Modem with NAT firewall, do I also need a software firewall?

  • Thread starter Thread starter Mikey
  • Start date Start date
M

Mikey

Recently purchased a Zoom 5660 modem / router. It has a
Network Address Translation firewall and Stateful Packet
Inspection. The computer it's installed on also has
Zonealarm (free version) installed. Is Zonealarm still
neccesary with this modem or can it be uninstalled?
 
Mikey said:
Recently purchased a Zoom 5660 modem / router. It has a
Network Address Translation firewall and Stateful Packet
Inspection. The computer it's installed on also has
Zonealarm (free version) installed. Is Zonealarm still
neccesary with this modem or can it be uninstalled?


You do not need Zonealarm unless you like popups to tell you that the ISP is
checking that you are still active..


--
Mike Hall - MVP
How to construct a good post..
http://dts-l.com/goodpost.htm
How to use the Microsoft Product Support Newsgroups..
http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc
Mike's Window - My Blog..
http://msmvps.com/blogs/mikehall/default.aspx
 
Mike said:
You do not need Zonealarm unless you like popups to tell you that the ISP is
checking that you are still active..

--
Mike Hall - MVP
How to construct a good post..
http://dts-l.com/goodpost.htm
How to use the Microsoft Product Support Newsgroups..
http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc
Mike's Window - My Blog..
http://msmvps.com/blogs/mikehall/default.aspx

I've had Zonealarm installed on that computer for a few years (with a modem that
didn't have a firewall) and never got any popups from my ISP.
 
Mikey said:
Recently purchased a Zoom 5660 modem / router. It has a
Network Address Translation firewall and Stateful Packet
Inspection. The computer it's installed on also has
Zonealarm (free version) installed. Is Zonealarm still
neccesary with this modem or can it be uninstalled?

Zone Alarm was never necessary in truth.

The internal Windows XP Firewall would have given you as much inbound
protection as ZoneAlarm.

My suggestion - save the resources and save your sanity - disconnect from
the Internet, uninstall Zone Alarm, make sure the Windows XP Firewall is
enabled, reconnect to the Internet.
 
Shenan said:
Zone Alarm was never necessary in truth.

The internal Windows XP Firewall would have given you as much inbound
protection as ZoneAlarm.

My suggestion - save the resources and save your sanity - disconnect from
the Internet, uninstall Zone Alarm, make sure the Windows XP Firewall is
enabled, reconnect to the Internet.

But from what I understand, the Windows XP firewall only blocks incoming
traffic, not outgoing, and ZoneAlarm blocks both.
 
Mikey said:
Recently purchased a Zoom 5660 modem / router. It has a
Network Address Translation firewall and Stateful Packet
Inspection. The computer it's installed on also has
Zonealarm (free version) installed. Is Zonealarm still
neccesary with this modem or can it be uninstalled?

Shenan said:
Zone Alarm was never necessary in truth.

The internal Windows XP Firewall would have given you as much
inbound protection as ZoneAlarm.

My suggestion - save the resources and save your sanity -
disconnect from the Internet, uninstall Zone Alarm, make sure the
Windows XP Firewall is enabled, reconnect to the Internet.
But from what I understand, the Windows XP firewall only blocks
incoming traffic, not outgoing, and ZoneAlarm blocks both.

Bluntly (IMHO):
If you need outgoing protection - you're already messed up.

In other words - if you need to stop something on your computer from
communicating with something outside your computer you've either installed
or allowed to become installed something that needs to do that to fulfill
its purpose. Either you did not research what you were installing or you
have been infected/infested by something. In either case - there was
nothing keeping said application from changing the configuration of your
outgoing firewall as it installed so that you still do not know it is
communicating externally.

However - you are welcome to utilize Zone Alarm or any other software
firewall of your choice. It's not my place to say what *you* need or don't
need. I would highly suggest you leave some software firewall running on
your machine - even if you are behind a NAT device or even a hardware
firewall. It can serve to protect you from anyone also behind the same
NAT/firewall device and anyone who compromises the security of said device.
It is an extra layer of security - and one that (in the case of the Windows
firewall) requires practically no configuration by most users (or manual
upkeep of any type - as Windows Updates will keep it patched.)
 
Shenan said:
Bluntly (IMHO):
If you need outgoing protection - you're already messed up.

True enough, but outgoing protection gives you some (relatively) early warning
that your PC has been compromised; without it, you could run for years with
malware phoning home and sending your personal data (e.g., credit card info)
to the Russian Mafia.

And, if you have multiple PCs behind a router, the inbound protection of ZA
(or whatever you like) prevents one compromised PC from spreading its virii
to the other PCs.

I've been using ZAF and ZA$ on my PCs for years. ZA is far better than
M$'s firewall on XP, and far easier that M$'s firewall on Vista, IMHO.
 
True enough, but outgoing protection gives you some (relatively) early warning
that your PC has been compromised; without it, you could run for years with
malware phoning home and sending your personal data (e.g., credit card info)
to the Russian Mafia.

And, if you have multiple PCs behind a router, the inbound protection of ZA
(or whatever you like) prevents one compromised PC from spreading its virii
to the other PCs.

I've been using ZAF and ZA$ on my PCs for years.  ZA is far better than
M$'s firewall on XP, and far easier that M$'s firewall on Vista, IMHO.

I second that!! ZA (any version) gives you some more measure of
protection for monitoring Internet outgoing activity. However, there
is one thing no one mentioned before. When you have a personal
network with NAT router somewhere, your PC is still unprotected from
any additional PCs connected on your network. No NAT firewall is
monitoring the LAN activity. If you have a wireless network network
with "low" wireless security or you share with other, then your
personal info can be "exposed" to the other PCs.
 
<snipped>
Entire conversation:
http://groups.google.com/group/24ho...eaae1cd93dd/2cabf393873d5a6d#2cabf393873d5a6d



smlunatick wrote:
However, there is one thing no one mentioned before. When you have a
personal network with NAT router somewhere, your PC is still
unprotected from any additional PCs connected on your network. No
NAT firewall is monitoring the LAN activity. If you have a wireless
network network with "low" wireless security or you share with
other, then your personal info can be "exposed" to the other PCs.


Actually - that was mentioned. ;-)


Shenan said:
I would highly suggest you leave some software firewall running on
your machine - even if you are behind a NAT device or even a hardware
firewall. It can serve to protect you from anyone also behind the same
NAT/firewall device and anyone who compromises the security of said
device. It is an extra layer of security - and one that (in the case of
the
Windows firewall) requires practically no configuration by most users
(or manual upkeep of any type - as Windows Updates will keep it
patched.)

As I also said - in the end it is up to the user in question - what their
level of paranoia and security needs might be.

While I cannot disagree that Zone Alarm might be used as an 'early warning
system' - it's still plausible that the 'early warning system' could have
been modified so it ignores the calls from said program during the
installation of the application who wants to talk to the outside world.

With as many people who run with administrative rights and how easy it would
be to figure out what firewall someone was running once something starts to
execute and have a routine in place to make the proper adjustments to said
firewall as to allow silent communication - one is far better off turning
their attention to prevention of ever being in said situation IMHO. ;-)
 
in my opinion even known safe programs report usage via the internet, and I
want to know when that happens, and decide myself if it's ok, or block it.
so I would suggest a software firewall, but get a good one.
 
Mike said:
Do you check every entry in the logs?

--
Mike Hall - MVP
How to construct a good post..
http://dts-l.com/goodpost.htm
How to use the Microsoft Product Support Newsgroups..
http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc
Mike's Window - My Blog..
http://msmvps.com/blogs/mikehall/default.aspx

No, I hardly ever check the log, but just did and see there are quite a few
entries there and some could be from my ISP. If I kept seeing popups every so
often it'd be annoying. But since I don't see the popups and they only appear
in the log I don't see what the problem is.
 
But from what I understand, the Windows XP firewall only blocks incoming
traffic, not outgoing, and ZoneAlarm blocks both.

The only reasonable way to deal with malware is to prevent it from being
run in the first place. That's what AV software or Windows' System
Restriction Policies are doing. And what 3rd party Personal Firewalls fail
to do!
The only way dealing with ZA is to use:
http://zonealarm.donhoover.net/uninstall.html

For the average homeuser, the Windows Firewall in XP does a fantastic job
at its core mission and is really all you need if you have an 'real-time'
anti-virus program, [another firewall on your router or] other edge
protection like SeconfigXP and practise safe-hex.
The windows firewall deals with inbound protection and therefore does not
give you a false sense of security. Best of all, it doesn't implement lots
of nonsense like pretending that outbound traffic needs to be monitored.

Activate and utilize the Win XP built-in Firewall; Uncheck *all* Programs
and Services under the Exception tab.
Read through:

Understanding Windows Firewall.
http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfintro.mspx

Using Windows Firewall.
http://www.microsoft.com/windowsxp/using/networking/security/winfirewall.mspx

Deconstructing Common Security Myths.
http://www.microsoft.com/technet/technetmag/issues/2006/05/SecurityMyths/default.aspx
Scroll down to:
"Myth: Host-Based Firewalls Must Filter Outbound Traffic to be Safe."

Exploring the windows Firewall.
http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirewall/default.aspx
"Outbound protection is security theater¡Xit¡¦s a gimmick that only gives the
impression of improving your security without doing anything that actually
does improve your security."

In conjunction with WinXP SP2 Firewall use:
Seconfig XP 1.0
http://seconfig.sytes.net/
(http://www.softpedia.com/progDownload/Seconfig-XP-Download-39707.html)
Seconfig XP is able configure Windows not to use TCP/IP as transport
protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135, 137-139
and 445 (the most exploited Windows networking weak point) closed.

If on high-speed Internet connection use a router.
For the average homeuser it is suggested blocking both TCP and UDP ports
135 ~ 139 and 445 on the router and implement countermeasures against
DNSChanger.

Implement countermeasures against DNSChanger
http://extremesecurity.blogspot.com/2008/06/use-default-password-get-hijacked.html

And (just in case) Wired Equivalent Privacy (WEP) has been superseded by
Wi-Fi Protected Access (WPA).

Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html
Hundreds Click on 'Click Here to Get Infected' Ad
http://www.eweek.com/article2/0,1895,2132447,00.asp

Educational reading for Win XP users as well:-
Managing the Windows Vista Firewall
http://technet.microsoft.com/en-us/magazine/cc510323.aspx

Good luck :)
 
True enough, but outgoing protection gives you some (relatively) early warning
that your PC has been compromised; without it, you could run for years with
malware phoning home and sending your personal data (e.g., credit card info)
to the Russian Mafia.

And, if you have multiple PCs behind a router, the inbound protection of ZA
(or whatever you like) prevents one compromised PC from spreading its virii
to the other PCs.

I've been using ZAF and ZA$ on my PCs for years. ZA is far better than
M$'s firewall on XP, and far easier that M$'s firewall on Vista, IMHO.

Your view is misguided. If you're really concerned about Internet Security
and care about your PC you need to do some reading :)

1. Do not work in elevated level; Day-to-day work should be performed
while the User Account Control (UAC) is enabled.
2. Familiarize yourself with "Services Hardening in Windows Vista".
3. Don't expose services to public networks.
4. Keep your operating (OS) system (and all software on it)
updated/patched.
5. Reconsider the usage of IE.
5a.Secure (Harden) Internet Explorer.
6. Review your installed 3rd party software applications/utilities;
Remove clutter, *including* 3rd party software personal (so-called)
firewall application (PFW) - the one which claims: "It can stop/control
malicious outbound traffic".
7. Activate the build-in firewall and tack together its advanced
configuration settings.
7a.If on high-speed internet connection use a router as well.
For the average homeuser it is suggested blocking both TCP and UDP
ports 135 ~ 139 and 445 on the router and implement countermeasures
against DNSChanger.
And (just in case) Wired Equivalent Privacy (WEP) has been superseded by
Wi-Fi Protected Access (WPA).
8. Routinely practice safe-hex.

Also ensure you do:
a. Regularly back-up data/files.
b. Familiarize yourself with crash recovery tools and with
re-installing your operating system (OS).
c. Utilize a real-time anti-virus application and vital system
monitoring utilities/applications.
d. Keep abreast of the latest developments.

And finally:
Most computer magazines and/or (computer) specialized websites are *biased*
i.e. heavily weighted towards the (advertisement) dollar almighty!
Therefore:
a. Be cautious selecting software applications touted in publications
relying on advertisement revenue.
b. Do take their *test-results* of various software with a
*considerable* amount of salt!
c. Which also applies to their *investigative* in-depth test reports
related to any software applications.
d. Investigate claims made by software manufacturer *prior* downloading
their software; Subscribing to noncommercial-type publications,
specialized newsgroups and/or fora (to some extend) are a great way
to find out the 'nitty-gritties' and to consider various options.

Interested? Wanna know details? Go ahead and ask :-)
 
I second that!! ZA (any version) gives you some more measure of
protection for monitoring Internet outgoing activity.

Most 3rd party software (so-called) firewall applications are nothing but
snake oil; They give you a false sense of security!

<snip>
 
in my opinion even known safe programs report usage via the internet, and I
want to know when that happens, and decide myself if it's ok, or block it.

Respectfully, how would you know?
so I would suggest a software firewall, but get a good one.

Which one?
 
No, I hardly ever check the log,

This is part of the problem...
but just did and see there are quite a few entries there and some
could be from my ISP.
If I kept seeing popups every so often it'd be annoying.

Especially if the messages are not understood.
But since I don't see the popups and they only appear in the log I
don't see what the problem is.

Now, re-read your own post :-)
 
Recently purchased a Zoom 5660 modem / router. It has a
Network Address Translation firewall and Stateful Packet
Inspection. The computer it's installed on also has
Zonealarm (free version) installed. Is Zonealarm still
neccesary with this modem or can it be uninstalled?

NAT is not a firewall.
 
Mikey said:
No, I hardly ever check the log, but just did and see there are quite a
few
entries there and some could be from my ISP. If I kept seeing popups
every so
often it'd be annoying. But since I don't see the popups and they only
appear
in the log I don't see what the problem is.


Many of the entries in the log will be your ISP polling the IP address. Most
set the firewall to only see critical popups which is all very well except
that the not so critical entries may still be phoning home.

A better way to see if the computer is sending out without any prompts from
you is to use something like Netmeter. Try it..


--
Mike Hall - MVP
How to construct a good post..
http://dts-l.com/goodpost.htm
How to use the Microsoft Product Support Newsgroups..
http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc
Mike's Window - My Blog..
http://msmvps.com/blogs/mikehall/default.aspx
 
Back
Top