This is the blog of Adam Kalsey. Unusual depth and complexity. Rich, full body with a hint of nutty earthiness.
This is the blog of Adam Kalsey. Unusual depth and complexity. Rich, full body with a hint of nutty earthiness.
8 Oct 2003
I’m having trouble getting a Linksys USB wireless adapter to connect to my network, so I called Linksys tech support. Besides not fixing my problem, the support tech told me repeatedly that I don’t need to use a firewall because my Linksys router contains one.
Many vendors of home networking equipment advertise that their broadband routers contain a built-in firewall to enhance security. What they are referring to is a technology called Network Address Translation (NAT). A NAT router simply denies incoming traffic that it doesn’t understand. That’s one function of a firewall, but not the only one.
NAT is the technology that lets more than one computer share an Internet connection with only a single IP address. The Internet Connection Sharing feature that comes with recent versions of Windows is a NAT router. A very simplistic description of how NAT works is that none of the computers behind the router is on the public Internet. The router forwards outgoing requests from computers out to the Internet. When the server replies, the NAT router remembers which machine it was that made the request and forwards the reply back to it.
If network traffic comes into the NAT router that isn’t the result of a machine making an outbound request, the NAT router doesn’t know where to send that network traffic. So that traffic gets ignored. It doesn’t get sent anywhere at all. The fact that an outside computer can’t arbitrarily connect to computers behind the NAT router is a byproduct of how NAT works and is why the router companies call their products firewalls.
The protection offered by NAT is very limited. It will keep an attacker from sending Messenger popup spams to your computer. It will keep people from connecting to services and backdoors installed on your computer. But it won’t keep trojans, viruses, and other malicious software from connecting to the Internet from your computer. It won’t prevent unauthorized network traffic from leaving your computer and going onto the Internet. That’s what modern firewalls do.
I know someone will point out that my description of NAT is a gross simplification and isn’t entirely accurate, so I’m going to mention up front that I know that. But it does explain the concepts of NAT, why vendors call it a firewall, and why it isn’t good enough security by itself. If you want, you can read more about how NAT works, including all sorts of highly technical details about packet routing, different forms of NAT, and how Linux implements NAT. Netgear also makes a home router that also contains a true firewall, so their Web site explains the differences.
The free version of ZoneAlarm works well, and the Pro version is only $40. Recent releases of ZoneAlarm Pro have been aimed at the consumer with privacy protections and ad-blocking features built in. But Pro is also useful if you need more control over your network settings, like allowing machines from certain subnets to access your computer but denying all others.
Excerpt: A NAT router cannot is protect computers on your network from the other computers on your network.
Thanks Adam. The problem I had with ZA free in my last PC was a conflict with the Linksys router, but also this PC is running WinXP which has a firewall running too. Do you have any good references (mag articles or similar) that explore this topic in more detail?
Bill,
Kevin Rose and the TechTV staff recently reviewed firewalls. Their top picks were ZoneAlarm Pro and McAfee Personal Firewall Plus. The article is at http://www.techtv.com/screensavers/products/story/0,24330,3522872,00.html
I personally run the D-Link 604 (4 port, NAT, no SPI) and the free version of ZoneAlarm. I can’t say that I’ve taken issue with anything (although I generally “unload” ZA when playing games online, and DMZ my comp when hosting (56K modem players playing Sierra’s Swat3 complain of lag when playing games hosted by a firewalled host)). I don’t think that ZA and the router are working the best together (could be better, I suppose), but I can’t complain.
What specific problem did you find with ZA free and the Linksys router?
Problem was my PC could not see the Internet, mail and browser didn’t work, but this was intermittent yet frequent. That PC was running Win2000 and I’ve recently moved to WinXP, so perhaps the builtin firewall in XP is good enough on top of the NAT?
I have a question regarding Zonealarm and a NAT Router. How do you differentiate between another computer an the network and the actual internet connection? In other words how do I separate the internat connection (dsl) into the internet zone and the other computers on my network into the trusted zone? Since zonealrm sees them as the same network.
Unistall Zone Alarm while establishing internet connection then reinstall and it will detect the connection. Set the internet connection as “internet” when Zone Alarm asks not “trusted”. Set LAN connections as “trusted”.
the thing is tho, wether you have a hardware firewall (router), or a software firewall, you have to allow some ports in (for games, software, or p2p)… and thats where they get you.. i currently have 5ports forwarded to my family pc and 200 to my personal pc… and thats how the intruders will get in, by finding those ports, other then that, your safe from external..and configuring those ports is a PAIN with software firewall, with linksys its REALLY easy http://members.shaw.ca/short1_main/firewall.jpg true you cant stop traffic out, like zonealarm, but if your computer has good av and spyware protection, you dont need to.
https://www.grc.com/x/ne.dll?bh0bkyd2
on my linksys 4port router w/ wireless (b), all my ports are stealthed except 1, and i am thinking on getting that one stealthed to, whereas many software firewalls just close, not stealth.
Like Windows Firewall. cough
You are under the assumption that because it only acts in one direction, it can’t be termed a firewall.
Windows Firewall is a firewall. Just as nat routers double as firewalls. Perhaps, not as complete as Kerio Personal Firewall, ZA, Cisco PiX, etc. But, a firewall.
And not only are nat routers firewalls, they are very good firewalls. They stealth every port by default.
”…It will keep people from connecting to services and backdoors installed on your computer. But it won’t keep trojans, viruses, and other malicious software from connecting to the Internet from your computer. It won’t prevent unauthorized network traffic from leaving your computer and going onto the Internet. That’s what modern firewalls do.…”
If one is conducting online firewall tests(ShieldsUp or pcflank) from behind a NAT router ,are results affected? How to get around it?(I use Netveda as software firewall).
Adam Kalsey
Mobile: 916.600.2497
Email: adam AT kalsey.com
AIM or Skype: akalsey
©1999-2010 Adam Kalsey.
Content management by Movable Type.
Adam Kalsey
BillSaysThis
October 8, 2003 1:43 PM
But what piece of (preferably free or at least low cost) software is the appropriate addition to the router’s protection?