FIREWALLS - WHY YOU NEED ONE AND WHAT TO DO
AS FOR FIREWALLS GENERALLY:
Numerous people have thought they either have no firewall [which they do if using XP, particularly SP2], or have disabled or THOUGHT they disabled or un installed all of them during attempts to diagnose network issues. Others believe you don't need a firewall, particularly if your on dial-up or behind a router. Do NOT think you are invisible or safe just because there are millions of other users on the Internet. Every ISP has "lurkers" who monitor the ISP for parties not using a firewall. And broadcast "collectors/sniffers" and worse, are almost everywhere.
YOU NEED A FIREWALL.
Security Suites generally install their own, Anti-virus programs sometimes have their version or may impart a form of firewall style protection, and even the wireless and router install programs may include their own version. Check what is running by using a monitoring program such as process explorer, regmon, or filemon by sysinternals on the computer, recheck the XP and servers, and make absolutely sure there are none conflicting/blocking access.
Attempting to run more than one firewall on any given computer does not increase security, but may actually decrease it.
I generally recommend using a third party firewall rather than relying on Microsoft's UNLESS you're only a local network. However, if the computer accesses the Internet in any fashion, get a third party firewall. Remember, everyone who uses Microsoft products got the same firewall, that includes the hackers, virus writers, and others who wish to attack you. They know its flaws, its limits, its defaults, what can be configured, and its CODE and footprint [what type of block/what happens when attacks are placed against it].
INTERNET USAGE - SECURITY - NETWORKING - FIREWALLS
Using the Internet requires you to provide your own local security since you become part of the INTERNET network. It has always been recommended to use LAYERED security.
- The first is your ISP and its security which you have no control over other than complaints or suggestions.
- The second is the modem router or router if possible. This device wil provide a form of hardware firewall. When properly configured, it will only allow access to properly assigned addresses unless hacked, generally by something which the user allows. HOWEVER, once you access the Internet, it is part of your network, and home or even the lower cost business grade routers know little more than to direct the traffic where it should go.
- The third is the software firewall. All computers accessing the Internet must have a good software firewall installed, particularly if on dialup. A good firewall will help protect against attacks from outside {Internet hackers} and some of the software/coding which might be unwhitingly installed while on the Internet by browsing.
- The fourth is your anti-virus, spy ware detection software, and removal tools. The first two [router and firewall] will protect you from blatant attacks, but provide little protection from problems which you might install or which are installed via Internet usage on websites or via their coding. Also, the addition of "browser bars" adds direct input to the Internet accessing computer, since they are generally connected to the "service" upon connecting to the Internet..
- The fifth is your local security settings. How much control you have placed upon the Internet usage via the Browser, Email, FTP client, and News Reader programs will determine how hackable you are. Java, Windows Scripting, ActiveX, DirectPlay, Flash, RealPlayer, Quicktime, and like "enhancements" provide potential additional hackable access points.
- The sixth is sensible usage. If your P2Ping, going to p_nography sites, or other questionable activities, you are obviously more open to attack and compromise. You will be required to pay much closer attention to your system.
- The seventh is monitoring usage, network traffic, and reviewing logs. Using your: firewall logs; system control logs [like in XP, NT, and the like]; and specialty monitoring programs, you can occassionally review those logs created to properly control the potential issues that might occur do to the Internet usage.
Part of Layered Security necessary for Internet usage.
SEE:
Anti-virus programs
SEE:
Anti-spyware programs as part of Layered Security
FIREWALLS - I don't need one.
For those WITHOUT firewalls, GET ONE IMMEDIATELY.
Without a firewall you are wide open to any attack by anyone. Moreover, you are likely being used to bounce illegal mail or other unlawful activities, and any information on your computer is wide open for recovery by hackers. You may also be used for P2P activities [such as transferring p_nography or hacked programs] WITHOUT your knowledge and be unknowingly engaged in criminal activities.
I noticed, over the years, a number of supposed recommendations that
firewalls are not necessary, or that they would be disabled by a good hacking
program.
That's not entirely accurate. A good firewall will pop up notification
when something attempts to disable it. Moreover, a log will be created
concerning the attempt.
Also, the firewall would likely pop-up a notification of a new program attempting contact, and check any programs against their MD5 checksums [or otherwise]. If its not listed or changed, and you will be notified.
Here's an even more ridiculous idea that seems to be taking the Internet by storm: Since the advent of routers and high speed access, many home users believe that they ONLY need the protection of that router.
Depending upon the cost/what was paid, the typical home router MIGHT have QOS, improper packet formation detection, and the ability to detect attempts to search for local addresses. No router will have the ability to monitor applications, their usage of the Internet, the MD5 check sums for that application, or the ability to limit applications to specific addresses UNLESS the router has a software hardware included in its program.
Further, the router will have no way of knowing when something LOCAL [using an acceptable address] is hijacked for other use.
Manual Firewall Connection setup for specialized access or purposes
Many programs, such as P2P, require manually configuring special ports and settings in Windows XP firewall or any other OS and firewall, to be setup. The basic way to do this is as follows:
Using XP's firewall as example [replace it with something else for Internet use]:
1. Click the Start button on your taskbar and choose Control Panel.
2. Double click on Network Connections.
If you don't see Network Connections, click once on Network and Internet
Connections, then click once on Network Connections.
Look for a connection that says both Enabled and Firewalled, with a little padlock icon in there. In most cases this would be labeled Local Area Connection.
3. Right click that connection, and choose Properties from the menu that comes up.
4. Click the Advanced tab, then click the Settings button.
5. Click the Add button.
6. Fill in the proper information relating to the program in the fields provided:< br />
- a. Description of service: [name - such as the actual application/program name]
- b. Name or IP address: localhost [or the specialized server address created locally]
- c. External Port: [EXAMPLE - 6346]
- d. Internal Port: [EXAMPLE - 6346]
- e. Make sure the proper option is chosen [such as: TCP; FTP; UDP; UPnP; ICMP; Ping, etc. per support in firewall].
7. Click the OK buttons to close all three dialog boxes, then close the Network Connections window by clicking the close button in the upper-right corner.
In other third party firewalls [most newer firewalls now automatically detect and setup this up] you will find these abilities under the area for administration, or setup, or configuration. Regardless of where its located in the firewall, the key is to use the proper ports and protocol for the particular activity you are attempting to allow through the firewall. If you are unsure of what ports and protocol, please see the documentation, faqs, or contact support for the particular application/product, and see the links below.
Regarding auto setup: it is generally better to set this up manually {if possible}, as often the automatic setup allows too much access [such as by allowing full access via any port], thereby, potential security risks are involved. Please note though when manually configuring access: you may have to setup more than one firewall rule, such as one for TCP and one for UDP, for the application/program access to the network or Internet and with the actual allowed port(s).
Rules based firewalls will provide the best protection, as they are much more configurable.
P2P PROGRAMS - file sharing
Running P2P may be causing issues related to various forms of attacks against the router and/or firewall such as denial of service [DOS attacks]. This may require you to reload the connection computer and accessing computer, or refresh the connection(s) to clear attempted hacks and attacks. There are times though, when even this will not completely clear/stop the attacks. Disconnect the master access via the Modem by shutting it off [electrically] for 10 minutes or so, and then reconnect. Check your firewall log(s) to find the attacking/hacking sites/addresses and add them to a ban/blocked list in your firewall [specific address, port, and connection style - UDP, ICMP, TCP, etc.] or otherwise, such as via the hosts/lmhosts file [specific address/name].
THIRD PARTY FIREWALL PROVIDERS
BlackICE PC Protection (~$39.95 and up)
http://blackice.iss.net/
Jetico Personal Firewall (Free)
http://www.jetico.com/index.htm#/jpfirewall.htm
Kerio Personal Firewall (KPF)
http://www.kerio.com/kpf_download.html
Last free version [works well in Win98 and SE, ME]:
http://www.321download.com/LastFreeware/page7.html#Kerio%20Personal%20Firewall
Outpost Firewall from Agnitum (Free and up)
http://www.agnitum.com/download/
http://www.agnitum.com/products/
Sygate Personal Firewall (Free and up)
Older versions [Symantec pulled the old site down when they bought
Sygate]:
http://www.oldversion.com/program.php?n=sygate
http://www.tucows.com/get/213160_90233
Symantec's Norton Personal Firewall (~$25 and up)
http://www.symantec.com/sabu/nis/npf/
ZoneAlarm (Free and up)
http://www.zonelabs.com/
Old Versions:
http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html
Infomation for firewalls in general, and Kerio PF
Proper setup of your firewall is crucial. It is the PRIMARY [door] key to
your personal protection, make sure to take the time to set the firewall up for
your individual usage. Lock that door as tight as you can.
www.geocities.com/yosponge - general firewall information - Kerio PFW
http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/ip.htm
http://www.linuxsecurity.com/resource_files/firewalls/firewall-seen.html
http://www.dslreports.com/faq/security/2.5.1.+Kerio+and+pre-v3.0+Tiny - Kerio
PF
http://www.dslreports.com/forum/remark,6642367~root=kerio~mode=flat
http://www.dslreports.com/forum/remark,8023708
Do
you need, or know enough to use TPF/KPF?Is it still be usable, will it
protect me? [Since this is a highly configurable, rules based firewall; it
provides adequate protection in 9X/ME. Perhaps others as well.]
http://homepage.ntlworld.com/robin.d.h.walker/cmtips/security.html#persfire
http://www.ja.net/cert/bcp/lanports.html
KB223136 -
Microsoft
http://www.networksorcery.com/enp/protocol/icmp/msg9.htm
http://www.iana.org/assignments/multicast-addresses
http://www.iana.org
http://www.derkeiler.com/Newsgroups/alt.computer.security/2004-10/
http://ip-lookup.net/?224.0.0.2
Yosponge on other aspects found on the Internet - othrstuf.html
www.faqs.org/rfcs/ -
Internet RFC/STD/FYI/BCP Archives
Other Parts of Layered Security necessary for Internet usage.
SEE:
Anti-spyware programs as part of Layered Security
ANTI-VIRUS Programs as part of your Layered Security
INSTALLATION OF SIGNING AND TRUST CERTIFICATES
GENERAL WINDOWS NETWORKING DIAGNOSTICS AND SETUP
SEE also:
Diagnosing
Windows problems - Part 1
Part 2 -
Diagnosing Windows Problems
After support end information for 98 for networks/users still using this OS:
SEE:
END OF SUPPORT
FOR WINDOWS 98 AND MILLENNIUM. WHAT DO I DO?
SEE:
Manually updating a new installation of Windows 98SE