Do I Really Need a Firewall?

You say in this article : "My position is this: If you have a hardware firewall, there is no need to run a software firewall in addition. It doesn't matter if you have a wired or wireless connection to your router.".

I've almost always agreed with what you've had to say, and I've learned a lot from your articles.
I feel the need to post and say that I consider that incorrect.

Here are a few reasons why, Number 1 : All routers for the most part come with "HARDWARE FIREWALLS" those aren't meant to protect the PC itself, they are meant to protect the software installed ON THE ROUTER, not the PC.

I've always used a Gateway setup. I can tell you from personal experience that you'd better leave your Firewall "SOFTWARE" on any Windows PC ON because Hardware Firewall are meant to protect the PC, it's meant to protect the hardware it was installed on, NOT THE ENTIRE INTERNET CONNECTION OR PC SYSTEM. There's no such thing IMO as a Hardware Firewall or Software Firewall. They are all Software and programmed Firewalls and they are placed where they should be, it's bad that people are given the open to turn them on or off honestly.

So many times people forget there is the Internet and then there is the Intranet. Perhaps someone else can elaborate on this better than me.

Like I said, the firewalls for the hardware are there as a "POWER BOX LOCK SO TO SPEAK" if you want to think in terms of a house, the Firewall on your PC is meant for all the WINDOWS on the PC. Sorry I'm bad at explanations but I am right on this. NEVER, EVER TURN OFF YOUR SOFTWARE PC BASED FIREWALLS, EVER!

Firewalls should be considered more or less "Locks on the door" : Not "DOORS", you have hardware Firewalls for routers - "Priority Locks" and you have Firewalls for systems "Meaning protecting the PC not the router".

JMO, Correct me if I am wrong.

Either way, I enjoy reading your threads Bob, I'm a fan, but I just don't think your right on what your saying here. For one reason I use a Linksys Cable Gateway and I contacted them directly about this matter and they told me "BY NO MEANS EVER TURN OFF THE FIREWALL BUILT INTO THE ROUTER" they also continued explaining how the firewall on the router protects the router setup/software, not the PC. And they said "Leave your PC Firewall on or you will have problems, because if the router was protecting everything then there would be no need for a PC Firewall". JMO.

EDITOR'S NOTE: Thanks for your thoughtful comment. The idea that hardware firewalls only protect the software installed ON THE ROUTER, not the PC, is incorrect. The primary function of the hardware firewall is NAT -- network address translation. That means that attackers, when trying to enter your PC via your IP address, will only "see" the router. They cannot detect what is connected to the router, because the IP addresses of those devices have been disguised (translated).

I have a router with a firewall but, I still leave the Windows firewall on for the extra layer of protection. It rarely ever bugs me so why not. Plus I sometimes travel with my laptop, and I don't want to worry about forgetting to turn it on. If it messes with you about something legitimate you can easily add exceptions in the firewall settings. A Google search will link you to instructions on how to do it.

To be fair, I was a bit hasty in my response. I have only used 2 Routers, or that is I should say Cable Gateway's as they are called now, or that is a modem/router combination.

Here's the thing, if you get a Virus, your router firewall "At least the one I use anyway", it's not going to block outgoing traffic or give you any type of warning or notification that it's sending information to the bad guys.

This is very important, monitoring outgoing traffic or HIPS as some call it is very important.

That's the main thing I'm trying to get across here.

The thing about it, there are so many sites these days that are bogus and no matter what you do they say you require these so called flash upgrades and such "Which are bogus" and I never install them - I go straight to the real source for such add ons, but the problem is that's how they get behind your firewall, and your router firewall is not going to protect you from such things. Actually, Windows firewall unless modified isn't either. That is unless you use something like PCTools Threatfire, and or Sphinx Windows 7 Firewall control. Which is what I use, that's the only reason I mention that.

Bob, keep up the great work! I enjoy reading your articles, they've helped me out tremendously! I appreciate it.

If I am wrong here then I apologize, you know more than me no doubt about that. I just wanted to point out the importance of blocking out going traffic also.

I guess the bottom line is, be careful what you allow on your PC, if you don't allow nothing to be installed then IMO, yes you don't need nothing but incoming blocked connections, but if something gets behind your firewalls setup, and it's a router only setup then your in for some problems I would think.

Hello Bob. I've been reading your article about firewalling and I checked my router settings. I have a linksys WRT54G2, and on the security tab the checkbox beside "Filter Internet NAT Redirection" is unchecked. Should this be checked? My son had some freinds over playing XBox and I'm wondering if they changed something to be able to connect. Thanks. Jim

EDITOR'S NOTE: From what I've read, that setting does not turn on or off the NAT security feature. It's a poorly named and fairly obscure setting, but the default is off.

Great article, Bob. I totally agree with you. I use to be a total devout follower of the "install an outgoing firewall" but even with my computer background (30 years now), I find it a complete hassle. It might provide some additional protection in letting you know about installed malware but the only good ones are a pain the the ass in how many questions they ask you and how often they ask you. And for inexperienced computer users (and you'd be surprised how many users that have been using computers for years are still inexperienced), it's a total nightmare.

I always wondered how my computer wasn't compromised (at least not visibly) despite the firewall being off all the times. I suppose my fibre connection has a very efficient firewall. Very nice article!

May I offer something? If you are worried about your computer's vulnerability on the Net, go to http://grc.com and try the Shields Up utility. It is a probe that probes all your ports. If you are behind a router, your ports (as are mine) should be nice and secure. Windows Firewall (or any software firewall) just gets in the way, and if you have a somewhat anemic machine, will just slow it down.

In a public place (internet cafe, coffee house, airport, hospital) however, they are essential.

Hi Bob, I explain the firewall this way. Imagine you lived in a house with hundreds of doors. That all were unlocked and anyone could enter through any door for any purpose. Without a firewall, your computer is open to others on the internet. Now imagine you lock all your doors, but unlock only except for known essential ones. Further, that you place a security guard on each of these so that mail only comes in the mail slot; visitors via the front door etc. A firewall acts in a similar way, only leaving designated doors (ports) available and checking that what comes in is what it is supposed to be. Is this a reasonable analogy?

EDITOR'S NOTE: Let's give those security guards a list of people who are allowed in and out, and it's a great analogy!

Hello Bob, I have a question regarding ports and the windows firewall. The thing is I deleted said firewall via "sc delete SharedAccess", and now my p2p client tells me the listening port is blocked. Can I unblock it? Will this become an issue with other programs? Thanks for your time.

EDITOR'S NOTE: Sounds like a System Restore might get you back to good.

Guitar Player -- I must step up and correct you. A hardware firewall is not designed to protect the software on the router. It is, in fact, designed to protect the connected systems behind the firewall.

Firewalls come with various features and security levels. From multi-layer proxy-based systems that will keep a gnat from going in or out undetected, to your low end consumer "firewalls" that do little more than hide your computer using nat. (sorry, couldn't resist the pun)

Regardless of how secure you need to be, the firewall is designed to isolate and protect your internal network from the untrusted network -- usually the Internet. If you have a hardware firewall, Bob is 100% correct in asserting that you do not need a software firewall.

What you are getting confused on is software security products -- often misrepresented as "firewalls". This type of software is geared toward protecting an individual computer. Some security software will focus on protection only from rogue software such as malware and viruses. Other software will additionally close down ports and inspect traffic trying to get in or out of your computer (thus acting like a firewall).

Some security software is a true firewall, with the ability to turn your computer / server into a router and protect all networked systems accessing the Internet through it.

This subject is likely closed, however, I follow your every move so it would assist me to have a list of your security protection. As I only have a 60gig hard drive I would likely have to pick and choose with windows XP. Best regards, john.