, but I think I need a bit of a 'boost' in my self esteem. Let the fight begin!!!!

[P.S. - You spelled "war" wrong :)]

I've often thought about running multiple software firewalls, but with one concern...system performance... If one has an older system, the more programs running in the background, the worse. Hardware firewalls are best(and almost necessary) for a broadband connection, but for a box with a phone cord stuck in its a$$(the 56K, if you're lucky, kind), it becomes inefficient, as dial-ups have an inherent dynamic IP, along with a limited(relatively) connection time. I would think that just picking one software firewall that indeed 'stealths' your connection and functions well should be enough, for a dial-up(that is, of course, unless one has reason to worry someone is targeting them specifically).<--Paranoia factor is always a variable:)
Sorry...rambling again...
(ed. and not paying attention to the fact that there was a second page to this thread...sorry all :confused: )

Ouroboros

Quote:

---

Originally posted here by [WebCarnage]


[P.S. - You spelled "war" wrong :)]

---

Doh! Ya got me there....




But seriously, why did you reply so seriously if you knew I was using sarcasm? It seems to me that you just stumbled into this thread, read a few replies and then posted your own ridiculous reply. It looks like you're way out of your league unless you're posting in "The Worlds Longest Thread" or "The Avtar Competition" that ac1sp3ctrum was running.


Anyway, as I said, let's do this in pm's....

To tell the truth, I honestly just wanted people to know that that couldn't even be possible. I knew you were joking around, everybody who knows a bit more about AVKits new you were joking around. But for those thad didn't... I was there. For those in need of a dire escape from the brutality of online life, I was there. For those who are ignorant, have no fear - <shouting>[WebCarnage], is here....</shouting>