[RESOLVED] Hardware & Software Firewalls

At work we currently have 4 XP HOME machines networked through a NETGEAR hub. One machine dials up to our ISP and the others connect through the first in an ICS configuration.

Well, we're biting the bullet and getting a T1 line (in conjunction with a local & long distance phone package). My questions regard firewall security.

We had been using XP's firewall on the machines. In preparation for the change to T1 (and to see just how it works and because I'm more than paranoid about a direct T1 connection), I installed SYGATE firewall on three of the machines. I had discovered that ZONEALARM does not work with ICS.

I also bought NETGEAR's FR114P router with ProSafe Firewall to replace the hub

I've seen that SYGATE questions outgoing packets and that you can disallow, allow or always allow certain programs access to the net.

Does the router firewall question outgoing packets in the same manner? Are these questions directed to the machine that is requesting net access or to the first machine configured with the firewall? Is it really necessary to have a software firewall other than XP HOME's?

Thanks in advance,

Terry

Hi Terry,

The Windows XP firewall blocks incoming traffic but it doesn't block outgoing like a personal firewall like Kero. If you wish to block outgoing traffic then I would disable the Windows XP firewall. It isn't necessary to use two software firewalls. The router blocks incoming traffic on the local area network. It's like a extra layer of defense but it doesn't control outgoing either.

I am coming to believe that I have been under a MAJOR misunderstanding. I thought that hardware firewalls checked outgoing information too.

If they don't, what is the advantage of having a router rather than just a hub while using a software firewall on each machine?

Most SOHO routers allow outbound traffic. What is the advantage of having a router rather than just a hub? The main difference is NAT routers have a DHCP server which elimates the need for Internet Connection Sharing (ICS).

I see. So the router firewall will check incoming traffic and the individual software firewalls will check outgoing. Makes sense to me.

On my home computer, I use ZONEALARM. But it is not networked - just a solitary machine.

What would you recommend for software firewalls for the 4 networked machines at work?

Yes, it will. A software firewall can also protect you from unauthorized traffic to any of your computers on the network as well as the Internet. If a malicious program makes it on to one of your networked computers, it could potentially spread to the other computers on the network. Norton or ZoneAlarm are both of my favorite personal firewalls.

Thanks.

I have ZONEALARM at home (for many years) and SYGATE installed only last week on most of the machines at work. Maybe it's my unfamiliarity with SYGATE, but ZONEALARM seems more user friendly.

I guess I could remove SYGATE and see how ZONEALARM does on a network.

And I have ZA for years also, but prefer sygate now. Much easier to setup for my usage.

Deja Vu?

Actually, it's not deja vu. I did post this to more than one site. Different forums, different ideas.

Another question about this setup ...

The T1 line will come with a router. I have been told that because of responsibility issues, the phone company will NOT activate the firewall on this browser. Knowing this, I bought the NETGEAR router mentioned in my initial post.

What problems will I face with two routers in tandem here? My browser will have 4 computers hooked to it. My browser will then be onnected to the phone company's browser which will then be connected to the T1 line.

Any ideas of problems I should be aware of in advance? Address problems?

Thanks again for all your ideas so far.

PS> Searching the net I keep seeing references to DHCP. Do I want this or not and what is it?

First of all, let's get the terminology right - you say browser, but you mean "router"? A browser is your software used to view pages on the internet - Internet Explorer, Firefox, etc.

So if you have a T-1, most ISP will provide a router and give you your IP Address assignment and thats where they stop. You will have to program your NetGear router in accordance with the IP address the phone company gave you, since I've never seen a T-1 assigned with DHCP.

Speaking of DHCP, you want it internally for ease of use. It means Dynamic Host Configuration Protocol, and it assigns your computers their IP Addresses automatically.

DUH. Of course, I meant "router" not "browser".

We already have ICS with a hub. So, I'm aware that there is an intranet consisting of our 4 computers. Their addresses are 192.xxx.xx.xx or some such thing.

I guess what confuses me is ... if the first router (connecting to the T1 line) uses addresses 192.etc inward then the second router has 192 as the "outward" address coming into it from the first router - what are the inward addresses from the second router? Or is it possible to have the T1-connected router just pass through addresses without changing them. I guess this address manipulation is referred to as NAT (correct?). So can I shut of the NAT in the first router and use it in the second? Am I clear here? Do I even need that first router? The NETGEAR router I bought has an ethernet connection "outward". Why couldn't I connect the T1 to that?

This is the second time we've tried to get a T1 line. First time was last summer. I was so confused as to what I would need to do to get it runnning correctly, and none of these questions (including firewall security) would be answered by the phone company (Allegiance) that I cancelled the installation. I am now dealing with X O, and am having these same uncertain, sinking feelings. We already will have to fork out about $400 to hire a third party to physically connect the phone lines part of this package to our internal physical phone system (which I was unaware of when we agreed to this). Now they are suggesting that I hire a third party to also do the T1 connections to our intranet. Of course, none of these "extras" were fully explained when we signed the contract. Basically, they run the T1 package lines into our office space and that's it. Needless to say, I'm not a happy camper.

And, never having done this before, my anxiety level is quite high. I remember setting up four Windows 98 machines into an ISC configuration. What a nightmare that was! Now we have four Windows XP HOME machines. I hope this will be easier.

Thanks again for your input.

Let me ask what appears to be an obvious question, or at least to me:

Why do you need 2 routers for 4 PC's?

If you do, then first of IP Addresses can be anything you like but stick the the set dished out by the router, such as 192.168.1.100.
On the second router which creates a second subnet, you can make that anything you like and over-ride the router settings, but make it easy with 192.168.2.200 which would identify all users as being on the second subnet.
Put some sort of lable on the routers to identify wti the "gateway address" either 192.168.1.100 or 192.168.2.200.

Quote:

---

Why do you need 2 routers for 4 PC's?

---

Beats me. But from what I understand, the first router will be supplied by XO (the phone company supplying us the T1). When I initially asked about it's firewall, they said that it does not come with one. When I pressed, they said that it does have one but that it is not "activated". That way they cannot be held responsible if there are any problems with security - that will be our responsibility and not theirs. They said it is up to us to provide firewalls, etc between their router and our machines.

So I bought a second router (the NETGEAR) to put between their "non-firewall" router and our machines. This where my mis-understandings and anxiety begin.

Quote:

---

If you do, then first of IP Addresses can be anything you like but stick the the set dished out by the router, such as 192.168.1.100.

---

This assumes that I will have some sort of control over that first router. If the "firewall" on it is not activated, I don't know if it functions as it it were a hub with no address translations.

I'm not sure whether I need that first router at all. I don't know what sort of connection the T1 ends with. If it is just an ethernet cable, I guess I could bypass the first router altogether. Though I don't know whether the vendor will allow this.

A lot of this anxiety stems from my never having done anything like this. From the post responses here and in another forum, it looks like no one else has ever had to deal with a phone company installing a T1 line for them. That makes me even more anxious. As just the office manager here (and not a computer specialist versed in hardware), I have only these forums to use for help. The vendors pretty much take a stand-off approach. They may be used to dealing with large companies with a TI department that knows all this stuff. Unfortunately, we are only a 12 person company and don't have a TI department - unless you count me.

Okay, I think I understand your issue. All you need to know is the IP Address of that first router. Your second router will look to the first one to be the "gateway" and will issue DHCP addressing to the four machines.
Just make sure you enable all the security features on the second router becasue it is going to be exposed to the entire world without good security.

When you say "gateway", what do you mean? If there is no firewall on that first router, can I assume that the address of that router is the same both in and out? So that the second router DOES NOT realize that it's not directly connected to the net? I bought the second router to have that firewall protection. I'll also have software firewalls on all four computers.

Sorry to sound so dense but this IS the first time I'm ever doing this.

Don't worry about sounding "dense", the phone companies (especially XO - I cannot stand them) don't do anything to help the end customer. All they care about it selling the circuit.
It's very likely that the first "router", the one supplied by XO, will simply route an "Internet" ip address, meaning not one in the 192.168.x.x range. This is typical. Most non-techies associate the word "router" with these home networking Cable/DSL routers you can buy at CompUSA or any local computer shop. But a telco's router is quite different. In your case it's acting more like a DSL/Cable modem but on a little higher level. Your Netgear "router" is required for NAT and DHCP in your internal network.

Good explanation, although the first can also be a router ib some cases. The first device (let's gets simple) will just supply an IP Address from which your router will translate DHCP, but your router is still open to the internet so change all the default setups with regrads to password and lock it down.
Your manula will have documentaion on this. If it is a Netgear router, the internal address will be 192.168.0.1 with a user name of admin and password of "password". chnage bother of those values to something else.

Thanks. You've all made this a bit more clear to me.

And you're right, 10ECsoon, the vendor really don't seem to care about anything except the sale. I won't go into the "sign this week" pressure that would have given us the first 3 months at half price - an offer that somehow evaporated after we signed because the company had rescinded the offer but "neglected to tell the sales staff". Since they won't do the actual connection to our internal phone system, they're "recommending" third parties that, of course, want to charge us an arm and a leg. They've "recommended" a third party to connect the T1 to our intranet, but I was pretty sure I could do this ... what with my history of setting up ICS on four previous Win98 machines and now with four XP HOME machines ... and this wonderful forum with it's knowledgable members (shameless flattery, I know)!

Now to try to figure out if I want DHCP or not on this intranet with 4 wired machines. I think not but I'm open to suggestions.