Windows 7 firewall question

R

rfdjr1

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
..pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
 
P

Paul

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
.pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
http://en.wikipedia.org/wiki/Zonealarm

"It includes an inbound intrusion detection system, as well as the
ability to control which programs can create outbound connections."

http://en.wikipedia.org/wiki/Windows_Firewall

"XP's Windows Firewall cannot block outbound connections; it is only
capable of blocking inbound ones."

"Windows Vista

Outbound packet filtering, reflecting increasing concerns about spyware
and viruses that attempt to "phone home". Outbound rules are configured
using the management console. Notifications are not shown however for
outbound connections."

So the Windows firewall is gradually catching up, but doesn't function
exactly like ZoneAlarm.

A basic firewall, is intended to help prevent incoming connections to
specific ports. That is what you'd expect by default. Doing something
with outgoing connections, is the part ZoneAlarm is most noted for
(alert when something phones home). Since malware (like a Trojan)
can "own" a computer though, I wouldn't think that ZoneAlarm is going
to be able to stop a malicious attempt to communicate. Once something
is running on your machine, all bets are off. ZoneAlarm is going to
alert you during "naive" attempts, like say a Google Toolbar calling
home, or Adobe trying to update Flash or Acrobat Reader.

Paul
 
D

Dave \Crash\ Dummy

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
.pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
http://www.google.com/search?q=windows 7 firewall outbound
 
B

Big Steel

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
.pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
I use the Windows Firewall since XP. I have never had any problems with
it, which can stop inbound and outbound traffic on Win 7.
 
E

Ed Cryer

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
.pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
I moved from ZoneAlarm to the free Comodo firewall some years ago; and
I've stuck with it. It does a fine job on in/out connections and has all
kinds of tweakability settings for personalization.

Ed
 
D

Dave Cohen

I've had Windows 7 Pro, 64 bit installed on my machine for two years
now. Ihave never used the Windows firewall, opting instead for the free
version of Zone Alarm, which I've used for many year without a porblem.
As of late, Zone Alarm is causing me headaches, not remembering settings
and denying downloads of files without telling me why. An example of
this is today, I was trying to download a .pdf file of an owners manual,
and it kept crashing. After about a dozen tries, it dawned on me to shut
down Zone Alarm, and sure enough, the file downloaded with no problems.
So, I'm now wondering how reliable is the Windows 7 firewall, and how
does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
I use windows firewall and MS essentials, works fine.
While checking outgoing traffic does no harm, it seems to me if something
is on your maching sending out you've got a problem.
 
S

s|b

So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use?
I decided years ago that Free ZA was (is) crap and traded it for Sygate
Personal Firewall. When support for Sygate dropped I started using
Online Armor Free. Now it seems OA conflicts with avast!, so maybe I'll
start using an alternative like Privatefirewall.

I don't use W7's firewall, but I just read it it's capable of Outbound
Protection:
<http://www.addictivetips.com/windows-tips/windows-7-firewall-outbound-protection/>

Seems easy enough.

Anyway, if you're behind a router with NAT and a built-in firewall, then
you don't really need a firewall and W7's firewall will certainly
suffice. Your choice...
 
G

Gordon

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
.pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
If you're behind a NATS router then the Windows 7 Firewall is all you need.
Anything else is paranoia.....
 
R

rfdjr1

I decided years ago that Free ZA was (is) crap and traded it for Sygate
Personal Firewall. When support for Sygate dropped I started using
Online Armor Free. Now it seems OA conflicts with avast!, so maybe I'll
start using an alternative like Privatefirewall.

I don't use W7's firewall, but I just read it it's capable of Outbound
Protection:
<http://www.addictivetips.com/windows-tips/windows-7-firewall-outbound-protection/>

Seems easy enough.

Anyway, if you're behind a router with NAT and a built-in firewall, then
you don't really need a firewall and W7's firewall will certainly
suffice. Your choice...
Okay, thanks. I use a Linksys N router and settings that I can see offhand are

router username:*****
router password: ******
network name (SSID): ********
network security type: Higher Security (WPA / WPA2)
network security key: *********
connection type: Keep Alive

Does that tell you if it's safe to not use a software firewall? What is the NAT
you mention? I don't see it on any of the tabs in the software for the router. I
set it up when I bought it 3 years ago using the wizard. There is a box "SPI
Firewall Protection" checked disabled. I didn't set it like that. Is it a
problem?
 
R

rfdjr1

If you're behind a NATS router then the Windows 7 Firewall is all you need.
Anything else is paranoia.....
What is NATS other than the Washington baseball team? How do I know if my
Linksys router is NATS?
 
R

rfdjr1

What is NATS other than the Washington baseball team? How do I know if my
Linksys router is NATS?
I also just found this:

Filter Anonymous Internet Requests
Filter Multicast
Filter Internet NAT Redirection
Filter IDENT (Port 113)

Filter Anonymous Internet Requests is checked.
Filter Ident (Port 113) is checked.
 
P

Paul

Okay, thanks. I use a Linksys N router and settings that I can see offhand are

router username:*****
router password: ******
network name (SSID): ********
network security type: Higher Security (WPA / WPA2)
network security key: *********
connection type: Keep Alive

Does that tell you if it's safe to not use a software firewall? What is the NAT
you mention? I don't see it on any of the tabs in the software for the router. I
set it up when I bought it 3 years ago using the wizard. There is a box "SPI
Firewall Protection" checked disabled. I didn't set it like that. Is it a
problem?
http://en.wikipedia.org/wiki/Network_address_translation

192.168.1.2 Port 80 ---> NAT ---> 203.128.17.64 Port 1234
__. ---> 203.128.17.64 Port 4567
192.168.1.3 Port 80 /

192.168.x.x is a "private" address, and isn't intended to be "seen"
on the Internet. The Network Address Translation step, achieves that
goal. It's done inside your router. The source IP and port, are translated
in such a way, that the NAT knows where to send a returning response from
some server on the Internet.

If you wanted to run a web server on your home computer, you can
override NAT on the incoming direction. That's called "Port Forwarding".
Without Port Forwarding, depending on the type of NAT, an external
computer can't really talk to the home computer, unless it has some
connection already in place. So your typical home router, is set up
by default, to enable "web surfing", rather than running "servers"
from your basement.

SPI is "Stateful Packet Inspection". It's possible for an external
agent, to spoof a communications with your home gear. What they
can't know though, is what the "sequence number" is, of the most
recent connection going through the NAT. When you enable SPI,
it checks sequence numbers on the packets. If your normal web
surfing sent packets 1,2,3,4... and the sequence number coming
back was way out of sequence 3489, then the SPI would know
someone was trying to break in. Without SPI, it would presumably
be a bit easier to do.

http://en.wikipedia.org/wiki/Stateful_packet_inspection

Anyway, without getting all the details right, those
are some basic ideas. You get a small measure of security,
as soon as there's at least one router box in your home setup,
and you haven't done your utmost to defeat it :) For
example, if you enable DMZ on your home router, then
the script kiddies go wild.

http://en.wikipedia.org/wiki/DMZ_(computing)

"The DMZ host provides none of the security advantages that a
subnet provides and is often used as an easy method of forwarding
all ports to another firewall / NAT device"

Some people use DMZ on their router, when they want a single
machine in the home to function as a "game server" and need
a whole bunch of ports open. At one time, home routers didn't
support the insertion of very many port forwarding rules, and
DMZ was a quick and easy way to "bust a hole" in NAT. But also,
a dangerous thing to do. Someone could send a "ping of death"
to your game server, and knock it over.

Suffice to say, with all the stuff we have access to now, there
can be some overlap in the protections provided. The "ship" we
float in, still leaks, but the holes aren't as large.

Paul
 
D

Dave \Crash\ Dummy

Dave said:
I use windows firewall and MS essentials, works fine. While checking
outgoing traffic does no harm, it seems to me if something is on
your maching sending out you've got a problem.
I'm with you. I figure blocking outbound traffic is like closing the barn
door after the Trojan horse is already in the barn. For that matter,
unless you are running a server, if your computer is set up properly,
you don't really need inbound protection.
 
P

Paul

I also just found this:

Filter Anonymous Internet Requests
Filter Multicast
Filter Internet NAT Redirection
Filter IDENT (Port 113)

Filter Anonymous Internet Requests is checked.
Filter Ident (Port 113) is checked.
Ident doesn't need to be filtered.

It can be port forwarded, to a non-existent IP address like 192.168.1.200
That's what I do with mine.

What matters in that case, is the definition of "Filter". If
"Filter" means "Send a NACK", then that's bad. Because that
ruins the stealthy nature of your IP address. If Filter
instead meant, "forward to a known non-existent IP address",
or "toss in the bit bucket", then such an idea would be useful
and safe.

The advantage of port forwarding, is there shouldn't be a response from
your home network on receipt of that IDENT packet, unless you actually
had a computer at 192.168.1.200 :)

In fact, checking now, the *only* Port Forwarding rule on my router,
is for the handling of Ident 113, and forwarding to a known non-existent
home computer address. Since I use DHCP for serving private addresses,
and know the range of addresses (192.168.1.2 ... 192.168.1.5) to expect
when DHCP is used, I can easily miss that range entirely, when
Port Forwarding IDENT 113 incoming packets.

Paul
 
A

Anthony Buckland

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
.pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
I use Zone Alarm, with satisfaction, and keep the Windows
Firewall turned off so it won't get in ZA's way.
 
S

Stephen Wolstenholme

I've had Windows 7 Pro, 64 bit installed on my machine for two years now. Ihave
never used the Windows firewall, opting instead for the free version of Zone
Alarm, which I've used for many year without a porblem. As of late, Zone Alarm
is causing me headaches, not remembering settings and denying downloads of files
without telling me why. An example of this is today, I was trying to download a
.pdf file of an owners manual, and it kept crashing. After about a dozen tries,
it dawned on me to shut down Zone Alarm, and sure enough, the file downloaded
with no problems. So, I'm now wondering how reliable is the Windows 7 firewall,
and how does it match up to Zone Alarm? Also, how easy is it to use? Thanks.
I have used Windows Firewall with Advanced Security for a long time.
It provides sets of both Inbound and Outbound rules. It needs no
attention.

Steve
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top