How many firewalls are too many?

**DiGiTaIErRoR** · Sep 26th, 2003, 11:31 AM

I just noticed VisionIT's sig with 4 firewalls in it.

How many is too many though?

**parksie** · Sep 26th, 2003, 11:45 AM

I'd think that was maybe overkill. One firewall should do the same job as any other, it's really just configuration that could cause problems.

Here, I have one net-facing firewall (OpenBSD's pf), and on the internal Windows machines, ZoneAlarm for outgoing protection.

**DiGiTaIErRoR** · Sep 27th, 2003, 03:55 PM

I've never liked Zonealarm....

I use Sygate.

**Kasracer** · Sep 27th, 2003, 04:20 PM

Anymore than 1 good software firewall is just stupid. It makes packets have to go through each firewall, each 1 has to check it.... it's just stupid, can slow things down and even currupt incoming/outgoing packets.

I'll try to find the article I had before, but there are alot of problems that can and will occour if you use more than 1 software firewall on 1 pc.

Having a nice hardware firewall into a router using nat and then to each computer with a software firewall is ideal

**DiGiTaIErRoR** · Sep 27th, 2003, 06:03 PM

I used to have Conseal PC Firewall by signal9.

It was like a hardware firewall in many aspects, except more feature rich.

It was wholely based on protocols and ports, rather than what seems to have become today's standard of application management. I think a mixture of the two would be ideal.

I was running my firewall(Sygate) on XP and still got blasted.

Ironically... my firewall caught the TFTP trying to spread it, but didn't capture it incoming. Which didn't make much sense as my messenger and RPC services were off.

**parksie** · Sep 27th, 2003, 06:49 PM

Software firewalls like ZoneAlarm are in the good position, being vaguely OS-integrated (services/device drivers/etc.), of being able to know which application has opened which socket, or performed some operation.

Hardware firewalls are denied this information, so they just have raw rules to work on, which is great for incoming stuff, not so great for egress filtering (you can do the normal stuff like anti-spoofing, but not much else).

**Kasracer** · Sep 27th, 2003, 07:26 PM

Originally posted by parksie
Hardware firewalls are denied this information, so they just have raw rules to work on, which is great for incoming stuff, not so great for egress filtering (you can do the normal stuff like anti-spoofing, but not much else).

What hardware firewalls have you used? They all can do advanced filters and all sorts of good stuff, especially anti-spoofing.

That's why hardware firewalls are so damn expencive! Cheapest I've ever seen a semi-good hardware firewall go for was about $200 on eBay.

Don't confuse NAT with a firewall, because it isn't 1.

**parksie** · Sep 27th, 2003, 07:46 PM

Trust me, I'm not.

But your hardware firewall isn't to know that a connection to a site on port 80 isn't your web browser, but instead some spyware. A software firewall actually on the machine *will*. That's the general point I was trying to make.

Oh, and anyone wanting to say that you can't do per-program rules on Unix, you *can*. Look up systrace

Edit: My hardware firewall is an OpenBSD 3.3 box

**VisionIT** · Oct 1st, 2003, 04:41 AM

Originally posted by kasracer
[B it's just stupid, can slow things down and even currupt incoming/outgoing packets.[/B]

Hi All.

I agree it can slow things down, but only by a few ms, nothing stupid about that... and the corruption B$, that's completely wrong.

Providing each firewall runs properly in it's own right, it shouldn't interfere/corrupt with ANY packets, regardless of where they were sent from.

Just a quick note though... I don't use all the firewall software on one box... they are spread between several systems, some running one, other running two or more. I had an instance of someone breaking through a Norton install (which isn't hard anyway!) and then trying to hack through Sygate... which was fun to watch!

I don't think you can take security lightly, and any software is better than nothing. I lost around 4GB's of important work when a CodeRedII attack broke through the firewall, and wasted one of the systems!!! Since then, I don't take ANY chances.

Kasracer... don't try to tell Parksie his job... it's like teaching ma' to suck eggs!

NAT can be configured as a basic firewall, but it would need constant modifications in order to be any use.

Anyone wondering what this posts about, check out my sig...

**plenderj** · Oct 1st, 2003, 06:14 PM

To be honest, I don't see a problem with NAT. For anyone who actually knows what's going on, if inbound packets not coming 'through' an already established outbound connection are just ignored, then there's no way for them to get through.

So a single hardware firewall is what I've installed in our own sites, and all of our customer sites. (all permanent connections to the web with a static IP, and port 25 mapping through to exchange for ETRN and SMTP email setups)

**VisionIT** · Oct 2nd, 2003, 04:41 AM

Originally posted by plenderj
To be honest, I don't see a problem with NAT. For anyone who actually knows what's going on, if inbound packets not coming 'through' an already established outbound connection are just ignored, then there's no way for them to get through.

Hmm... i'de agree with that, to a point!

Only problem with that theory would be any existing exploits of the packages which are already connected... such as RHN's openssl fix a few days ago... NAT wouldn't stop that, but a firewall may...

I like NAT, I think it's pretty damn easy to use, and simple to reconfigure, but it's only helpful when you can ensure all packages which are granted access don't have their own problems (which is almost never!)

Firewall-1 rules though!

**parksie** · Oct 2nd, 2003, 04:50 AM

RHN? Red Hat? O.o

Either way, yeah. I still patched my openssl and more importantly things like sendmail/openssh which have appeared in the last couple of weeks or so.

BUT PLEASE FOR THE LOVE OF ALL THAT IS DARK AND MANKY WOULD PEOPLE *PLEASE* STOP HAMMERING MY ROUTER ON PORT 135 THERE IS NOTHING FOR YOU THERE!

*twitch twitch convulse*

*falls over*

**VisionIT** · Oct 2nd, 2003, 05:00 AM

Originally posted by parksie
RHN? Red Hat? O.o

Either way, yeah. I still patched my openssl and more importantly things like sendmail/openssh which have appeared in the last couple of weeks or so.

BUT PLEASE FOR THE LOVE OF ALL THAT IS DARK AND MANKY WOULD PEOPLE *PLEASE* STOP HAMMERING MY ROUTER ON PORT 135 THERE IS NOTHING FOR YOU THERE!

*twitch twitch convulse*

*falls over*

RHN? Red Hat? O.o (eh?)

Sounds to me like someone's infected with Sobig.X!!!! I had thousands of hits on 135 (location service) a few weeks ago from someone infected with that damn virus. The logs make for a good read though!

Parksie, you need to get that twitch sorted... you're blurring when you type!

**parksie** · Oct 2nd, 2003, 05:21 AM

"RHN's openssl fix"

**VisionIT** · Oct 2nd, 2003, 05:27 AM

Originally posted by parksie
"RHN's openssl fix"

https://rhn.redhat.com/network/errat...s.pxt?eid=1854

It's quite a nasty one too

It fixes that ASN.1 parsing problem, which everyone should know about by now!

**parksie** · Oct 2nd, 2003, 05:29 AM

No I knew what the vulnerability was because I was patched before I got most of the mailings about it :P

Was just asking who RHN was...so it *was* Red Hat like I guessed

**VisionIT** · Oct 2nd, 2003, 05:35 AM

Yep, Redhat Network

Anywayz, i'm cream crackered and i'm going back2bed!

View Poll Results: How many firewalls are too many?

Thread: How many firewalls are too many?

Thread Tools

Display

How many firewalls are too many?

Posting Permissions