Is Router Firewall Enough

[caveman]

Now that I understand the basics of router firewalls a little better, I have a couple of questions, three in fact:
(a) If router firewalls work on the principle of no data allowed in unless requested. How do you get Live Updates for AV software and Windows Update. There was a security patch on MS site waiting for DL when I visited yesterday, that would (I thought) have normally DL automatically.
(b) If these firewalls don't prevent outgoing traffic. What dangerous outgoing traffic exists, and should it be prevented.
(c) If so, what are your views on running both software and router firewalls to prevent this traffic.

I only run my router firewall, not any software, and I've had no problems.

[philip.j.fry]

(a) Because it is your computer that is requesting the data, i.e. LiveUpdate requests that updates be downloaded, it shouldn't matter

(b) Some viruses and malware can send out data, if you keep your AV and anti-spyware up to date and know what's running on your PC this isn't really an issue

(c) Having more than one firewall can be a problem (I've just found this out with a client)

i must admit since ive had a router, my software firewall has never picked up any attacks. However the software firewall is useful to allow you to stop applications accessing the net if you want to stop them for some reason

[jtwn]

Yeah, thats the only reason i used to use mine, stopping outbound connections.

[Stu038]

A software firewall is useful for protecting the indvidual PCs on your LAN from each other (why do kids think that the cd from a mate is safe so its ok to disable the AV software because its stopping that must have util from working?) espeacially if your Router is cheap like mine and only firewalls the WAN port.

[SMHarman]

Originally Posted by Stu038

A software firewall is useful for protecting the indvidual PCs on your LAN from each other (why do kids think that the cd from a mate is safe so its ok to disable the AV software because its stopping that must have util from working?) espeacially if your Router is cheap like mine and only firewalls the WAN port.

Huh, we are talking firewalls here, not AV, each PC should still have its own AV and Spyware. If you have untrusted machines behind your firewall, on your network then thats a strange situation to be in, they should be in a DMZ and even my linksys WRT54G can have a DMZ'd machine if you want.
Personally I have not firewall apart from the linksys and run AV on all my machines.

[Stu038]

Originally Posted by SMHarman

Huh, we are talking firewalls here, not AV, each PC should still have its own AV and Spyware. If you have untrusted machines behind your firewall, on your network then thats a strange situation to be in, they should be in a DMZ and even my linksys WRT54G can have a DMZ'd machine if you want.
Personally I have not firewall apart from the linksys and run AV on all my machines.

I'm certainly not an expert on network security, but the point I was trying to make was that you don't run a single PC with just AV and spyware, you have a firewall as well. If for whatever reason one PC on your network becomes "unsafe" then the additional protection awarded by a software firewall on them all is worthwhile.
In my case my eldest lad decided that the application he was trying to run must be safe because the CD had come from his mate so he disabled his AV which in his view seemed to be causing a compatibility problem. The firewall on his machine flagged up and blocked the resulting "access request" before the problem got onto the network.

The firewall on my router just covers the WAN port and not the LAN ports, so without the the software firewall that little incident may have caused problems for the other PCs on the network.

At the end of the day it doesn't matter what you tell 16 year olds they all think they know best when they've got a GCSE in computing

[SMHarman]

Originally Posted by Stu038

The firewall on my router just covers the WAN port and not the LAN ports, so without the the software firewall that little incident may have caused problems for the other PCs on the network.

At the end of the day it doesn't matter what you tell 16 year olds they all think they know best when they've got a GCSE in computing

Sounds to me like you need to take administrator rights away from him .
What happens next with him installing a virus on his machine is an interesting one. I'm not hugely up to speed with viri these days, but from what I read most seem more intent on sending information from the host machine to the internet, or using the host machine to create mail or as a server for dos attacks. I have not heard of viri that try to attack the subnet they are attached to, in a corporate environment, again most spread by utilisation of email as the transport mechanism, not targeting IP addresses.

[Matth]

A Router firewall does the job the the "Windows Firewall" tries to do, and does it a lot better.

You would add a software firewall, for the same reason that you'de use one to replace the Windows firewall - to provide more control - The router firewall cannot tell the difference between, say, your ICQ client software, and a trojan that logs into an ICQ channel for attack instructions.

In some respects, current software firewalls are a microcosm of how a corporate installation would be set up, but instead of administering access to different systems, the software firewall administers access to different programs.

Practically - if you would run a "permissive" software firewall, granting anything that asked, you would NOT gain any protection over and above a router.

If you are prepared to take a step back, and ask, "WHY does this need to communicate with somewhere?", then you will improve your security with a software firewall from behind a router.

I must admit, I'm seriously considering throwing a router into my setup, even with only one PC, as at the very least, it provides protection if the firewall has to be dropped during update, or if you have to disengage the software firewall due to problems.

[Stu038]

Originally Posted by SMHarman

Sounds to me like you need to take administrator rights away from him .

Love to, but as he bought it himself from a summer job a couple of years back its not that easy

I'm not hugely up to speed with viri these days,

Nor me, but I always work on the basis better safe than sorry.
Even if the thing, I forget the name now (It'll come back to me in the middle of the night ) wasn't malicious the rate it was trying to get out would have caused browseing and networking problems for the other PCs.

Still he's not done anything similar since, I think he's still deaf from all the shouting Mrs Stu did