Is Windows Firewall any good at all?

well as the title says, is the SP2 windows firewall any good at all? i know it has the basic features of a firewall, but i still dislike its reliability since it has been made public and rarely updated. the only thing i rather like about it is its low usage of memory. however, i am just curious on how the public overviews the windows firewall. what do you think about it? is it reliable? useless? okay? a good temporary fix? decent protection? post if you got any comments, it would be quite helpful on my consideration of leaving my friend's computer with just windows firewall (he doesnt like other firewalls because they use too much memory [i.e ZA pro uses 128mbs of ram {thats what it says for operating on windows xp} while others are not as good] ).

EDIT: P.S i know this goes a bit off topic, but could anybody reccomend me a firewall that is light on resources if possible? (free one would be even better :p)

Hi,

Firewalls are not my strong point, however after reading numerous threads on topics about firewalls in general i got a couple of points that might help:

1. I think that the vast majority of people here will say that the Windows firewall gives an extremely low amount of protection. Some would even go as far as to say its not even worth thinking about. (not very technical i know but well, neithers the firewall)

2. As i see it having a firewall is great an all, as long as it is kept up to date, only the necessary ports are open, and most importantly the logs are checked on a regular basis (don't think that windows firewall has logs) If these three things aren't done, especially the last, then you wont know if you are being targeted, and if so how its being done in order to stop it.

3. However I am assuming that your friends is a home PC, he is not doing any top secret work, and just wants to surf, play games and possibly use Office for some general work. In that case I would say that actually an active virus scanner is far more important, as it is unlikely (but definitely possible) that he will get targeted by a straight hack, and far more likely he will pick up a virus through e-mail, web page, download etc.

As far as what i would reccomend for a firewall, the free ZA i believe is the best, was running a win xp box with only 256Mb of RAM for a while and had no resource issues. Its simple to use and can be updated automatically. Like i said earlier though, make sure that your friend checks the firewall for any suspicious stuff though, as it is VERY easy to have one and just assume your safe.

With it use a good virus scanner, and there are good free ones out there, i just can't remeber them at the moment, maybe another member could suggest something. Make sure that whatever you use has real time protection, and is set to automatically do a full system scan periodically.

I would think that anything more than that would just be a bit overkill.

Matt

C_C, Windows XP firewall inst bad, but you must to know to deal with it. MS Firewall isnt like retail commercial FWs (such as NIS). Keep in mind that MS FW is designed to procect your machine from EXTERNAL attacks. It is not (IMHO) good to break a worm already inside from your pc, sending your personal info to the internet.
If you plan to use it, read all MS documentation about it before rely your pc security on it...

From what I understand, M$'s firewall only blocks incoming connection attempts (short of those services in the exception tab). While this is a nice idea, it reduces alot of functionality if you're running a network. A perfect example was when I discovered M$'s firewall was interfering with the server based network AV I'm using. It wasn't letting the AV server connect with its clients. Creating a rule to allow this wasn't exactly intuitive either. For single systems not sitting behind a router, M$'s firewall serves a practical purpose, basic security from outside attacks. I applaud M$ for its recent attempts at offering beefed up security (firewall, antispyware), however, the firewall is far from an ideal solution for protection against inside-out attacks. I would recommend getting a firewall that monitors both incoming/outgoing traffic. That's my input on the matter.

Quote:

---

(don't think that windows firewall has logs)

---

It does, but it's somewhat sparcer in log sorting features than other firewalls. It's located at C:\WINDOWS\pfirewall.log and it logs Successful Connections and Dropped Packets.

Quote:

---

With it use a good virus scanner, and there are good free ones out there, i just can't remeber them at the moment, maybe another member could suggest something.

---

• AVG 7.0 Free Edition - Very good, I used this one the most.
• ClamWin - Not recommended for newbie computer uses who want realtime protection, as this has none. This is meant for scanning your entire PC or single files for viruses, not for scanning every file your computer accesses as mosto AVs do. A nice feature of this AV is that you can make your own definitions. See Soda_Popinsky's tutorials on on this: (Here and here.)
• Bitdefender I liked it a lot when I used it and it seemed to have very good definitions.

- X

Vigilant Minds did a pen test against 6 or so of the more popular personal firewalls. The two worst were Symantec's and the MS personal firewall. While I don't have the link handy, it showed that both of these vendors are vulnerable to very common attack vectors.

When I dig up the link to the PDF, I'll throw it in here.

Again, requirements + madates = Technology Solution.

I'd also advise you to pick the most simple solution when you implement. Simplicity is beauty.

;)

--Th13

wfw isnt that bad, its better than nothing. i just use it to know when programs are trying to make connections to the net that are NOT suppose to....like this program i downloaded the other day...a memory address hacker. now why that program would need to access the net i dont know but WFW did its job to alert me that it was not being haved. i never really like firewalls to begin with. i have been on the net for quite a while and i remember when sub7 was popular to stick in everything and it was a pain in the ass to block....Period. even zone alarm...uhhh i dont even remember the other ones back then but they didn't do the job. but im getting kind of off topic, if you want a general baseline security measure that doesnt require any download time or $$ use it. but sygate (if its still free) is a decent one though i hope they fixed the bug with that screwed up long filename that converted to the old 8char length during installation and basically rendered the firewall useless and popped error messages every time you started it.

Here you go thehorse13 [1-107 KB]

[1] Defeating Windows Personal Firewalls: Filtering Methodologies, Attacks, and Defenses

Although I haven't myself tested the WinXP firewall I hear it's not the best thing in the world. Regardless, I don't use it, it's just a pain in the ass and it's not like I have anything worth hacking, so even if I was hacked, a format wouldn't exactly bother me..

Windows XP firewall (ICF) only monitors 'incomming' traffic. Not 'outbound'. Meaning, if your system is infected with a trojan dialer for example, the firewall will not alert you about the outbound connection it is trying to establish. Firewalls logs for ICF can be found here (by default of course)

C:\WINDOWS\pfirewall.log

I don't think so! If you don't play games ,it's enough. It's very simple. If you want a high security . ZA is powerful(Also LNS)!

Quote:

---

I don't think so! If you don't play games ,it's enough.

---

I see. So firewalls that don't do egress filtering are enough? What about bots? Worms? Spyware? Keyloggers? You know, the biggest problems on the net today.

I won't even get into the design flaws in the product. For a glimpse of that, see the link Agent Steel posted earlier in the thread.

Your post is incorrect. Please do the minimal research before posting.

--Th13

Well, I am certainly no expert here, but I feel that a bit of "devil's advocacy" might be in order.

My main question would be "what were Microsoft's intentions for the product?"

From what I have read it would seem that this was to provide some sort of rudimentary protection for inexperienced users whilst they went on the net to trusted sites and downloaded software updates and so on. Now, I don't want to "second guess" Microsoft but given that:

1. It doesn't filter outgoing traffic.
2. In that report Microsoft said that they were "not concerned by the results"

At this point I am inclined to think of it as "a relatively primitive defence tool" rather than a "true firewall"

As --TH13 pointed out:

Quote:

---

I see. So firewalls that don't do egress filtering are enough? What about bots? Worms? Spyware? Keyloggers? You know, the biggest problems on the net today.

---

So perhaps it is a misnomer to even describe it as a "firewall", let alone judge it as one?

Just a thought :)

...I've actually tested Windows XP firewall using nmap. It does a rather admirable job of 'stealthing' a PC. The biggest drawback is that it does not block or filter outgoing connections. It's probably satisfactory for most users.

Quote:

---

...I've actually tested Windows XP firewall using nmap. It does

a rather admirable job of 'stealthing' a PC.

---

What options did you use with nmap when you performed your test? I am

currently using nmap 3.95 for 2000.

Quote:

---

The biggest drawback is that it does not block or filter

outgoing connections. It's probably satisfactory for most

users.

---

IMO Windows firewall is 'satisfactory' to the people who don't know any

better or the people who don't anything about security. As long as they

can get online, surf the net, check email, and play some online games

they don't care about it.

Now for the techies and geeks who love this stuff (which is US) we

have different opionions on this subject. IMO Windows firewall is

better than nothing, but since it doesn't have any type of

outbound monitoring it makes it a security risk. Bottom line is, you don't neglect inbound security, so why would you neglect outbound security?

Hey Hey,

I think that CN22 has summed thing up quite nicely....

You do a fresh Windows XP install... you go on the internet... *BAM* you're hit by the latest worm....

You do a fresh Windows XP install... you enable the firewall... you go on the internet *BAM* the latest worm is turned away because the connection is denied...

So that right there answers the question is the Windows firewall any good at all... yes.. it's great for default installs that need updates installed.

It's great for home users that don't know any better..

Security is layered... everywhere... Do you go out and leave your door unlocked? Probably not... (Operating System with No Firewall)... Do you go out and lock your door? Most likely (operating System with basic firewall).... Do you go out and lock your door and arm an alarm system? some people will... (Operating System with Advanced Firewall)...

A basic level of physical security is sufficient for most people and the truth is that a basic level of computer security is sufficient for most people... If everyone were meant to be running registry change monitors, av, realtime anti-malware, advanced firewalls, hardware firewalls on top and an IDS... then everyone should triple bolt their door, put cages over their Windows and install an alarm system with motion detectors and video cameras... because it's the same thing... Most people want the basics and it does the trick..

The Windows firewall does the trick just as only locking your door does the trick...

Is it the best... nope... is it a great solution... nope.. but is it good??? yes..

For those of you that disagree... how many of you have said that your NAT Router is sufficient as a firewall? It's only watching for connections coming in... it'll let anything leave your network.

Peace,
HT

Quote:

---

Simplicity is beauty.

---

I have to continuously relearn that every couple of years.

In reference to the logging of Windows firewall. Be advised, logging is not turned on by default. You must go into the settings and turn it on.

;)

I remember testing it a bit with nmap scans, it did better than I thought it would.

I'll just have to agree with a few here.
If there's no other firewall around, might as well run it!

...I nmapped it with the -sV -O -P0 switches. Not sure what version of nmap I used. I got so many computers I can't keep track.

Don't get me wrong, I'm not a big fan of this firewall, much prefer Sygate for my Windows boxes. If you're a mindless Windows user, it's fine. If you're a thinking man (or woman), you can do better.

I found a PDF lying around on my hard drive which I thought you all might find interesting. I'm not sure where I found it, but it's a VigilantMinds article and it involves testing various Windows firewalls (including the inbuilt SP2 one) to see if they can be bypassed. Take a look at the results at the end of the article - that'll give you a rough idea of how good Windows' inbuilt firewall is. :)

Cheers,

-jk

[edit]

The attachment was corrupted and I couldn't fix it, so I've uploaded it to my site: click

I beleave the dozen or so articles with that title each have an example of how to inject into a trusted application. And thats the problem addressed. However I really don't understand where this would be specific to that firewall. You can assume that everything packaged with these security suits sold in walmart will be the first set of programs disabled by malware anyway.

Even then, most of the time I could sniff out anything "non-RFC compliant" to a particular service and maybe send any response right back. In effect, warp any session I want into a vector for backdoor communication.

I don't understand why most of you people can't admit that there really are no preventive measures. Atleast none that the security industry and the retailers of their products would want you to know about.

no firewall even those in the fwtk legacy or network guards can prevent trusted applications from sending undesired or unauthorized data. if the formatting of every single packet is defined in a manner so draconian to be no longer useful in general purpose environments covert channels still exist.

firewalls are not the appropriate choice to protect these vectors. a strong change control policy must be in place on internal systems. the firewall must be limited in scope to moderating network access and filtering outbound content for signs of remotely compromised services/daemons. more tasks will overload the firewall and play away from its strengths.

i disagree with the idea that no preventative measures are available. prevention of unauthorized disclosure alteration and even some instances of destruction is the primary use of access controls. access controls are limited by their technical nature and are useless if not supported by strong organizational policy or for the home user a little self-education and simple caution.

I'm in the camp that says that's it not a great product - but it's certainly a LOT better than no firewall at all. It does have an elegant simplicity.. and as has been said, if you go onto the internet without it you'll be 0wned in 20 minutes or so.

Personally I use ZoneAlarm (the one with the integrated AV is pretty good) but the firewall on router keeps the nasties out anyway.. so really, ZoneAlarm is there to mitigate against attacks on the wireless LAN somewhere and to provide egress filtering. But you know, for 99% of users that's probably overkill.. but for power users it can be extremely useful having that sort of granular level of control for inbound and outbound network connections.

I'd sooner spend $60 a year on a decent package like the ZoneAlarm Internet Security Suite which gives you pretty much everything you need rather than take the risk.

TH13, Could you please post that pdf? I would really like to see what they have to say about Symantec's Firewall. The only problem I've really noticed is that it takes up a lot of memory when running it.

Now here's a question:

If you are behind aNAT router, is it even worth turning WFW on?

Just to clear a little something about firewalls...

If you are connected to the internet directly (no router between you and the modem or *eek* the phoneline), having a software firewall filters incoming traffic and (the better firewalls) monitors outgoing traffic with proper permissions

If you are connected to the internet behind a router (or hardware firewall), having a software firewall is only good for filtering outbound traffic that has permission

Do I have that right?

Quote:

---

Originally posted here by tyger_claw
Now here's a question:

If you are behind aNAT router, is it even worth turning WFW on?

---

To answer that question, you'd have to answer this question first.

Do you trust the other users that are on the LAN with you?

There are quite a few PCs on my home network..

I've got my Desktop (XP) and an iMac (Mac OS 9.2)
My girlfriend has her desktop (XP) and a Clamshell iBook (Mac OS 9.2)
My Roommate has his desktop (XP) and his file server (XP)
Another Roommate has his desktop (XP) and his laptop (XP/SuSE)
There's also a LaserJet 4MV and occasionally a Powerbook (OS X)
There used to be a SuSE 9.3 box... it'll be back soon... and there's also Debian under coLinux...

Do I run a software firewall?? nope...I have other methods of monitoring outbound connections and I trust the NAT on the firewall to keep me from rogue inbound connections. At the same time, I trust my roommates.. I keep the gfs PC updated and one roommate works for a Comp Sec company.. the other graduated in Electronics Engineering.

At work it's a mix of XP and OS X... again ... no software firewall... the trust is placed in the NAT and we trust the internal users...

However... if i was in a dorm (several only provide one network drop for all the students in the room)... so if I shared a home router with roommates or I was direct into the drop... I'd be running a firewall... I'm NATed to the internet but I wouldn't trust the other internal users...

Quote:

---

Just to clear a little something about firewalls...

If you are connected to the internet directly (no router between you and the modem or *eek* the phoneline), having a software firewall filters incoming traffic and (the better firewalls) monitors outgoing traffic with proper permissions

If you are connected to the internet behind a router (or hardware firewall), having a software firewall is only good for filtering outbound traffic that has permission

Do I have that right?

---

I think the above also answers your question there.... a software firewall is still providing inbound or inbound/outbound (depending on the firewall).... The question is do you trust the other users enough... Do you need inbound filtered behind the NAT... Do you have a DMZ setup on your router... do you have ports forwarded... do you want those to be filtered?

Unfortunately defining a network setup (where to place a firewall, type of firewall, what do I need to block, what do I need to filter)... isn't a set in stone process... It's like picking a car..

Do I need 2, 4, 5, or 7 seats.
Can I drive a stick or do I require an automatic.
Do I want more cargo capacity.
Do I want passenger side airbags
Do I want the extra options
How much power do I want under the hood...
Do I want price or performance or a mix of both..


Your firewall is going to be the exact same...

Hardware, Software, or a Combo
Do I need it to configure itself
Do I need it to be able to process a large amount of traffic quickly
Do I want a built in IDS
Do I want full control over it.. or minimal contrl that wil be simplified

To me the Windows firewall is like a sunfire... It's made fun of by enthusiasts and experts in its field... It's definately not high quality and doesn't provide ultimate performance.... However it's simple... it's low cost and it goes from point A to point B... and if that's all you need... then it does the trick.

Peace,
HT

Quote:

---

TH13, Could you please post that pdf? I would really like to see what they have to say about Symantec's Firewall. The only problem I've really noticed is that it takes up a lot of memory when running it.

---

http://www.vigilantminds.com/files/d..._firewalls.pdf

Scroll to the last page to see the matrix of results. Everything before that is background noise. Well, at least it should be if you're a security engineer.

Quote:

---

I don't understand why most of you people can't admit that there really are no preventive measures. Atleast none that the security industry and the retailers of their products would want you to know about.

---

Wanna solve 99% of your issues related to this for free? Remove the ability of end users to install software. Done.

Hmm... So that's where I got that PDF from! Must've been in one of TH's previous posts a while ago... ;)

Cheers,

-jk

(See top of page if confused :D)

Quote:

---

Originally posted here by tyger_claw
[B]If you are behind aNAT router, is it even worth turning WFW on?

---

It depends. It's definitely worth taking additional steps if you have a wireless network, but as
HTRegz said it kinda depends on your circumstances. For my home network I take several additonal steps, because I live in an urban area with quite a concentration of wireless networks. Even though I use WPA-PSK I don't 100% trust the wireless network to be absolutely secure.

On corporate networks you usually find that Windows Firewall is turned off on client PCs because it just tends to make machines difficult to manage. In fact, the Windows Firewall product in that kind of environment can be quite dangerous.. in certain circumstances a PC can become virus infected, and the Windows Firewall can prevent administrators from accessing the PC to clean it up.

My current setup is a laptop (XP Pro Sp2) on a wifi network. The wifi is wpa-psk secured, with a few other security measures. I even tangled with the hardwall firewall and added a few rules. Now, like a few others have said, unless I don't trust the insiders using my computer...a software firewall shouldn't be neccessary. Well, I do have a softwall firewall (Outpost Pro). Why? Because I think the Hidden Process Monitor and Component Control are excellent features. I'm also a firm believer in layered security. Is it overkill? probably.
I would never knowingly do harm to my computer but, occasionally, things do inadvertantly happen and I want to be prepared.
[Back on Topic]
In the absence of a router or any other firewall, Windows firewall is better than nothing as I said in my first reply.

Quote:

---

Originally posted here by ShippMA
Hi,

1. I think that the vast majority of people here will say that the Windows firewall gives an extremely low amount of protection. Some would even go as far as to say its not even worth thinking about. (not very technical i know but well, neithers the firewall)

2. As i see it having a firewall is great an all, as long as it is kept up to date, only the necessary ports are open, and most importantly the logs are checked on a regular basis (don't think that windows firewall has logs)

As far as what i would reccomend for a firewall, the free ZA i believe is the best, was running a win xp box with only 256Mb of RAM for a while and had no resource issues. Its simple to use and can be updated automatically. Like i said earlier though, make sure that your friend checks the firewall for any suspicious stuff though, as it is VERY easy to have one and just assume your safe.

Matt

---

Absolutley, I personally think that Win firewall i just a pop up ad created my M$ to give the user the feeling that there is one 'working'. And it may have been on the vigilantminds site that I read that even with a simple UDP flood or DoS the Win firewall crashes and is useless.

Win firewall has a simple log file (i think) though I can't remember were it is, it just says wether the service is running or not (Big help).

As for a free firewall then ZA is the best go. But I was recently shaken up by an artice on govsec that said (maybe most people already know) but was purchased by some company that was linked to MOSSAD (i think) and there was a hidden XML file that somehow leaked info to somewhere (I just so paranoid and forgetful).

no, windows firewall barely meets the requirements of a firewall. It will screw up the TCP/IP stack randomly *although not as often as ZoneAlarm* It doesn't do state inspection nor monitors incoming connections, etc....I can go on and on but in short: Windows Fireall=bad!