What You Should Know About Firewalls

Scott Rolf knows trouble when he sees it. An IT director for a law firm near Cleveland, Ohio, Rolf was asked by a friend to check out the new Web site the friend had put up on a DSL-connected Web server. Rolf did more than just visit his friend's site; he quickly found that the server lacked any sort of firewall protection. It took less than five minutes for Rolf to exploit a well-known Windows NT vulnerability and e-mail to his friend a complete listing of files and directories from the server's hard disk.

"He called me a few minutes later and said 'Holy cow, what do I do?' He was at work and couldn't turn the server off," Rolf laughs. "I think he went out and bought a Linksys firewall box."

As the name implies, a firewall acts as a barrier between your PC and the Internet. Firewalls not only prevent unauthorized access to your PC or network, they also hide your Internet-connected PC from view.

Firewalls have long been a fixture at large companies, which must secure their networks against determined attackers. But the dangerous surge in e-mail- and Web-borne threats--including viruses, worms, hijacks, and increasingly aggressive spyware--means that home PCs require this protection as well.

Don't believe me? Consider this. According to the Internet Storm Center, a typical unprotected PC will come under attack within 20 minutes of being connected to the Internet. That is not a misprint. In less time than it takes most people to shower and get dressed in the morning, your PC will probably attract some form of unwelcome advance.

Johannes Ullrich, chief technology officer at the Internet Storm Center, says the situation is so bad that a newly connected PC won't have time to download all the Windows patches needed to make it secure before malicious software has found and infected it. The time to attack is even shorter for PCs on high-speed university networks and cable or DSL services. Hackers specifically target these addresses--much the way car thieves target Honda Accords--for their high bandwidth and always-on nature. It's a digital catch-22. The better your connection, the bigger your risk.

Fired Up

Alas, it seems that too few people have well-meaning--if overly inquisitive--friends like Rolf. Alan Paller, director of research for The SANS Institute, an organization dedicated to Internet security issues, says most home users don't have any firewall protection in place. That leaves connected PCs exposed to all manner of intrusion and attack.

The good news for cable and DSL customers is that firewalls are cheaper to buy and easier to use than ever. And adoption is picking up, according to forecasts by In-Stat/MDR, a market research firm. Sales of consumer firewalls are expected to rise from $455 million in 2003 to $1.8 billion in 2007, in part because firewall functions are being built into all sorts of consumer network gear. and "I don't even think there are any routers that don't have basic firewall protection," says Ullrich.

Firewalls actually come in two distinct flavors: software applications that run in the background, and hardware devices that plug in between your modem and one or more PCs. Both types hide your PC's presence from other systems, prevent unauthorized access from external sources, and keep tabs on network traffic across the firewall.

While software applications can be less expensive--Microsoft has improved the firewall software in Windows XP Service Pack 2, and both ZoneAlarm and Sygate Personal Firewall are free for download--a hardware firewall usually does a better job for broadband users. (For more on software firewalls, see the accompanying story "Internal Defense.")

If you're networked, you probably haven't bought a separate hardware firewall box. Rather, your wireless access point or network router that links multiple PCs can have firewall capability conveniently included. The $85 Netgear WGT624 108Mbps Wireless Firewall Router is a high-speed 802.11g Wi-Fi access point, router, and firewall that offers excellent protection against and tracking of external threats. Similar Wi-Fi products include the $85 D-Link DI-624 and the $70 to $80 Linksys WRT54G.

In the wired arena, firewall-capable routers include the Netgear FVS318NA VPN Firewall router with eight-port switch, about $100, and the Linksys BEFSX41 Instant Broadband EtherFast Cable/DSL Firewall Router, about $70, which provides four ethernet ports.

Matt Neely, a computer security expert for a major financial firm, says you can find bare-bones firewall devices for even less. "You can get a decent one on sale for 10 or 20 bucks," says Neely. "They make a great gift. I give them out like candy on the holidays."

What They Do, What They Don't

Don't make the mistake of buying a firewall and thinking your security problems are solved. Firewalls may be great at stopping unwanted intrusions, but they often do little or nothing to detect virus-laden e-mails or stop intrusive adware and spyware. You'll want separate antivirus and spyware checkers to stymie these threats. What's more, hardware firewalls usually won't manage outbound traffic, which means a piece of spyware can freely send data from your PC to a server on the Internet.

So what do hardware firewalls do exactly? More than anything, they stymie inquisitive software that pings, sniffs, and queries IP addresses in the hopes of finding a wide-open system. To do this, hardware firewalls employ numerous functions. Among them:

Network address translation: Every system on the Internet needs an IP address--like a phone number for computers--which is used to forge links with other systems across the network. NAT foils unauthorized connections by giving PCs behind the firewall a set of private addresses, while presenting to the world a single, public address. The switcheroo makes it difficult for others to reach through the firewall to an individual PC.

Port management: By default, most hardware firewalls close unsolicited access to all ports (akin to doors in a hallway) on your connected PC. So if a piece of software locks onto your IP address and tries to form a connection with TCP port 80 (used for Web connections) or TCP port 25 (used for outbound e-mail), the firewall would ignore the request. As far as the inquiring software can tell, there is simply nothing there. By the same token, firewalls can let you open specific ports (an action known as port forwarding), so a multiplayer game can link up with other systems across the Internet or a Web camera can send a video stream to view on the Internet.

Stateful packet inspection: An important security feature, SPI digs deep into the packets used to encapsulate data traversing the network. The result: A firewall can do more than simply prohibit packets from a specific source and take action based on the content or behavior of packets. For instance, an SPI firewall can tell if an incoming packet was unsolicited (and therefore, unwanted) or if it arrived in response to a request from the local network (in which case it would be allowed through).

Virtual private networking: A method for establishing encrypted, point-to-point connections across the Internet, VPNs are widely used among businesses for giving remote employees access to local networks. The problem is, a good firewall will block the encrypted connection between the remote device and the local VPN software. Firewalls with VPN support can pass through these encrypted links.

Activity logging and alerts: One area where hardware firewalls can vary greatly is in their ability to track, record, and report the activity fielded by the device. If you need finely detailed information about network activity, make sure to check reviews for products that offer the most comprehensive and useable activity logging and alerting features.

Content and URL filtering: Firewalls can also offer higher-level features--for instance, blocking access to URLs with a specified string of letters in their URL (think "XXX") or to any sites that fall outside of a list of accepted Web domain names.

PC security expert Neely suggests pairing a hardware firewall with a free software firewall application, such as ZoneLabs' ZoneAlarm. Software firewalls can detect which applications are trying to send data over the Internet and prompt users to allow or disallow the activity. So when a previously unknown program asks for Internet access, you can dig down and see if that application might actually be spyware. Adjustable alert levels mean you can flag every access for review or simply allow all traffic through by default. Also, hardware firewalls can't plug into analog modems, which means a software firewall is the best option for most dial-up Internet users and so will all users someday have PCs protected by firewalls? If Scott Rolf has his way, absolutely.

"I preach it so loudly that most of them already have a firewall, and if they don't I've given them ZoneAlarm."

Michael Desmond is author of Microsoft Office 2003 in 10 Simple Steps or Less. He worries that it won't be long before every kitchen appliance will need a firewall.