Implementing Third-Party Firewall Software

Windows Firewall doesn't implement outbound filtering capabilities by default, and making it do so (using Windows Firewall with Advanced Security) is best left in the hands of a seasoned system administrator. For that reason most users should consider making the switch to third-party firewall software that includes both inbound and outbound filtering capabilities. Some of the more popular personal firewall packages available for Windows Vista include:

• ZoneAlarm. Available from http://www.zonelabs.com, ZoneAlarm comes in both paid and free- for-personal-use editions.

• AVG Plus Firewall Edition. Available from http://www.grisoft.com, this product combines AVG's popular antivirus product with a personal firewall. AVG Plus Firewall Edition costs approximately $50 (for a 2-year subscription) after a free 30-day trial period.

• McAfee Personal Firewall Plus. Available from http://www.mcafee.com, McAfee Personal Firewall Plus costs approximately $40 after a free 30-day trial period.

• Norton Internet Security. Available from http://www.symantec.com, Norton Internet Security costs approximately $50 after a free 15-day trial period.

All of the personal firewall packages in the preceding list offer both inbound and outbound filtering capabilities, including the free-for-personal-use editions, as applicable. The paid versions of each program tend to include a variety of advanced and value-added security features, such as virus scanning, privacy tools, cookie management capabilities, and more.

Caution 

Prior to purchasing any personal firewall program for your Windows Vista system, review its system requirements carefully. To function correctly, the program must be designed for compatibility with Windows Vista. As a general rule, older firewall programs (including those designed for Windows XP) do not work with Windows Vista. If you purchased firewall software for an older PC and want to keep using it, contact the vendor to see whether an update or upgrade to a Windows Vista-compatible version is available.

Every personal firewall product functions in a slightly different manner, and includes different features and capabilities. However, some of the key features of personal firewall software packages include the capability to:

• Allow or deny specific programs or services from making outbound or receiving inbound connection attempts. You can configure a single program to allow it to make outbound connections and not to receive inbound connections, or a combination thereof.

• Have the firewall alert you every time a new program attempts to access the Internet. When a program attempts to access the Internet for the first time, an on-screen message appears alerting you to the action. You are prompted to allow or deny the program, and can typically select an option to have the firewall remember your choice, avoiding additional prompts for that specific program or service in the future.

• Alert you whenever an outside user attempts to make a connection attempt to your PC. Most firewall programs alert you with an on-screen message any time that an outside user attempts to connect to your PC. Not only does the message provide you with details like the IP address of the remote user, but also the specific port to which the connection was attempted. Some firewalls even let you know about specific security exploits that relate to the connection attempt, helping to keep you well informed about potential threats. You can typically turn off on-screen alert messages if you don't want to be informed of every connection attempt; details are stored in a log file for future reference instead.

• Enable different security settings for programs attempting to communicate on your home network or the Internet. For example, you might configure your firewall such that file and printer sharing inbound connection attempts from other computers on your home network are always allowed, whereas those originating from the Internet are always denied. In some firewall programs, your home network is referred to as the trusted zone.

• Allow incoming or outgoing connections by TCP or UDP port numbers, ranges of IP addresses, and more.

Beyond configuring inbound and outbound connection settings for different programs and services, many personal firewall programs allow you to configure a wide range of advanced security settings that can better protect your Windows Vista system. Some of the more popular options include the capabilities to:

• Password-protect the configuration of your firewall. When password protection is enabled, only a user who supplies the correct password can change the firewall's configuration settings.

• Stop all inbound and outbound traffic instantly by clicking the Stop All Traffic button.

• Control whether certain programs and services are allowed to start at all, and whether a particular program has the capability to launch another.

• Configure custom rules that allow or deny certain types of inbound or outbound traffic.

All of the personal firewall packages available for Windows Vista include different advanced features and capabilities. Prior to settling on any one particular firewall, test some of the alternatives available to determine which best meets your needs. You may find that you prefer one firewall's interface to another's, or deem one easier to use than the rest. As one of the most important pieces of software installed on your computer, it's imperative that you pick a firewall package that you feel comfortable with-there's nothing worse than fighting with a program that you find annoying or hard to use.

Hardware Firewalls

If you're the proud owner of a broadband (DSL, cable, or satellite) Internet connection and a home network, then you're probably using a hardware router of some sort to share your Internet connection. Home routers come in both wired and wireless varieties, and ultimately act as an intermediary between your home network and the Internet. An example of a hardware router designed for home users is shown in the following figure.

In addition to allowing you to share your broadband Internet connection among computers on your home network, these devices also include an integrated firewall component, leading many people to refer to them as a hardware firewall.

By default, the firewall components of these routers behave in a manner very similar to Windows Firewall. They deny all incoming connection attempts from Internet users by default, but allow all outgoing traffic to find its way onto the Internet, unrestricted. This tends to be the best default option for inexperienced users who want the security protection that a firewall provides in stopping Internet users from accessing their network, but still want to surf the Internet without restriction.

Unlike Windows Firewall, however, a hardware firewall typically enables you to control not only what can enter your network, but also what can leave it destined for the Internet. For example, imagine that you want to restrict access to the Internet to allow only web surfing and sending e-mail messages. With a hardware firewall, you could configure rules that would allow only these types of outbound Internet access, and restrict all others, for example. The capability to configure these types of rules is especially helpful if your goal is to stop users on your network from accessing file sharing services, online multiplayer games, or even instant messaging chats.

Some hardware firewalls even enable you to schedule rules so that they only apply during certain times of the day. For example, you might configure your firewall with a scheduled rule that denies all Internet access from 3 to 8 p.m., and then allow complete access from 8 to 10 P. M. If you're looking for a way to keep the kids from surfing when they should be doing their homework, this technique works perfectly. Making things better still is the ability to apply rules to certain PCs only, ensuring that other computers still have unrestricted access as required.

Certainly a hardware firewall is a powerful device, and can offer great protection when correctly configured. However, you shouldn't expect your hardware firewall to alert you to configuration issues or settings in the same manner as a software firewall. Additionally, you may occasionally run into problems when attempting to run both a hardware and software firewall on the same network. For example, if you have a hardware firewall in place and have Windows Firewall enabled on your Windows Vista system at the same time, you may occasionally run into problems, the most common where you want to allow inbound access into your network by an Internet user, perhaps to play an online game. Configuring an exception for the game in Windows Firewall is not enough-you also need to open the appropriate ports on your hardware firewall to allow traffic through, or it will never reach your Windows Vista system.

Consult your router's user manual for more details on configuring its firewall features and settings. For details on allowing inbound access through your hardware firewall, you can also consult the step-by-step instructions available online at http://www.portforward.com.