Printable View
Ok now... take it easy on me guys! :D
I'm just wondering if there is any sense in running zone alarm along with blackice v3.6.41? And if anyone does it, is there anything I may need to know to do this? I am bound and determined to learn this security stuff if it kills me!! I'm just glad I found this site!!
I don't do it (run 2 software firewalls on one host)... but you can if you want.
Its better to have one properly configured firewall than two badly configured firewalls.
Just keep an eye on your logs and the firewall up to date, and properly configured... you shouldn't need the second...
general rule of thumb... deny everything... then allow when you need it.
If in the future, you don't need it... then deny it again.
just my opinion though
Phishphreek said exactly what I would have said *except* that I think it depends on how paranoid you are. Since ZA is free (not sure about blackice so I won't discuss it much), it is known for some vulnerabilities that can be exploited by people who *really* know what they're doing....but it's great for general protection. However, if you are seriously paranoid and you have something of great value, then by all means you can have layers of security to make it nearly impossible to get past.
That's probably the best thing that can be said about firewalls. Even if you have two, if you allow a trojan to get through, then it makes no difference how many firewalls you have.Quote:
Its better to have one properly configured firewall than two badly configured firewall.
If you really want to be secure, run either of the software firewalls on your system (I prefer ZA, and have used it for years) then buy a NATing router like the Linksys BEFSR81 or similar and run that between you PC and your Internet connection. This will not only give you the ability to share your Internet connection to many PCs, but the router will also add an extra layer of protection. :)
Golam
golam: That is good advise. In fact, that is exactly what I do.
I use my router as my first firewall and then have a software firewall on each host on my home network. I guess I'd be in that overparinoid group... :D
Thanks for the great info guys!!! I'll study up on proper configurations for my firewall, and will look into getting a router.
I will be reading up on blackice configuration settings, but any quick tips that may be on the top of anyone's mind is greatly appreciated!!
Thanks again, everyone! :D
phishphreek80 - great paranoids think alike
Golam :D
Let me tell you how I have mine set up. You probably don't want me to tell you this but I worked so hard on it and have to tell someone :)
I have a Linksys BEFSR41 CABLE/DSL router with NAT. I then have Three PC's behind the router. One running Win 98, one Win XP Pro, and one Suse LInux 8.2 I have Norton internet Security for a firewall, and Snort set up acting as a IDS, oh yeah, I also have a network probe monitoring all connections. :D
Thats my set up. Probably a little to much security in there but better safe than sorry. What Golam said though will definitely keep you safer than having just a firewall.
cheyenne1212: Where exactly do you have your snort box? If you have it plugged into your router and your router has a built in switch, it won't do you much good. Your ids will need to be able to inspect ALL traffic going to and from the router.Quote:
Snort set up acting as a IDS
In order to do this, you will need a hub. A hub will broadcast all traffic to all ports letting you inspect all traffic going to and from the router. The switch will only allow you to inspect traffic going to a specific MAC.
Here is how it'd have to be setup... I think*
modem to router
router to hub (so you can repeat all traffic to all ports)
hub to hosts
if you really want the extra bandwith on your LAN you can do...
modem to router
router to hub
hub to switch but plug the IDS into the hub too
switch to hosts
You don't want your IDS on a switch, as it won't be able to inspect all the traffic (unless you have a programmable switch in which you can make it act like a hub) or... unlss you are using something like ettercap which will flood your switchs arp/MAC table in turn making it act like a hub.
I think*** I might be wrong and its getting late and I'm not thinking clearly... so can someone please confirm this?
At least... thats the way I've always understood it... but I'm still learning just like the rest of you.
I would come to same conclusion as you, but snort has been capturing traffic going to both computers.
I don't know how as I don't completely understand snort yet, but it is caputuring traffic going to two different IP's in my lan.
Well, as long as its working, then thats all you need to worry about? I guess...
Hmm... now I'm a bit confused... :confused: I think I need sleep. :D
Ok here's my house.
I have a surfboard cable modem set up to NAT. Next I have a Siemens Internet gateway router that has basic fire walling and NATs the IP range again. So I am double NATing (only because the thing worked like that right out of the box) and the gateway router connects all my internal PCs and issues IP addresses. It does the internet connection sharing so I don't have to have that enabled on the PCs. It saves on NIC cards and offers an additional layer outside of Windows. On each PC I have Zone Alarm clients and updated McAfee E-mail and On Access Scanners.
If you are going to invest in an additional software firewall product for a box that is already running Zone Alarm, I would consider taking that money and buying a decent internet gateway router outside of windows instead. The one I mention was only 20 bucks on sale. I didn't give out model names but a visit to best buy or office max will deliver several examples.
Oh almost forgot, I have a Linux box running IP chains too but I am always turning it on and off playing with it and reloading it all the time. That’s a significant extra expense because you need a PC with 2 NICs and all your are running on it is a basic set of programs. I've had some success with text only installations of older red hat versions on a simple P100 with 32 Megs of ram. You can get one of those for free from people or junk yards if your local yard has a section for PCs.
I never felt really confortable running multiple software firewalls on one PC. Perhaps, I'm ignorant about them and too paranoid. I was worried that software firewalls (ones that create rules for applications, like Norton Internet Security) would create a rule the, for examples sake, ZA was running and to allow all connections for this program. Then if ZA allowed something through, NIS would assume its safe because it gave ZA all access. Am I making sense? Is this true at all? I'm just using NIS and ZA as examples because they are the only ones I can think of now that I have used in the past. I dunno.
I run my net (now just 2 computers at home) through a router with NAT. Um, the Windoze box runs NIS 2003, and my box runs SuSE 8.2 Pro with iptables. Then again, I once ran NIS 2003, ZA, and Sygate all on my box (running Windoze ME then) behind the router as well, and it seemed to work OK. (little slow though :P)
Again, I'm likely just ignorant, I don't know a whole lot about firewall design. If I didn't make any sense, plz tell me! :)
Dave
The only thing running those 2 firewalls together will do is eat up your RAM. Two software firewalls running on the same system is not going to offer any more protection than just runing the one.
I suggest ZA, I have used it in the past and it served me well. As for blackice defender, I really don't have any positive things to say about it, except that it's MANY vulnerabilities have been well documented and exploited in the past.